3 ms·

1 - kernel module from anti-cheats are weaponized by hackers. 2 - if I recall properly, that linux feature is a direct mapping of the target user process allow

by sylware 10mo ago

1 - kernel module from anti-cheats are weaponized by hackers. 2 - if I recall properly, that linux feature is a direct mapping of the target user process allowing extreme dynamicity in time, performant, and much more powerfull mechanisms than basic 'calls'. Namely hell for hackers if a live service game has a proper "security" team, all that without a kernel module.

dijit 10mo ago
What are you even talking about? The parent is right. I'm quite literally the first person to bash Windows for being a shitty operating system, but the requirement for signed modules puts a massive barrier to entry for cheaters, where Linux can load just about anything. If every system call can lie to you, there's a few things you can do, but it's not many. I know this because I've actually done a lot of due diligence on anti-cheat. One mechanism I attempted to employ was to replay initalisation vectors and determinism of inputs; this means I could replay your session out of band and witness the same outcomes. If there was variation then there's a fault. Except as soon as you introduce floating point numbers there's no more determinism... Oh well. The other was to watch for "impossible" things, but then you need to run full complex physics simulations for every client. If your game requires you to effectively buy an i7-11700k for every user then you'd have to sell your game for a lot more money, and limit how long they can play - nobody wants this. The third option was to score our best players and anyone who performs better than that gets their behaviour tracked. The problem is, coming up with a scoring system that's server side is much harder than you think. GameDevs don't actually like paying a shit load of money for anti-cheat (that also breaks their debugging systems and causes bugs: a wonderful combination)... so if you've got a better way: join the industry and fix it. You'll be a moderately wealthy person.
- sylware 10mo ago
  What are you talking about? 1 - kernel anti-cheats ARE weaponized by hackers. This is not a matter of discussion unless you are into the AI generated HN news conspiracy. 2 - this linux feature should provide (if I recall properly) a very complex and flexible (not limited to "calls"), and performant, set of interactions between a set of anti-cheat processes and the set of game processes. All that as being non-root priviledge (I think you must be have the same effective user id). The actual and real parameter is the level of competence and creativity of the "anti-cheat" team which is a requirement of any "live-service games" with frequent updates. 3 - for FPS games where aiming skill is critical, anti-cheat are close to useless due to "external" AI based aim assist hardware.
  - Thaxll 10mo ago
    1. They're not, not sure where you've seen that, not in western games at least.
    - esseph 10mo ago
      > "The researchers investigated the techniques used in online game cheating, as well as those deployed by ‘anti-cheat’ technologies. Most modern anti-cheat engines run in the Windows kernel, alongside applications such as anti-virus, at the highest levels of privilege. Software can only run in the Windows kernel if it has been approved and signed by Microsoft. This makes it more powerful than software run normally by the user. An example of kernel level software is the Crowdstrike system that recently failed, bringing down large parts of the internet." > "While the anti-cheats are allowed in the kernel by Microsoft, the study also revealed that cheat software commonly uses weaknesses in Windows protections to ‘inject’ itself into the kernel and gain higher privileges. Many techniques mirror what is commonly seen in the domains of malware and anti-virus, with a difference in motivation." > "This kernel injection technique has previously been observed in advanced ransomware attacks to disable anti-malware protections before the main attack." https://www.eurekalert.org/news-releases/1061994 https://www.eurekalert.org/news-releases/1061994
      - Thaxll 10mo ago
        None of that talk about exploiting anti cheats, nowhere. Not a single concrete example. The goal of cheats is to make money not to hack PCs.
        esseph 10mo ago
        https://www.threatshub.org/blog/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/ https://www.threatshub.org/blog/ransomware-actor-abuses-gens... > Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus
        sylware 10mo ago
