9 ms·

Kernel anti-cheat is an overreach

111 points by zdw 3mo ago

_aavaa_ 3mo ago
> So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private. Yeah except that’s not the options here. Even with ring-0 there are lots of cheaters. Without it the game would be completely infested with them.
- bigstrat2003 3mo ago
  I would still rather have that than let some game run in ring 0 TBH.
  - jnwatson 3mo ago
    You're not forced to buy the games that require it.
  - anon7000 3mo ago
    I think that’s a choice people can make for themselves. Thing is, cheating is an existential threat to the entire business model. Games like Valorant rely on a player base that keeps coming back, and a competitive scene where if you work hard, you can move up the ranks and maybe even make money one day. Players quit over cheating. You log in, you play hard and good, but you just can’t win because there are cheaters. These are games you’re trying to be good at… It’s incredibly demoralizing. Happens enough times, and you’ll find a different game not plagued by the same issue. And then your game is dead. You make money off it being a live service, and so maybe your business is dead too. So it makes a lot of sense for a company releasing a new FPS game centered around competitive gaming to pull out all the stops to prevent that issue. Now, the bigger question here is why can I play a game like Overwatch 2 on Linux, but not Valorant? Does Overwatch have a bigger cheating problem? If not, then Valorant should take a look at why their anticheat is just as effective without requiring kernel access.
    - vel0city 3mo ago
      > Does Overwatch have a bigger cheating problem? Yes, considerably. One can also look at Counterstrike running on Valve's matchmaking which uses userland cheat detection versus Faceit's kernel level anticheats for the exact same game. It's been incredibly rare for me to run into obvious cheaters on Faceit but I'll often run into cheaters in Valve's matchmaking. It's the same game, the same executables.
      - laughing_man 3mo ago
        I finally stopped playing Counterstrike because of all the cheating. It was difficult enough to detect that I never knew when I got killed because someone was good, because they were lucky, or because they were cheating.
        frollogaston 3mo ago
        Or smurfing. Whether someone is cheating or just insanely good, neither person is having fun. I learned a while back to simply avoid any video game marketed as "competitive" because it means people treat it like a job or sport.
        laughing_man 3mo ago
        Heh. I used to play Dota back when the tournament prizes were really large. There were a lot of Asian guys trying to get rich as a professional playing on the US West server because the competition wasn't as fierce in the US. They would get so angry if you were on their team and weren't playing the way they thought you should.
    - ryandrake 3mo ago
      > I think that’s a choice people can make for themselves. Users do not have meaningful choice. On most games that use Anticheat, it is required to play the game. I can’t choose to use a non-anticheat version of games. It’s either submit to it or don’t play. Not much of a meaningful choice.
  - _aavaa_ 3mo ago
    Nobody is forcing you to play a game with kernel anti-cheat. I want to play the game, not deal with mass cheating. Unless the people against kernel-level anti cheat can provide an alternative with similar level of protection, there isn’t anything to discuss as far as I’m concerned.
ChocolateGod 3mo ago
> Riot went as far as pushing a UEFI firmware update to Valorant players to close a hardware attack — the first time an anti-cheat has reached below the operating system to change your firmware I don't believe Vanguard did this at all? It told users they need to update their firmware to play, it didn't touch the firmware itself. > Cheats started in user space, so anti-cheat moved into the kernel to see them. Cheats followed into the kernel, and then below it into hypervisors I think cheats moved into kernel space before anti-cheats did.
- sitzkrieg 3mo ago
  long beforehand naturally. the arms race is as good of an excuse as any to trample user rights though
- glitchc 3mo ago
  Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations in memory in a specific order, which brings me to my point: An anti-cheat mechanism can always be defeated if the cheater can access a lower order of abstraction from the mechanism. An arms race is the inevitable outcome. It's either that or competitive gaming is not viable.
  - gopher_space 3mo ago
    I mean the assumption here is that administration needs to be automated. Cheating is an intermittent problem at worst on moderated servers.
