6 ms·

The interesting solution here is secure boot, only allow users to play from a set of trusted kernels.

by tapoxi 9mo ago

monerozcash 9mo ago
Yep, a plenty of prior art on how to implement the necessary attestations. Valve could totally ship their boxes with support for anticheat kernel-attestation. Is it possible to do this in a relatively hardware-agnostic, but reliable manner? Probably not.
fooker 9mo ago
You can switch out the kernel in the running Linux desktop.
znpy 9mo ago
I wonder if you could use check-point and restore in userspace (https://criu.org/Main_Page https://criu.org/Main_Page) so that after the game boots and passes the checks on a valid system you can move it to an "invalid" system (where you have all the mods and all the tools to tamper with it). I don't really care about games, but i do care about messing up people and companies that do such heinous crimes against humanity (kernel-level anti-cheat).
- tapoxi 9mo ago
  The war is lost. The most popular game that refuses to use kernel-level anti-cheat is Valve's Counter-Strike 2, so the community implemented it themselves (FaceIT) and requires it for the competitive scene.
__MatrixMan__ 9mo ago
I'd be less antianticheat if I could just select the handcuffs at boot time for the rare occasion where I need them. Although even then I'd still have qualms about paying for the creation of something that might pave the path for hardware vendors to work with authoritarian governments to restrict users to approved kernel builds. The potential harms are just not in the same league as whatever problems it might solve for gamers.
- digiown 9mo ago
  Once a slave, always a slave. Running an explicitly anti-user proprietary kernel module that does god-knows-what is not something I'd ever be willing to do, games be damned. It might just inject exploits into all of your binaries and you'd be none the wiser. Since it wouldn't work on VMs you'd have to use a dedicated physical machine for it. Seems to high of a price to play just a few games.
  - charcircuit 9mo ago
    What if the kernel module is only run in a separate VM than your main one?
    - Delk 9mo ago
      Games that require kernel-level anticheat will probably try to detect VMs and refuse to run.
      - charcircuit 9mo ago
        The idea is that the hypervisor would also be signed and provide security guarantees to games to block cheats from working.
        digiown 9mo ago
        Being able to snapshot and restore memory is a pretty common feature across all decent hypervisors. That in and of itself enables most client-side cheats. I doubt they'd bother to provide such a hypervisor for the vanishingly small intersection of people who: - Want to play these adversarial games - Don't care about compromising control of hypervisor - Don't simply have a dedicated gaming box
        charcircuit 9mo ago
        >Being able to snapshot and restore memory is a pretty common feature across all decent hypervisors A hypervisor that protects against this already exists for Linux with Android's pKVM. Android properly enforces isolation between all guests. Desktop Linux distros are way behind in terms of security compared to Android. If desktop Linux users ever want L1 DRM to work to get access to high resolution movies and such they are going to need such a hypervisor. This is not a niche use case.
vbezhenar 9mo ago
What do you mean? Ship computer with preinstalled Linux that you can't tamper? Sounds like Android. For ordinary computers, secure boot is fully configurable, so it won't work: I can disable it, I can install my own keys, etc. Any for any userspace way to check it I'll fool you, if I own the kernel.
- tapoxi 9mo ago
  No, just have the anti-cheat trust kernels signed by the major Linux vendors and use secure boot with remote attestation. Remote attestation can't be fooled from kernel space, that's the entire point of the technology. That way you could use an official kernel from Fedora, Ubuntu, Debian, Arch etc. A custom one wouldn't be supported but that's significantly better than blocking things universally.
  - digiown 9mo ago
    You can't implement remote attestation without a full chain of exploits (from the perspective of the user). Remote attestation works on Android because there is dedicated hardware to directly establish communication with Google's servers that runs independent (as a backchannel). There is no such hardware in PCs. Software based attestation is easily fooled on previous Android/Linux.
    - tapoxi 9mo ago
      The call asks the TPM to display the signed boot chain, you can't fake that because it wouldnt be cryptographically valid. The TPM is that independent hardware.
      - digiown 9mo ago
        How would that be implemented? I'd be curious to know. I'm not aware that a TPM is capable of hiding a key without the OS being able to access/unseal it at some point. It can display a signed boot chain but what would it be signed with? If it's not signed with a key out of the reach of the system, you can always implement a fake driver pretty easily to spoof it.

