4 ms·

Anti-cheat evolution in Windows 11

41 points by davikr 9mo ago

Animats 9mo ago
The future of serious cheating is probably a second machine watching the video and playing the game.
- deleted 9mo ago
  [deleted]
- YPPH 9mo ago
  I reckon hackers get a thrill out of doing the inputs themselves. They seem to be able to disregard the fact they've got an unfair advantage, pretending that they are still achieving something by their acts. Where vision based AI will start running riot is in games like Runescape where macroing is a huge problem. I expect it will become undetectable and therefore unbannable.
  - vips7L 9mo ago
    I could see a vision based solution being popular in an mmo too. Gold farming is lucrative.
- thecommakozzi 9mo ago
  [dead]
- Rohansi 9mo ago
  That's still an improvement over the current state of games. Cheats being able to read hidden game state is a huge advantage vs. just what is visible on screen.
  - orbital-decay 9mo ago
    No, it just leads to subtler cheating. Closet cheaters are much worse than obvious ones, and they thrive in exactly these conditions: the game is not too broken by rage mode cheaters so there's a lot of fair players they're preying on, they have an inconspicuous advantage, and the advantage is gatekept with some entry barrier so there aren't too many of them. You can have a fully encrypted and attested click-to-photon DRM chain, but it will just a) turn your computer into an appliance and b) cause even worse cheating.
    - seba_dos1 9mo ago
      You're right, but developers don't really care about cheaters cheating. They care about cheaters ruining the game to others, so closet cheaters are not such a big deal to them even when they're thriving as long as they remain closeted.
    - pyrolistical 9mo ago
      Good! It would push down the cheating down to really low percentages. It won’t be easy for a script kiddie to just download any cheat.
      - orbital-decay 9mo ago
        There's nothing good about this, and you'll be surprised how many people are willing to spend more than $1k/mo just to cheat in video games. Your game will still be ruined in a worse way, and every step towards the full lock-in just makes this closer. As I said, closet cheaters are MUCH worse than obvious ones, and much harder to catch (and for the context, I used to host very popular servers for several games, so I've seen player complaints and retention rates). Here's my previous comment about what it takes to actually eliminate cheaters. Anticheats are only marginally helpful in this, it's all about observability, manual control, and community building. https://news.ycombinator.com/item?id=46139481 https://news.ycombinator.com/item?id=46139481 Intrusive DRM schemes will just take any semblance of computing freedom away from you, while actually making the problem worse in the end.
        pyrolistical 9mo ago
        If we could eliminate all cheaters down to those willing to spend $1000 per month to cheat, I would consider the war won
        orbital-decay 9mo ago
        Which is a pretty naive view of the cheating landscape that ignores everything I posted above. Enforcing the rules by technical means is largely superficial everywhere except the actual esports, the culture around the multiplayer gaming (both esports and not) needs to change.
  - snailmailman 9mo ago
    I don’t think it is an improvement. At the level of League of Legends me and my friend group play, we never noticed cheaters. We play casual ARAM games. Never noticed any hackers or anything. But we definitely notice when at the start of the game, one of our team didnt actually get past the loading screen because Vanguard decided instead they need to reboot their machine. And then good luck winning when you are down a player for several minutes. It doesn’t happen often, but it happens way more often than cheaters did. And this bug happens to multiple people in my friend group. This anti cheat software is extremely buggy. And causes way more problems than it solves for us. I wish i could say “but the software is improving” because the last few weeks it’s been fine, until literally yesterday. I got out of fountain and into combat and then got a “Vanguard must be running” popup. It kicked me out and I couldn’t get back in until I rebooted. And then if you open league too fast after the reboot, because you are hurrying to get back in, you can actually open League before Vanguard starts and then too bad you have to reboot again!
- smileybarry 9mo ago
  There's some ML image-based cheats out there but they're much worse (and have been for years). Some games have sidestepped this with tiny imperceptible color changes to nametags & outlines to throw off the cheats while not bothering a human player.
- goykasi 9mo ago
  This youtuber had an interesting approach: https://www.youtube.com/watch?v=pjJImfcQGjI https://www.youtube.com/watch?v=pjJImfcQGjI "Neuromuscular Cyborg Aim Assist"
seba_dos1 9mo ago