  - ButlerianJihad 3mo ago
    > The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.
vel0city 3mo ago
> I want to preface this with the fact that I’m not a gamer. So you're prefacing it as someone who has never really dealt with the games you like to play getting totally infested with and nearly unplayable with so many cheaters in practically every lobby. Its easy to think its something that's not needed if one never spends any time in the space. Do they stop all cheats? No. Do they make the bar extensively higher to cheat? Absolutely. Even they point this out: "A DMA cheat is a separate FPGA card that sits in a PCIe slot and reads the game’s memory directly over the bus, while a second computer processes what it sees and feeds back aim and wallhacks..." Any random person can go run some executable they found on a forum, what percentage of the playerbase has these FPGA cards and a second computer to properly run these cheats? And even then, more modern systems can even detect these kinds of things. Are there lots of problems with these anti-cheat platforms? Sure. Are they now often developed with ties to countries many wouldn't want have that deep of access to their computers? Sure. Is kernel-level anti-cheat overall as a concept overreach? Probably not for what a lot of players actively want. Players want systems to ensure everyone is playing on a somewhat equal playing field. Other than the games being rendered in the cloud I don't know any other real way to begin to enforce it. > I would rather share a match with the occasional cheater What if it wasn't "the occasional cheater" and instead was "nearly every match of every game you like to play"?
- pibaker 3mo ago
  Yes, it is very rich for someone with no skin in the literal game to police what others do to their computers. I don't play any games that use anticheat. But I also don't go out of my way to tell other players who knowingly, consensually installs games with anticheat so they can play them. It's like saying it is an invasion of privacy for cycling athletes to be subjected to doping tests. It's their game. Why does it bother you?
  - frollogaston 3mo ago
    It's everyone's problem if those PCs get turned into a botnet, but otherwise whatever.
facepalmz 3mo ago
[flagged]
AgentMasterRace 3mo ago
what a goof. yes it's a privacy risk, but so is half the things people do on the internet. cs2 is infested with hackers, arc raiders died because of hackers... many games I've played and loved are dead because of hackers.
- vips7L 3mo ago
  Hackers were only one of the many straws that killed Arc Raiders. Mostly it was a dev team that didn’t care.
- HDBaseT 3mo ago
  "CS2 is infested with hackers" is either cope OR you have low trust factor.
  - literallyroy 3mo ago
    My NA experience was bad at top level premier (or was ~1 year ago). Why assume a large swath of the community is coping or low trust factor and that instead your experience is the only accurate one?
Thaxll 3mo ago
Since you're not a gamer sorry but your opinion does not means much, you don't seem to realize how cheating is a problem in online games, it's not just an inconvenience, it kills games.
cowthulhu 3mo ago
This article reminds me of Chesterton Fence - the author is complaining about something, without ever experiencing why it exists.
- ronsor 3mo ago
  Unlike the Fence, kernel anti-cheat wasn't always there and won't be effective in the future with new AI-powered cheats growing.
  - fastball 3mo ago
    The analogy of Chesterton's Fence does not imply / require that the fence has been "always there".
  - ramon156 3mo ago
    Cheaters are a problem, that's the focus you should be taking, not that KAC is an overreach. Everyone knows its not a solution. Writing an article about a problem without addressing the problem shows the author never had the problem i. The first place
- CursedSilicon 3mo ago
  I must admit I immediately questioned the credibility of the article when the author admitted they "aren't a gamer" and then started making allusions to vague political threads. Not to say these criticisms aren't valid, but they're a weird jumping off point The reality is none of the companies want to do these things. Every step in this process locks out some subset of customers. And that's not including the ones who meet the technical requirements but are turned off enough by the decision to just avoid the games anyway They're an unfortunate response to how utterly profitable and expansive cheating in online games has become. They cost the companies precious development time that could be spent making the game better to instead make it just vaguely "playable" for normal people
  - orbital-decay 3mo ago
    >The reality is none of the companies want to do these things. (...) They're an unfortunate response to (...) This reasoning can be used to justify pretty arbitrary behavior, don't you think? Intent is irrelevant for malice, incentives are enough.
grg0 3mo ago
The tl;dr from the post is that kernel anti-cheat presents both an attack vector for malware and a backdoor for firms. The former is already known to be exploited. I don't know why comments here are so negative. PC gamers should be wary of installing this stuff, and PC users in general wary of attempts to lock down their computer. If game companies want a fully locked down PC, they already have one; it's called a console.
