6 ms·

As most of you know, these anti-cheat systems are functionally equivalent to rootkits. There is zero visibility into how these privileges are used for targeted

by bflesch 11mo ago

As most of you know, these anti-cheat systems are functionally equivalent to rootkits. There is zero visibility into how these privileges are used for targeted attacks. Due to geographic location of the large game companies this has a geopolitical angle. Fingerprinting of devices and the networks they are in provides a lot of metadata that is most definitely fed into their intelligence apparatus.

pmarreck 11mo ago
I remember trying to install Valorant for the first time, and its ridiculously invasive anticheat kernel mod (or whatever it's called) gave me my first blue (or was it red??) screen I'd seen on Windows in years. Immediately uninstalled it and haven't ever played Valorant to this day. Fuck that crap, if your community is so toxic that you need a rootkit to keep cheaters at bay, then maybe it's more of a community problem than a technological one. And yes, if this means that you have to block all of China in order to do so, then that is still a community problem. Put your rootkits on your Chinese servers, separate them out, and let the cheaters fight amongst themselves.
- xeonmc 11mo ago
  Is it any coincidence that such state is from the same company behind League of Legends?
- philipallstar 11mo ago
  > if your community is so toxic that It's nothing to do with a toxic community.
  - ohdearnopls 11mo ago
    It might not be the sole reason (and most likely isn’t), but toxic communities breed these sort of behaviours, especially in games that are extremely hostile to casual players.
surajrmal 11mo ago
Unpopular opinion, but we would be better off with a single open trusted implementation of anti cheat (aka drm) which can attest whatever requirements are desired by the game is met. The only real problem is that it would likely be limited to approved kernel images and someone would need to own that validation and signing infrastructure, but you could imagine having multiple trusted entities have this role.
- bflesch 11mo ago
  Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state. Cheating is a meat space problem and there is no technical solution to it. Thats why in tournaments there are referees standing behind the players. Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that.
  - maccard 11mo ago
    > Cheating is a meat space problem and there is no technical solution to it Cheating is an arms race - the number of people who are willing to run a second computer with DMA connected to a single machine is vastly smaller than the number of people who are wiling to download a dodgy file from the internet and run it. > Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that. If it was that easy, cheating would be a solved problem. An awful lot of play is "I know the reload time is 0.75s, so they're going to appear when they've reloaded" - that's way beyond human reaction time. And that's at "mid level" play - at gold/sliver levels in league of legends knowing cooldowns is considered base knowledge. At higher levels of play, _all_ of your players are statistical outliers.
    - sudosysgen 11mo ago
      This hasn't been true for a very long time. The kind of cheats that can survive even very basic anticheat for a long time cost a decent amount of money on subscription basis. Most cheaters by volume pay quite a chunk of change to cheat.
deleted 11mo ago
[deleted]
az09mugen 11mo ago
Yes, and more than that, the kernel-level-anticheats are unable to spot someone using a Cronus ( hardware aim assist among other stuff [0] ). I'm never going to play again online on any FPS because that whole incoherent bubble of crap disgusts me. The multiplayer games community is toxic, and players are focused on success whatever the cost is. And I don't even want to touch the question of match making with a 10-foot-pole. Local, self-hosted or in small community is the best. [0] https://cronus.shop/ https://cronus.shop/
- officeplant 11mo ago
  >Local, self-hosted or in small community is the best. It always makes me happy to fire up Quake via Darkplaces or even ioQuake3 and still see servers up and people playing.
stephen_cagle 11mo ago
I'm curious, do they have to be? Would it be possible to boot the program + the anti cheat into it's own VM or something? So they know I am running on trusted hardware, but I know that the aren't reading my emails? Genuinely curious and don't know the answer to this.
- bflesch 11mo ago
  The anticheat will try to detect the VM and it will give a warning, so that's not a solution. Ideally keep leisure time devices and work devices separate. Consoles are a good solution because you are never tempted to use your emails on those. But also you need to think about who your adversary is. Other countries have access to all your icloud mail and photos all the time. Something like dropbox and onedrive is scanned and catalogued in the background. Hardware supply chain is a difficult topic and each layer of abstraction has their own mini operating system in the firmware, and past has shown many of them have backdoors.