In other words - it's up to Microsoft to allow you to do certain things on your own PC, just like it's been on Android with Google for a while now, as if they don't the third parties will just refuse to provide their services to you. (inb4 "but Microsoft only provides a report that's interpreted by others" - yes, but ultimately it's up to whether Microsoft chooses to sign the content of a report you want to produce)
- cortesoft 9mo ago
  I don’t think this is really true… you can choose to opt in to this limitation, and in return you can play certain games that have this type of anti-cheat. Or, you can choose to not opt in, and then you can’t play those particular games. The only thing Microsoft is preventing you from doing on your own PC is having Microsoft lie to the other piece of software.
  - seba_dos1 9mo ago
    You may want to look up what SafetyNet Attestation and Play Integrity APIs are being used for.
- smileybarry 9mo ago
  This is entirely used for anticheat purposes. Ergo, if you want to play with other people in a multiplayer setting, you're required to abide by certain rules: some logical and social, some technical. It's a careful balance between a fully locked down platform (Xbox/PS OS) and just zero measures to prevent cheaters. (No, server-side anticheat is not sufficient, as proven countless times) You're free to use your hardware as you wish, but if you want to disable the Secure Kernel et al, don't be surprised if the gameserver rejects your connection.
  - seba_dos1 9mo ago
    Entirely anticheat, then DRM, then banking, then...
    - 9mo ago
super256 9mo ago
Some thoughts - secure kernel WILL get hijacked and be completely invisible to anti cheats. Which would be funny. - Microsoft won't port back the attestation process to win 10 (although secure kernel exists there too), forcing all gamers, where the AC adopts this attestation, to install win11 - trying to lock out Linux for sure, which is a funny coincidence given that Valve is partnering with anti cheat developers (eg EAC and Battleye) to support Linux
- c0balt 9mo ago
  > EAC and Battleye They may be partnering with them but support for competitve titles is rather limited. For example, the most prominent Battleye title (iirc), Rainbow Six Siege, is not support on Linux via Steam due to Battleye blocking it. Valorant, LoL, BF6 or CoD also don't work ime.
  - napkinartist 9mo ago
    They will need to sooner or later. Linux has more momentum than ever, and saying "players on steam deck/steam machine/bazzite can't play our game" seems like a losing long term strategy.
    - bentcorner 9mo ago
      It's a balance between allowing linux and (theoretically) opening the door for more cheaters. Saying "players can't play our game because every match has a cheater" is just as bad. I can't say which has more weight but it's not a cut and dry situation, at least until Linux has anti-cheat. Right now developers could make an "unattested" queue for linux and other non-TPM windows systems. Which could also serve as a black-hole for cheaters, so maybe there's some value in that.
    - immibis 9mo ago
      So, the problem with anticheat on Linux is there's no "safe" reference version of Linux that you can enforce to be running. This is a good thing. It's supposed to be modifiable. This fundamentally conflicts with the goal of anticheat which is to stop you modifying it. I predict they won't allow all Linux but only the specific version Valve puts on the Steam Deck/Machine, and if you modify it then your games won't run again.
evgpbfhnr 9mo ago
I don't get why a bad guy couldn't dump the current log / hash, then load a kernel module that'd just replay the same values whenever someone asks for it? Does the log have a challenge/nonce from the client that'd change the hash everytime it's obtained? (if the client loads their own kernel module they can check it's on the list, but the whole point is about not having to do that, right..)
compsciphd 9mo ago
I've said this before, but given how fast machines can boot these days, why not simply reboot into a secure boot attested environment with minimal things loading besides the game. i.e. why not simply make it "XBox for the PC" and leverage both PC and XBox gaming together. There should be no difference to a developer of an "XBox for the PC" and XBox development besides XBox giving you an exact performance config. One codes the same, one has the same resources made available to them and so forth and then one doesn't need anti-cheat (i.e. I'm making an assumption that there's no real need for invasive anti-cheat on xbox / ps platforms). If I was being conspiracy minded, I might argue that Microsoft doesn't do this, because if one simply reverted to a trusted/attested platform, it be easy for valve to provide the same on a steam deck. If one is booted into a trusted/attested mode on the steam deck, these games that eschew invasive anti-cheat due to trusting the platform could do the same on the steam deck if it provided such a mode. So by enabling invasive anti-cheat, they create a form of lock-in.
deleted 9mo ago
[deleted]