- frollogaston 3mo ago
  There are people who treat their PC almost like a console, cause all they use it for is video games anyway, but they want more than what a console offers (and will spend a lot). They install whatever. Kernel anti-cheat isn't even the worst thing on those, that'd be Windows. It's fine. Personally I keep my Mac clean. It can play a few games, which is enough for me. I also found a spare PC in e-waste, and occasionally boot it up to play games in Win10, but wouldn't care if it died.
AuthAuth 3mo ago
>it hasn’t stopped cheating No but it has largely reduced it to where you can play competitively and not run into cheaters. Go play f2p csgo and enjoy a hacker in nearly every single game blatantly spinning in spawn head shotting everyone.
- dannersy 3mo ago
  It doesn't take kernel level anticheat to detect that kind of behavior. This is just laziness.
- laughing_man 3mo ago
  It's hard to know. If I were cheating on a competitive server, I'd be using cheats that gave me an edge without making me dominant. That sort of thing is very difficult to detect.
  - AuthAuth 3mo ago
    But because you were cheating you'd be above your level. So there would be a mismatch somewhere. You'd need to vastly improve your aim to compensate for bad game sense or use wall hacks to compensate for bad map awareness. Either way its not to hard for people to notice if they watch a replay. Not many cheaters are doing tiny adjustments because that would suggest they're already at that skill level.
    - laughing_man 3mo ago
      Oh, I agree that it only makes sense if you're already a world-class player playing other world-class players.
sgjohnson 3mo ago
I’m actually surprised how a lot of commenters here are defending kernel-level anticheat.
- sushid 3mo ago
  Have you played games with a ton of cheaters? It's infuriating, and I'm glad that kernel-level anti-cheat makes it such that you can have an enjoyable gaming experience. Now, I no longer play competitive shooters due to my age, but this was a huge issue back in the day.
  - Akronymus 3mo ago
    On private/community hosted/moderated servers my experience was that cheating was mostly a non-issue. Only with the advent of forced matchmaking/only official servers and such has it become a real problem.
    - dannersy 3mo ago
      I think this is the answer. You get a lot more false positives, but at least the players can do something about it and aren't at the mercy of devs who can stop support at any time and also are fighting a losing battle.
    - deleted 3mo ago
      [deleted]
    - iscoelho 3mo ago
      That's a different type of game entirely. Private/community servers cannot be competitive at the scale of modern competitive games.
      - slumberlust 3mo ago
        Why? I have a hard time imagining anyone would care more about the integrity of the game than the community. Private servers are an IP play, allowing companies to pull the plug completely when it is convenient for them.
charcircuit 3mo ago
The overreach of kernel anticheats that this article complains about can be done just as easily from user mode anticheats. It's not whether an anticheat is kernel mode or not for whether it is overreaching or not. >The hardware requirements lock out Linux and the Steam Deck Because their security is out of date. Meanwhile macOS has modern security good enough to not even require Vanguard to need kernel mode to be effective.
giov4 3mo ago
Uninstalled riot years ago, not playing games that dont run on linux with proton, problem solved and you should do the same. Avoiding to play games that take over my system on a low-level is a no go, I can live without LoL or BF6 and I live even better :) ignoring this problems means you don't care about your identity, data, privacy and you prefer to keep ignoring this and play the games that hype abd you like, but inside you know that long term your are profiled and such profiling will be used against you!
- deleted 3mo ago
  [deleted]
- Parae 3mo ago
  I play fighting games. Didn't even bother to try 2XKO on Windows because I knew I won't be able to play on Linux due to Vanguard.
bob1029 3mo ago
I don't think kernel goes far enough. We are pushing down the wrong path. We don't need kernel level anti cheats. I think there should be real world legal consequences for exploiting information systems like this. "Gaming" shouldn't magically exempt a business sector from reasonable protection against fraud and abuse. Just because it's easy to do or involves bits in a computer (that isn't physically on the game developer's premises) should not magically exempt bad actors from prosecution. Yes, it's your computer, those are technically your bits, but this is about how these things are used and the context within which they are. We have the CFAA in the US, but you'd need a fairly loose interpretation to cover most forms of cheating today. I don't really see the distinction between client and server when the actions taken on the client side cause a dramatic loss in quality of service for other clients connected to that same server or p2p relay. South Korea has laws on the books as of 2016. https://dotesports.com/overwatch/news/ow-hacker-sentenced-prison https://dotesports.com/overwatch/news/ow-hacker-sentenced-pr...
