4 ms·

Very nice walk-through on the reverse engineering process. Also, they linked this post that made my jaw drop: https://www.unknowncheats.me/forum/anti-cheat-byp

Very nice walk-through on the reverse engineering process. Also, they linked this post that made my jaw drop: https://www.unknowncheats.me/forum/anti-cheat-bypass/667333-bannleeye-banning-arbitrary-players-using.html https://www.unknowncheats.me/forum/anti-cheat-bypass/667333-... Apparantly BattleEye anti-cheat had an exploit where hackers could permanently ban any player they wanted. BattleEye allowed anybody to log in as a "game server" so hackers simply booted up a fake server, told BattleEye that "player X has logged in and is doing a bunch of suspicious stuff" and then player X's account was no more... I'm sorry, why do we trust these guys again?

ronsor 1y ago
Because game companies force you to in order to play.
- seangrogg 1y ago
  Play dumb games, win dumb prizes.
ethan_smith 1y ago
This BattleEye exploit demonstrates a classic failure of trust boundary definition - they effectively created a system where client attestation was accepted without proper authentication or verification.
- gen6acd60af 1y ago
  >a classic failure of trust boundary definition - they effectively created a system where client attestation was accepted Can you elaborate? I'm unsure what a trust boundary definition means in this context and how it relates to attestation.
  - lightedman 1y ago
    trust boundary basically means a spot in execution where the trust level of code changes (aka privilege level) and thus needs reverification
  - close04 1y ago
    It means you trust something with lower trustworthiness without (re)validating, or even trusting it at all if the validation isn't all but guaranteed. The boundary is when you switch between levels of trust. Trusting something outside of your control is a good example. When your trusted game server trusts the untrusted game client when it says "trust me, it was a headshot" without validating this.
- cobbal 1y ago
  Fortunately they have a solution for trusting untrusted clients already! They just need to run an anti-cheat for their anti-cheat.
AHTERIX5000 1y ago
That's scary. I have an old Steam account with tons of games and already got banned once due to a bug in anti-cheat software and for a while my whole account was marked with a cheater tag. The bug was so widespread that developers eventually removed bans but I'm sure something similar could happen where problem goes undetected and it would be really hard to try to convince developers to lift a ban.
AnthonyMouse 1y ago
It's crazy that people allow this stuff to effectively run as root. One of these companies is going to have a vulnerability that lets other players run code on your machine in kernel mode.
- monster_truck 1y ago
  Happens about as often as games ship UI middleware that uses html and has xss, leading to an rce when the game leaves itself running as admin after an update. So basically all the time.
- pxc 1y ago
  It's kind of amusing to me how some PC gamers act superior to console gamers because PC gamers run their games on a flexible, customizable, general-purpose machine that the user controls rather than an appliance... and then immediately hand over control to half a dozen companies at a level that reduces "their" PC to a vendor-owned appliance anyway. If you are a PC gamer and run anti-cheat software like this, you should probably think of your gaming PC as a much more powerful and much jankier console, and avoid running or storing anything on it other than your games.
  - MisterTea 1y ago
    > and then immediately hand over control to half a dozen companies at a level that reduces "their" PC to a vendor-owned appliance anyway. This was not always the case. Also, the publishers lie about how invasive their software is - see the Sony rootkit fiasco.
    - pxc 1y ago
      > This was not always the case. I know. :( (Though, unfortunately, the SecuROM fiasco shows that this has sadly been going on a long time.) I say it's amusing, but it's a bitter thing for me, too.
  - ragequittah 1y ago
    You just dual boot. Windows is a joke itself even without the anticheat shenanigans so I use it like a toy. Any real work gets done in Luks encrypted Linux inaccessible to the Chinese company with a rootkit in my windows. Hopefully.
dogleash 1y ago
> I'm sorry, why do we trust these guys again? Anyone who's attachment to gaming is low enough to let things like this effect their purchase decisions are already out. To the devs/pubs, those customers don't even exist in the category of potential customers. So they just worry about not pissing off the existing customerbase by changing the status quo too much or too fast.
- meansob 1y ago
  [dead]

ronsor 1y ago

Because game companies force you to in order to play.

seangrogg 1y ago
Play dumb games, win dumb prizes.

ethan_smith 1y ago

This BattleEye exploit demonstrates a classic failure of trust boundary definition - they effectively created a system where client attestation was accepted without proper authentication or verification.

gen6acd60af 1y ago
>a classic failure of trust boundary definition - they effectively created a system where client attestation was accepted Can you elaborate? I'm unsure what a trust boundary definition means in this context and how it relates to attestation.
- lightedman 1y ago
  trust boundary basically means a spot in execution where the trust level of code changes (aka privilege level) and thus needs reverification
- close04 1y ago
  It means you trust something with lower trustworthiness without (re)validating, or even trusting it at all if the validation isn't all but guaranteed. The boundary is when you switch between levels of trust. Trusting something outside of your control is a good example. When your trusted game server trusts the untrusted game client when it says "trust me, it was a headshot" without validating this.
cobbal 1y ago
Fortunately they have a solution for trusting untrusted clients already! They just need to run an anti-cheat for their anti-cheat.

AHTERIX5000 1y ago

That's scary. I have an old Steam account with tons of games and already got banned once due to a bug in anti-cheat software and for a while my whole account was marked with a cheater tag. The bug was so widespread that developers eventually removed bans but I'm sure something similar could happen where problem goes undetected and it would be really hard to try to convince developers to lift a ban.

AnthonyMouse 1y ago

It's crazy that people allow this stuff to effectively run as root. One of these companies is going to have a vulnerability that lets other players run code on your machine in kernel mode.

monster_truck 1y ago
Happens about as often as games ship UI middleware that uses html and has xss, leading to an rce when the game leaves itself running as admin after an update. So basically all the time.
pxc 1y ago
It's kind of amusing to me how some PC gamers act superior to console gamers because PC gamers run their games on a flexible, customizable, general-purpose machine that the user controls rather than an appliance... and then immediately hand over control to half a dozen companies at a level that reduces "their" PC to a vendor-owned appliance anyway. If you are a PC gamer and run anti-cheat software like this, you should probably think of your gaming PC as a much more powerful and much jankier console, and avoid running or storing anything on it other than your games.
- MisterTea 1y ago
  > and then immediately hand over control to half a dozen companies at a level that reduces "their" PC to a vendor-owned appliance anyway. This was not always the case. Also, the publishers lie about how invasive their software is - see the Sony rootkit fiasco.
  - pxc 1y ago
    > This was not always the case. I know. :( (Though, unfortunately, the SecuROM fiasco shows that this has sadly been going on a long time.) I say it's amusing, but it's a bitter thing for me, too.
- ragequittah 1y ago
  You just dual boot. Windows is a joke itself even without the anticheat shenanigans so I use it like a toy. Any real work gets done in Luks encrypted Linux inaccessible to the Chinese company with a rootkit in my windows. Hopefully.

dogleash 1y ago

> I'm sorry, why do we trust these guys again? Anyone who's attachment to gaming is low enough to let things like this effect their purchase decisions are already out. To the devs/pubs, those customers don't even exist in the category of potential customers. So they just worry about not pissing off the existing customerbase by changing the status quo too much or too fast.

meansob 1y ago
[dead]