41 points by davikr 9mo ago

Animats 9mo ago

The future of serious cheating is probably a second machine watching the video and playing the game.

deleted 9mo ago
[deleted]
YPPH 9mo ago
I reckon hackers get a thrill out of doing the inputs themselves. They seem to be able to disregard the fact they've got an unfair advantage, pretending that they are still achieving something by their acts. Where vision based AI will start running riot is in games like Runescape where macroing is a huge problem. I expect it will become undetectable and therefore unbannable.
- vips7L 9mo ago
  I could see a vision based solution being popular in an mmo too. Gold farming is lucrative.
thecommakozzi 9mo ago
[dead]
Rohansi 9mo ago
That's still an improvement over the current state of games. Cheats being able to read hidden game state is a huge advantage vs. just what is visible on screen.
- orbital-decay 9mo ago
  No, it just leads to subtler cheating. Closet cheaters are much worse than obvious ones, and they thrive in exactly these conditions: the game is not too broken by rage mode cheaters so there's a lot of fair players they're preying on, they have an inconspicuous advantage, and the advantage is gatekept with some entry barrier so there aren't too many of them. You can have a fully encrypted and attested click-to-photon DRM chain, but it will just a) turn your computer into an appliance and b) cause even worse cheating.
  - seba_dos1 9mo ago
    You're right, but developers don't really care about cheaters cheating. They care about cheaters ruining the game to others, so closet cheaters are not such a big deal to them even when they're thriving as long as they remain closeted.
  - pyrolistical 9mo ago
    Good! It would push down the cheating down to really low percentages. It won’t be easy for a script kiddie to just download any cheat.
    - orbital-decay 9mo ago
      There's nothing good about this, and you'll be surprised how many people are willing to spend more than $1k/mo just to cheat in video games. Your game will still be ruined in a worse way, and every step towards the full lock-in just makes this closer. As I said, closet cheaters are MUCH worse than obvious ones, and much harder to catch (and for the context, I used to host very popular servers for several games, so I've seen player complaints and retention rates). Here's my previous comment about what it takes to actually eliminate cheaters. Anticheats are only marginally helpful in this, it's all about observability, manual control, and community building. https://news.ycombinator.com/item?id=46139481 https://news.ycombinator.com/item?id=46139481 Intrusive DRM schemes will just take any semblance of computing freedom away from you, while actually making the problem worse in the end.
      - pyrolistical 9mo ago
        If we could eliminate all cheaters down to those willing to spend $1000 per month to cheat, I would consider the war won
        orbital-decay 9mo ago
        Which is a pretty naive view of the cheating landscape that ignores everything I posted above. Enforcing the rules by technical means is largely superficial everywhere except the actual esports, the culture around the multiplayer gaming (both esports and not) needs to change.
- snailmailman 9mo ago
  I don’t think it is an improvement. At the level of League of Legends me and my friend group play, we never noticed cheaters. We play casual ARAM games. Never noticed any hackers or anything. But we definitely notice when at the start of the game, one of our team didnt actually get past the loading screen because Vanguard decided instead they need to reboot their machine. And then good luck winning when you are down a player for several minutes. It doesn’t happen often, but it happens way more often than cheaters did. And this bug happens to multiple people in my friend group. This anti cheat software is extremely buggy. And causes way more problems than it solves for us. I wish i could say “but the software is improving” because the last few weeks it’s been fine, until literally yesterday. I got out of fountain and into combat and then got a “Vanguard must be running” popup. It kicked me out and I couldn’t get back in until I rebooted. And then if you open league too fast after the reboot, because you are hurrying to get back in, you can actually open League before Vanguard starts and then too bad you have to reboot again!
smileybarry 9mo ago
There's some ML image-based cheats out there but they're much worse (and have been for years). Some games have sidestepped this with tiny imperceptible color changes to nametags & outlines to throw off the cheats while not bothering a human player.
goykasi 9mo ago
This youtuber had an interesting approach: https://www.youtube.com/watch?v=pjJImfcQGjI https://www.youtube.com/watch?v=pjJImfcQGjI "Neuromuscular Cyborg Aim Assist"