- giov4 3mo ago
  yes but you are going off topic, the point is companies installing low level malware on any gamer's system to prevent cheaters and monitoring all of them as a consequence. And not that there are not enough laws against cheaters and against people tampering with a software or system, also tampering imho has always been the base for the rest of the reversing :)
- dTal 3mo ago
  No thanks. >We don't need kernel level anti cheats. More than that, they'd be illegal by your own standard, if applied fairly. You can't steal control of someone's computer just because they bought a game from you. That's a strictly more severe "exploit" with strictly more impact on "quality of service" than sending bogus data to a server. Cuts both ways. But we all know how it'd really play out. If lying to a server counts as "hacking", but corporate rootkits and locked bootloaders are fine, all you've really done is solidify "felony infringement of business model". You haven't protected anyone. Video games are a stupid thing to immolate computing freedom for.
wronex 3mo ago
I play a lot. Competitive shooters mostly. Most of them are unplayable for one or two reasons. Cross play (controllers with aim assist) and cheaters. As a PC player I would like to see no aim assist and actual consequences for cheating. I’ll gladly verify my real world identity, if it meant cheaters where banned once and forever. I’ve heard this is how it works in Korea (claim not verified) and could see it work here too as most of Europe has access to very UX friendly state sponsored digital ID. If there were actual stakes to cheating, it would be less prevalent. Now you can create another account and keep playing. Often for free! On a side note. How come replay analysis doesn’t catch more cheaters?
- iscoelho 3mo ago
  > "How come replay analysis doesn’t catch more cheaters?" 1) There's too many players. 2) Closet cheaters are extremely subjective: automated & manual moderation would be full of false positives. In these cases, functional anti-cheats actually serve to vindicate these players.
galkk 3mo ago
> So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private. You’re not a gamer so you don’t have a word here. I was a competitive gamer and I would happily accept even the game where you need a government id to be allowed to play in ranked/matchmaking. I do dual boot for gaming/home stuff though.
nubinetwork 3mo ago
> During setup, I did a clean Windows 11 install > Unfortunately the install was legacy MBR > I was forced to convert the disk with mbr2gpt and spent about an hour manually rebuilding the boot drive to work under UEFI. I'm surprised Windows 11 even booted on MBR, I was under the impression that after 7 all Windows installs had to be GPT/EFI, regardless of whether secure boot was on or not.
iscoelho 3mo ago
In my opinion, the debate about kernel anti-cheat on Windows is disingenuous fear-mongering. I'm confused why Hacker News of all places misrepresents the technical details. You can already completely compromise the average user's privacy with an underprivileged process (nearly all of your personal information is accessible with zero privileges!), and you can already persist with administrator privileges (that is routinely given on Windows). In regard to the "RCE attacker risk", attackers can RCE to escalate just as easily into vulnerable Windows services (there's too many to count). Kernel drivers aren't that special. In regard to the "CrowdStrike risk", that's not privacy related and is extremely overblown. What exactly does a kernel driver change regarding privacy? Nothing I can think of. It's this simple: If games want your personal data, they don't need a kernel driver to get it.
- ChocolateGod 3mo ago
  > In my opinion, the debate about kernel anti-cheat on Windows is fear-mongering I don't think a lot of people who complain about kernel anti-cheat actually play competitive games.
  - iscoelho 3mo ago
    I feel someone doesn't need to play competitive games to be able to give an honest assessment of the privacy & security risks. I'm sad I'm not seeing that honesty elsewhere in this thread.
    - Reubachi 3mo ago
      It certainly is helpful to understand the mindset of a person who: a.) their hobby is to play competitive games which mandate kernel level (or similar intrusive anti-cheat) b.) either accepts the requirements or builds sufficient security gapping to make it a nonconsideration. These people exist, and would say in an honest assesmment that the above behavior is no more rights-intrusive than what 99 percent of the tech absorbing population allow today.