        In the current state of things, YOU have to provide the proof a kernel anti-cheat is not weaponized by hackers (yet...). It is now common knowledge, kernel level anti-cheats are leveraged by hackers. And we all know this is fully hypocrit. "Computer security" does not exist, but for sure, adding a "gaming" _kernel module_ won't improve anything there... (irony).
- transcriptase 10mo ago
  I’ve seen so many cases of cheaters online where even the most braindead of checks would neuter most cheats: Are they moving faster than conceivably possible by a real player? Even the most basic (x2-x1)/t > twice the theoretical will catch people teleporting or speed hacking. Is their KDR or any other performance metric outside 5 standard deviations from the mean? Here’s one: is everyone they encounter reporting them for cheating along with one of the above? Do people leave their matches constantly? Defining and detecting objectively impossible things is not impossible.
  - dijit 10mo ago
    Yeah, we do those things. 1) they’re not foolproof 2) there is a delay in aggregating the data this has annoying effects when the game has a trial period/goes on sale/has lots of cheap CD keys floating around. 3) if you weren’t delayed then the cheaters get better at adjusting to how you catch them. We actually do a lot of statistical analysis, but it works in tandem with endpoint anti-cheat, and would hardly work at all alone.
    - brightball 10mo ago
      I know when I spent a lot of time dealing with fraud in a different market, the most effective tool was to catch and shadowban the accounts rather than banning them. If we banned them, they just created a new account and kept doing the same things. When we detected them and the isolated them from all other good standing accounts, only allowing them to interact with other shadowbanned users, it virtually solved the problem. Normal users went about their day and the cheaters/fraudsters wasted a lot of time never getting through to anyone. In gaming it seems like creating a cheaters purgatory where they are stuck competing against other cheaters forever would probably end up being its own special league after a while. Like when people suggested steroids in pro-baseball should be legal.
      - dijit 10mo ago
        Yeah, we actually discussed doing something like that. That's what GTA5 did (though, they marked you with a dunce cap)... .. even though it's a good idea (and we nearly implemented it actually), there's probably a reason that GTA5 is still plagued with cheaters.
- mschuster91 10mo ago
  > GameDevs don't actually like paying a shit load of money for anti-cheat (that also breaks their debugging systems and causes bugs: a wonderful combination)... so if you've got a better way: join the industry and fix it. You'll be a moderately wealthy person. I got a better way... just look at the past. Back in ye goode olde UT2004 times, there was no random matchmaking / ranking bullshit that removed the social element, game licenses cost money, people ran their own servers, and if you pissed off server mods enough, no matter if you were a cheater, a suspected cheater, or just an asshole, your serial got banned - sometimes, across a fleet of servers that shared ban lists. Cheating had costs associated. But of course, that means you can't lure in whales with free to play games and loot them via microtransactions any more...
  - dijit 10mo ago
    Thats a cynical take. The truth is that UT2004 sold 234,451 units over its life according to Wikipedia. The Division sold over 10,000,000 copies in the first weekend. The requirements change drastically when you have a larger audience.
    - mschuster91 10mo ago
      > Thats a cynical take. Primarily driven by my utter disgust for modern monetization mechanics, corporate greed and gambling. Cheaters, IMHO, are an inevitable side effect of combining gamification with gambling, with no barriers to entry, and with removing social barriers of entry. > The requirements change drastically when you have a larger audience. The market has exploded in the 12 years between UT2004 and The Division.
      - dijit 10mo ago
        > The market has exploded in the 12 years between UT2004 and The Division. Yes, and you can’t assert that it didn’t happen at least in part due to efforts to make games more accessible. You couldn’t release a game like UT2004 today with the same UX and expect competitive sales. Even if you did, the experience would scale very poorly.
  - 10mo ago
- esseph 10mo ago
  If companies have the ability to control the binaries that run on your PC, and prevent you from running the ones you want, you're cooked.