seba_dos1 9mo ago

In other words - it's up to Microsoft to allow you to do certain things on your own PC, just like it's been on Android with Google for a while now, as if they don't the third parties will just refuse to provide their services to you. (inb4 "but Microsoft only provides a report that's interpreted by others" - yes, but ultimately it's up to whether Microsoft chooses to sign the content of a report you want to produce)

cortesoft 9mo ago
I don’t think this is really true… you can choose to opt in to this limitation, and in return you can play certain games that have this type of anti-cheat. Or, you can choose to not opt in, and then you can’t play those particular games. The only thing Microsoft is preventing you from doing on your own PC is having Microsoft lie to the other piece of software.
- seba_dos1 9mo ago
  You may want to look up what SafetyNet Attestation and Play Integrity APIs are being used for.
smileybarry 9mo ago
This is entirely used for anticheat purposes. Ergo, if you want to play with other people in a multiplayer setting, you're required to abide by certain rules: some logical and social, some technical. It's a careful balance between a fully locked down platform (Xbox/PS OS) and just zero measures to prevent cheaters. (No, server-side anticheat is not sufficient, as proven countless times) You're free to use your hardware as you wish, but if you want to disable the Secure Kernel et al, don't be surprised if the gameserver rejects your connection.
- seba_dos1 9mo ago
  Entirely anticheat, then DRM, then banking, then...
  - 9mo ago

super256 9mo ago

Some thoughts - secure kernel WILL get hijacked and be completely invisible to anti cheats. Which would be funny. - Microsoft won't port back the attestation process to win 10 (although secure kernel exists there too), forcing all gamers, where the AC adopts this attestation, to install win11 - trying to lock out Linux for sure, which is a funny coincidence given that Valve is partnering with anti cheat developers (eg EAC and Battleye) to support Linux

c0balt 9mo ago
> EAC and Battleye They may be partnering with them but support for competitve titles is rather limited. For example, the most prominent Battleye title (iirc), Rainbow Six Siege, is not support on Linux via Steam due to Battleye blocking it. Valorant, LoL, BF6 or CoD also don't work ime.
- napkinartist 9mo ago
  They will need to sooner or later. Linux has more momentum than ever, and saying "players on steam deck/steam machine/bazzite can't play our game" seems like a losing long term strategy.
  - bentcorner 9mo ago
    It's a balance between allowing linux and (theoretically) opening the door for more cheaters. Saying "players can't play our game because every match has a cheater" is just as bad. I can't say which has more weight but it's not a cut and dry situation, at least until Linux has anti-cheat. Right now developers could make an "unattested" queue for linux and other non-TPM windows systems. Which could also serve as a black-hole for cheaters, so maybe there's some value in that.
  - immibis 9mo ago
    So, the problem with anticheat on Linux is there's no "safe" reference version of Linux that you can enforce to be running. This is a good thing. It's supposed to be modifiable. This fundamentally conflicts with the goal of anticheat which is to stop you modifying it. I predict they won't allow all Linux but only the specific version Valve puts on the Steam Deck/Machine, and if you modify it then your games won't run again.

evgpbfhnr 9mo ago

I don't get why a bad guy couldn't dump the current log / hash, then load a kernel module that'd just replay the same values whenever someone asks for it? Does the log have a challenge/nonce from the client that'd change the hash everytime it's obtained? (if the client loads their own kernel module they can check it's on the list, but the whole point is about not having to do that, right..)

compsciphd 9mo ago

I've said this before, but given how fast machines can boot these days, why not simply reboot into a secure boot attested environment with minimal things loading besides the game. i.e. why not simply make it "XBox for the PC" and leverage both PC and XBox gaming together. There should be no difference to a developer of an "XBox for the PC" and XBox development besides XBox giving you an exact performance config. One codes the same, one has the same resources made available to them and so forth and then one doesn't need anti-cheat (i.e. I'm making an assumption that there's no real need for invasive anti-cheat on xbox / ps platforms). If I was being conspiracy minded, I might argue that Microsoft doesn't do this, because if one simply reverted to a trusted/attested platform, it be easy for valve to provide the same on a steam deck. If one is booted into a trusted/attested mode on the steam deck, these games that eschew invasive anti-cheat due to trusting the platform could do the same on the steam deck if it provided such a mode. So by enabling invasive anti-cheat, they create a form of lock-in.

deleted 9mo ago

[deleted]