4 ms·

Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and

by bflesch 11mo ago

Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state. Cheating is a meat space problem and there is no technical solution to it. Thats why in tournaments there are referees standing behind the players. Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that.

maccard 11mo ago
> Cheating is a meat space problem and there is no technical solution to it Cheating is an arms race - the number of people who are willing to run a second computer with DMA connected to a single machine is vastly smaller than the number of people who are wiling to download a dodgy file from the internet and run it. > Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that. If it was that easy, cheating would be a solved problem. An awful lot of play is "I know the reload time is 0.75s, so they're going to appear when they've reloaded" - that's way beyond human reaction time. And that's at "mid level" play - at gold/sliver levels in league of legends knowing cooldowns is considered base knowledge. At higher levels of play, _all_ of your players are statistical outliers.
- sudosysgen 11mo ago
  This hasn't been true for a very long time. The kind of cheats that can survive even very basic anticheat for a long time cost a decent amount of money on subscription basis. Most cheaters by volume pay quite a chunk of change to cheat.
cortesoft 11mo ago
This is theoretically possible, but I don't think most cheaters would have the equipment or skill to do this. Cheating is only rampant in games where people can just buy and download cheats... if it requires a lot of skill and hardware, it won't be a big issue.
- sudosysgen 11mo ago
  It's not just theoretically possible, you can buy kits that do this already.
bangaladore 11mo ago
> Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state. Incorrect. DMA (direct memory access) is and can be prevented [1] and detected [2]. [1] https://www.faceit.com/en/news/faceit-rollout-of-tpm-secure-boot-iommu-and-vbs?cp=welcome-landing https://www.faceit.com/en/news/faceit-rollout-of-tpm-secure-... [2] https://community.osr.com/t/detecting-pcie-dma-based-cheating-hardware-in-online-games/55899 https://community.osr.com/t/detecting-pcie-dma-based-cheatin...
- sudosysgen 11mo ago
  You can still do DMA cheating with IOMMU enabled. There are quite a few relatively widespread bugs with IOMMU that allow you to bypass it, for example https://cloud.google.com/blog/products/gcp/fuzzing-pci-express-security-in-plaintext https://cloud.google.com/blog/products/gcp/fuzzing-pci-expre.... So to be able to actually do IOMMU DMA protection you need to be willing to ban many popular devices. That may be viable for FACEIT and ESEA but it won't be for 99.9% of anticheat deployments. The detection for DMA cheating is based on the DMA engines being unable to emulate 1:1 the actual behavior the hardware ID would be expected to have. This can be fixed by simply doing that properly. But even besides that, DMA through PCIe is just one hardware cheat that fits a separate thread model and therefore has some countermeasures. There are much more robust methods you can use, for example a PCIe interposer between the OS and GPU, or simply direct memory interposes if you want to do DMA without the protections afforded by the PCIe implementation. There are interposets along with machinery to get along memory encryption and other obfuscations that can be made for around 100$.
- vablings 11mo ago
  Once again back to another arms race. Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this) physical access to the hardware is just a function of time and money to get direct access to the memory https://x.com/danielgenkin/status/1989003973429268974?s=12 https://x.com/danielgenkin/status/1989003973429268974?s=12 Something like TEE.fail can be used to read encryption keys for network traffic then a MITM proxy can display player information easily on a second PC, you will never be able to reliably detect this

by bflesch 11mo ago

maccard 11mo ago

> Cheating is a meat space problem and there is no technical solution to it Cheating is an arms race - the number of people who are willing to run a second computer with DMA connected to a single machine is vastly smaller than the number of people who are wiling to download a dodgy file from the internet and run it. > Ultimately it comes down to checking if metrics like reaction speed are humanly possible, but a rootkit is not really needed for that. If it was that easy, cheating would be a solved problem. An awful lot of play is "I know the reload time is 0.75s, so they're going to appear when they've reloaded" - that's way beyond human reaction time. And that's at "mid level" play - at gold/sliver levels in league of legends knowing cooldowns is considered base knowledge. At higher levels of play, _all_ of your players are statistical outliers.

sudosysgen 11mo ago
This hasn't been true for a very long time. The kind of cheats that can survive even very basic anticheat for a long time cost a decent amount of money on subscription basis. Most cheaters by volume pay quite a chunk of change to cheat.

cortesoft 11mo ago

This is theoretically possible, but I don't think most cheaters would have the equipment or skill to do this. Cheating is only rampant in games where people can just buy and download cheats... if it requires a lot of skill and hardware, it won't be a big issue.

sudosysgen 11mo ago
It's not just theoretically possible, you can buy kits that do this already.

bangaladore 11mo ago

> Kernel anticheat is not really effective because it can be circumvented on the hardware level, for example using direct memory access with a second computer and screen to show the hidden game state. Incorrect. DMA (direct memory access) is and can be prevented [1] and detected [2]. [1] https://www.faceit.com/en/news/faceit-rollout-of-tpm-secure-boot-iommu-and-vbs?cp=welcome-landing https://www.faceit.com/en/news/faceit-rollout-of-tpm-secure-... [2] https://community.osr.com/t/detecting-pcie-dma-based-cheating-hardware-in-online-games/55899 https://community.osr.com/t/detecting-pcie-dma-based-cheatin...

sudosysgen 11mo ago
You can still do DMA cheating with IOMMU enabled. There are quite a few relatively widespread bugs with IOMMU that allow you to bypass it, for example https://cloud.google.com/blog/products/gcp/fuzzing-pci-express-security-in-plaintext https://cloud.google.com/blog/products/gcp/fuzzing-pci-expre.... So to be able to actually do IOMMU DMA protection you need to be willing to ban many popular devices. That may be viable for FACEIT and ESEA but it won't be for 99.9% of anticheat deployments. The detection for DMA cheating is based on the DMA engines being unable to emulate 1:1 the actual behavior the hardware ID would be expected to have. This can be fixed by simply doing that properly. But even besides that, DMA through PCIe is just one hardware cheat that fits a separate thread model and therefore has some countermeasures. There are much more robust methods you can use, for example a PCIe interposer between the OS and GPU, or simply direct memory interposes if you want to do DMA without the protections afforded by the PCIe implementation. There are interposets along with machinery to get along memory encryption and other obfuscations that can be made for around 100$.
vablings 11mo ago
Once again back to another arms race. Assuming that your operating system doesn't allow any bad drivers (Windows does NOT do this) physical access to the hardware is just a function of time and money to get direct access to the memory https://x.com/danielgenkin/status/1989003973429268974?s=12 https://x.com/danielgenkin/status/1989003973429268974?s=12 Something like TEE.fail can be used to read encryption keys for network traffic then a MITM proxy can display player information easily on a second PC, you will never be able to reliably detect this