The interesting solution here is secure boot, only allow users to play from a set of trusted kernels.

by tapoxi 9mo ago

The interesting solution here is secure boot, only allow users to play from a set of trusted kernels.

Yep, a plenty of prior art on how to implement the necessary attestations. Valve could totally ship their boxes with support for anticheat kernel-attestation. Is it possible to do this in a relatively hardware-agnostic, but reliable manner? Probably not.

fooker 9mo ago

You can switch out the kernel in the running Linux desktop.

znpy 9mo ago

I wonder if you could use check-point and restore in userspace (https://criu.org/Main_Page https://criu.org/Main_Page) so that after the game boots and passes the checks on a valid system you can move it to an "invalid" system (where you have all the mods and all the tools to tamper with it). I don't really care about games, but i do care about messing up people and companies that do such heinous crimes against humanity (kernel-level anti-cheat).

tapoxi 9mo ago
The war is lost. The most popular game that refuses to use kernel-level anti-cheat is Valve's Counter-Strike 2, so the community implemented it themselves (FaceIT) and requires it for the competitive scene.

__MatrixMan__ 9mo ago

I'd be less antianticheat if I could just select the handcuffs at boot time for the rare occasion where I need them. Although even then I'd still have qualms about paying for the creation of something that might pave the path for hardware vendors to work with authoritarian governments to restrict users to approved kernel builds. The potential harms are just not in the same league as whatever problems it might solve for gamers.

digiown 9mo ago
Once a slave, always a slave. Running an explicitly anti-user proprietary kernel module that does god-knows-what is not something I'd ever be willing to do, games be damned. It might just inject exploits into all of your binaries and you'd be none the wiser. Since it wouldn't work on VMs you'd have to use a dedicated physical machine for it. Seems to high of a price to play just a few games.
- charcircuit 9mo ago
  What if the kernel module is only run in a separate VM than your main one?
  - Delk 9mo ago
    Games that require kernel-level anticheat will probably try to detect VMs and refuse to run.
    - charcircuit 9mo ago
      The idea is that the hypervisor would also be signed and provide security guarantees to games to block cheats from working.
      - digiown 9mo ago
        Being able to snapshot and restore memory is a pretty common feature across all decent hypervisors. That in and of itself enables most client-side cheats. I doubt they'd bother to provide such a hypervisor for the vanishingly small intersection of people who: - Want to play these adversarial games - Don't care about compromising control of hypervisor - Don't simply have a dedicated gaming box
        charcircuit 9mo ago
        >Being able to snapshot and restore memory is a pretty common feature across all decent hypervisors A hypervisor that protects against this already exists for Linux with Android's pKVM. Android properly enforces isolation between all guests. Desktop Linux distros are way behind in terms of security compared to Android. If desktop Linux users ever want L1 DRM to work to get access to high resolution movies and such they are going to need such a hypervisor. This is not a niche use case.

vbezhenar 9mo ago

What do you mean? Ship computer with preinstalled Linux that you can't tamper? Sounds like Android. For ordinary computers, secure boot is fully configurable, so it won't work: I can disable it, I can install my own keys, etc. Any for any userspace way to check it I'll fool you, if I own the kernel.

tapoxi 9mo ago
No, just have the anti-cheat trust kernels signed by the major Linux vendors and use secure boot with remote attestation. Remote attestation can't be fooled from kernel space, that's the entire point of the technology. That way you could use an official kernel from Fedora, Ubuntu, Debian, Arch etc. A custom one wouldn't be supported but that's significantly better than blocking things universally.
- digiown 9mo ago
  You can't implement remote attestation without a full chain of exploits (from the perspective of the user). Remote attestation works on Android because there is dedicated hardware to directly establish communication with Google's servers that runs independent (as a backchannel). There is no such hardware in PCs. Software based attestation is easily fooled on previous Android/Linux.
  - tapoxi 9mo ago
    The call asks the TPM to display the signed boot chain, you can't fake that because it wouldnt be cryptographically valid. The TPM is that independent hardware.
    - digiown 9mo ago
      How would that be implemented? I'd be curious to know. I'm not aware that a TPM is capable of hiding a key without the OS being able to access/unseal it at some point. It can display a signed boot chain but what would it be signed with? If it's not signed with a key out of the reach of the system, you can always implement a fake driver pretty easily to spoof it.