by bflesch 11mo ago

pmarreck 11mo ago

I remember trying to install Valorant for the first time, and its ridiculously invasive anticheat kernel mod (or whatever it's called) gave me my first blue (or was it red??) screen I'd seen on Windows in years. Immediately uninstalled it and haven't ever played Valorant to this day. Fuck that crap, if your community is so toxic that you need a rootkit to keep cheaters at bay, then maybe it's more of a community problem than a technological one. And yes, if this means that you have to block all of China in order to do so, then that is still a community problem. Put your rootkits on your Chinese servers, separate them out, and let the cheaters fight amongst themselves.

xeonmc 11mo ago
Is it any coincidence that such state is from the same company behind League of Legends?
philipallstar 11mo ago
> if your community is so toxic that It's nothing to do with a toxic community.
- ohdearnopls 11mo ago
  It might not be the sole reason (and most likely isn’t), but toxic communities breed these sort of behaviours, especially in games that are extremely hostile to casual players.

surajrmal 11mo ago

Unpopular opinion, but we would be better off with a single open trusted implementation of anti cheat (aka drm) which can attest whatever requirements are desired by the game is met. The only real problem is that it would likely be limited to approved kernel images and someone would need to own that validation and signing infrastructure, but you could imagine having multiple trusted entities have this role.

bflesch 11mo ago
Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state. Cheating is a meat space problem and there is no technical solution to it. Thats why in tournaments there are referees standing behind the players. Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that.
- maccard 11mo ago
  > Cheating is a meat space problem and there is no technical solution to it Cheating is an arms race - the number of people who are willing to run a second computer with DMA connected to a single machine is vastly smaller than the number of people who are wiling to download a dodgy file from the internet and run it. > Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that. If it was that easy, cheating would be a solved problem. An awful lot of play is "I know the reload time is 0.75s, so they're going to appear when they've reloaded" - that's way beyond human reaction time. And that's at "mid level" play - at gold/sliver levels in league of legends knowing cooldowns is considered base knowledge. At higher levels of play, _all_ of your players are statistical outliers.
  - sudosysgen 11mo ago
    This hasn't been true for a very long time. The kind of cheats that can survive even very basic anticheat for a long time cost a decent amount of money on subscription basis. Most cheaters by volume pay quite a chunk of change to cheat.

deleted 11mo ago

[deleted]

az09mugen 11mo ago

Yes, and more than that, the kernel-level-anticheats are unable to spot someone using a Cronus ( hardware aim assist among other stuff [0] ). I'm never going to play again online on any FPS because that whole incoherent bubble of crap disgusts me. The multiplayer games community is toxic, and players are focused on success whatever the cost is. And I don't even want to touch the question of match making with a 10-foot-pole. Local, self-hosted or in small community is the best. [0] https://cronus.shop/ https://cronus.shop/

officeplant 11mo ago
>Local, self-hosted or in small community is the best. It always makes me happy to fire up Quake via Darkplaces or even ioQuake3 and still see servers up and people playing.

stephen_cagle 11mo ago

I'm curious, do they have to be? Would it be possible to boot the program + the anti cheat into it's own VM or something? So they know I am running on trusted hardware, but I know that the aren't reading my emails? Genuinely curious and don't know the answer to this.

bflesch 11mo ago
The anticheat will try to detect the VM and it will give a warning, so that's not a solution. Ideally keep leisure time devices and work devices separate. Consoles are a good solution because you are never tempted to use your emails on those. But also you need to think about who your adversary is. Other countries have access to all your icloud mail and photos all the time. Something like dropbox and onedrive is scanned and catalogued in the background. Hardware supply chain is a difficult topic and each layer of abstraction has their own mini operating system in the firmware, and past has shown many of them have backdoors.