by sylware 10mo ago

dijit 10mo ago

What are you even talking about? The parent is right. I'm quite literally the first person to bash Windows for being a shitty operating system, but the requirement for signed modules puts a massive barrier to entry for cheaters, where Linux can load just about anything. If every system call can lie to you, there's a few things you can do, but it's not many. I know this because I've actually done a lot of due diligence on anti-cheat. One mechanism I attempted to employ was to replay initalisation vectors and determinism of inputs; this means I could replay your session out of band and witness the same outcomes. If there was variation then there's a fault. Except as soon as you introduce floating point numbers there's no more determinism... Oh well. The other was to watch for "impossible" things, but then you need to run full complex physics simulations for every client. If your game requires you to effectively buy an i7-11700k for every user then you'd have to sell your game for a lot more money, and limit how long they can play - nobody wants this. The third option was to score our best players and anyone who performs better than that gets their behaviour tracked. The problem is, coming up with a scoring system that's server side is much harder than you think. GameDevs don't actually like paying a shit load of money for anti-cheat (that also breaks their debugging systems and causes bugs: a wonderful combination)... so if you've got a better way: join the industry and fix it. You'll be a moderately wealthy person.

sylware 10mo ago
What are you talking about? 1 - kernel anti-cheats ARE weaponized by hackers. This is not a matter of discussion unless you are into the AI generated HN news conspiracy. 2 - this linux feature should provide (if I recall properly) a very complex and flexible (not limited to "calls"), and performant, set of interactions between a set of anti-cheat processes and the set of game processes. All that as being non-root priviledge (I think you must be have the same effective user id). The actual and real parameter is the level of competence and creativity of the "anti-cheat" team which is a requirement of any "live-service games" with frequent updates. 3 - for FPS games where aiming skill is critical, anti-cheat are close to useless due to "external" AI based aim assist hardware.
- Thaxll 10mo ago
  1. They're not, not sure where you've seen that, not in western games at least.
  - esseph 10mo ago
    > "The researchers investigated the techniques used in online game cheating, as well as those deployed by ‘anti-cheat’ technologies. Most modern anti-cheat engines run in the Windows kernel, alongside applications such as anti-virus, at the highest levels of privilege. Software can only run in the Windows kernel if it has been approved and signed by Microsoft. This makes it more powerful than software run normally by the user. An example of kernel level software is the Crowdstrike system that recently failed, bringing down large parts of the internet." > "While the anti-cheats are allowed in the kernel by Microsoft, the study also revealed that cheat software commonly uses weaknesses in Windows protections to ‘inject’ itself into the kernel and gain higher privileges. Many techniques mirror what is commonly seen in the domains of malware and anti-virus, with a difference in motivation." > "This kernel injection technique has previously been observed in advanced ransomware attacks to disable anti-malware protections before the main attack." https://www.eurekalert.org/news-releases/1061994 https://www.eurekalert.org/news-releases/1061994
    - Thaxll 10mo ago
      None of that talk about exploiting anti cheats, nowhere. Not a single concrete example. The goal of cheats is to make money not to hack PCs.
      - esseph 10mo ago
        https://www.threatshub.org/blog/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/ https://www.threatshub.org/blog/ransomware-actor-abuses-gens... > Ransomware Actor Abuses Genshin Impact Anti-Cheat Driver to Kill Antivirus
      - sylware 10mo ago
        In the current state of things, YOU have to provide the proof a kernel anti-cheat is not weaponized by hackers (yet...). It is now common knowledge, kernel level anti-cheats are leveraged by hackers. And we all know this is fully hypocrit. "Computer security" does not exist, but for sure, adding a "gaming" _kernel module_ won't improve anything there... (irony).
transcriptase 10mo ago
I’ve seen so many cases of cheaters online where even the most braindead of checks would neuter most cheats: Are they moving faster than conceivably possible by a real player? Even the most basic (x2-x1)/t > twice the theoretical will catch people teleporting or speed hacking. Is their KDR or any other performance metric outside 5 standard deviations from the mean? Here’s one: is everyone they encounter reporting them for cheating along with one of the above? Do people leave their matches constantly? Defining and detecting objectively impossible things is not impossible.
- dijit 10mo ago
  Yeah, we do those things. 1) they’re not foolproof 2) there is a delay in aggregating the data this has annoying effects when the game has a trial period/goes on sale/has lots of cheap CD keys floating around. 3) if you weren’t delayed then the cheaters get better at adjusting to how you catch them. We actually do a lot of statistical analysis, but it works in tandem with endpoint anti-cheat, and would hardly work at all alone.
  - brightball 10mo ago
    I know when I spent a lot of time dealing with fraud in a different market, the most effective tool was to catch and shadowban the accounts rather than banning them. If we banned them, they just created a new account and kept doing the same things. When we detected them and the isolated them from all other good standing accounts, only allowing them to interact with other shadowbanned users, it virtually solved the problem. Normal users went about their day and the cheaters/fraudsters wasted a lot of time never getting through to anyone. In gaming it seems like creating a cheaters purgatory where they are stuck competing against other cheaters forever would probably end up being its own special league after a while. Like when people suggested steroids in pro-baseball should be legal.
    - dijit 10mo ago
      Yeah, we actually discussed doing something like that. That's what GTA5 did (though, they marked you with a dunce cap)... .. even though it's a good idea (and we nearly implemented it actually), there's probably a reason that GTA5 is still plagued with cheaters.
mschuster91 10mo ago
> GameDevs don't actually like paying a shit load of money for anti-cheat (that also breaks their debugging systems and causes bugs: a wonderful combination)... so if you've got a better way: join the industry and fix it. You'll be a moderately wealthy person. I got a better way... just look at the past. Back in ye goode olde UT2004 times, there was no random matchmaking / ranking bullshit that removed the social element, game licenses cost money, people ran their own servers, and if you pissed off server mods enough, no matter if you were a cheater, a suspected cheater, or just an asshole, your serial got banned - sometimes, across a fleet of servers that shared ban lists. Cheating had costs associated. But of course, that means you can't lure in whales with free to play games and loot them via microtransactions any more...
- dijit 10mo ago
  Thats a cynical take. The truth is that UT2004 sold 234,451 units over its life according to Wikipedia. The Division sold over 10,000,000 copies in the first weekend. The requirements change drastically when you have a larger audience.
  - mschuster91 10mo ago
    > Thats a cynical take. Primarily driven by my utter disgust for modern monetization mechanics, corporate greed and gambling. Cheaters, IMHO, are an inevitable side effect of combining gamification with gambling, with no barriers to entry, and with removing social barriers of entry. > The requirements change drastically when you have a larger audience. The market has exploded in the 12 years between UT2004 and The Division.
    - dijit 10mo ago
      > The market has exploded in the 12 years between UT2004 and The Division. Yes, and you can’t assert that it didn’t happen at least in part due to efforts to make games more accessible. You couldn’t release a game like UT2004 today with the same UX and expect competitive sales. Even if you did, the experience would scale very poorly.
- 10mo ago
esseph 10mo ago
If companies have the ability to control the binaries that run on your PC, and prevent you from running the ones you want, you're cooked.