      - 3mo ago
n3rv 3mo ago
Letting RIOT into your ring ZERO is not a risk I'm willing to take. It just sits nagging in the back of your mind. So why take the risk.
- Hikikomori 3mo ago
  Are you playing games on a different user? If not a user space program can already access all your files and memory of running processes.
  - giov4 3mo ago
    yama? ptrace scope? namespaces? selinux? apparmor? of course depends also on system defaults, but then why I cannot dump ssh-agent process from same user? oh maybe that's also the reason why the move to the kernel level in general? or that's not necessary with different privileges and they could stay on user space without taking over kernel? (insert here philosoraptor meme pls) again having low leve drivers from external corps that could ready anything anytime from my system and exfiltrate without me even knowing is even more scary than running a recent microsoft os! and should be avoided if possible!
    - Hikikomori 3mo ago
      Talking about Windows here as we're discussing kernel anti cheat. >again having low leve drivers from external corps What do you think drivers are then?
  - frollogaston 3mo ago
    Userspace program at least needs admin privs to read others' memory, right?
    - Hikikomori 3mo ago
      That's the thing, they don't for processes of the same user.
km144 3mo ago
> So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private. The article makes an argument that anti-cheat is not worth the trade-off, yet the author admits they are a non-gamer. Then they go on to present one example of anti-cheat that tells us all we need to know about actual gamers' preferences—FACEIT. For those who don't know, FACEIT is a third-party matchmaking service, primarily for CS2. People choose to go through the hoops of using third-party service that installs kernel-level anti-cheat on their computer because it helps to keep cheaters out of their games. This seems like pretty strong evidence that the author's argument is not a good representation of gamers' thoughts on this. I don't know what the actual solution is. I suspect if Valve made their own kernel-level anti-cheat people might trust it more, but it's still the same problem.
- nomel 3mo ago
  I suspect the only technical alternative would be the extreme of "this is not your system at all" mode, and necessarily involve dedicated hardware, where you can boot your computer as a "game console". I also suspect this would mean that mode would necessarily be the "primary" mode [1], PS2 style. [1] https://en.wikipedia.org/wiki/Linux_for_PlayStation_2 https://en.wikipedia.org/wiki/Linux_for_PlayStation_2
- avadodin 3mo ago
  Faceit has cheaters too by all accounts and some of the cheats have advanced to the point that not even kernel access under secure boot helps as they don't even run on the same device. Behavioral patterns are a much better target. If your cheats make you play like a legit player, who cares? It's the same as in the gym. People are bothered by people who look like Ahnold, and still can't lift one plate. Not the fattie who takes t to look like a normal person. I think that's the spirit of VAC. The only issue is it can't —or won't— detect people helicopter–hopping no–scope sniping around the map or terrible players who shoot you in the face every time in 12ms.
  - literallyroy 3mo ago
    Saying FACEIT has cheaters “by all accounts” feels like a bad faith argument without including that it has significantly fewer cheaters (at least at higher ranks). As well as having the ability to report to real human moderators. I have too many hours in cs:go and cs2 and am level 10 FACEIT. I have had many awful cheater experiences in the native competitive systems but have never had an obvious cheater (never reported someone) in a FACEIT match. It works. It raises the bar high enough that cheating is significantly less frequent.
josefritzishere 3mo ago
That sounds like malware.
nhggfu 3mo ago
online real-money and crypto poker sites have a big cheating problem too - and face similar issues for detection. Alarmingly the software for one popular operator has some very invasive features - verging on spyware - including harvesting screenshots of all screens (sent to some unknown biz in india, stored under "who-knows-what" security), hardware fingerprinting, and 'remote access' wired in for future releases. https://pokerindustrynews.com/features/coinpoker-anti-cheat-spyware-remote-access-kyc-leaks-updated/ https://pokerindustrynews.com/features/coinpoker-anti-cheat-...
SwellJoe 3mo ago
I have purchased every Civilization (and closely related) game since III. I have played more hours of any single Civ than all other games combined. I didn't buy Civ VII, because I don't buy malware. As long as it's got Denuvo, it's not a game I'm buying or playing.
- preisschild 3mo ago
  Fuck Denuvo's parent company (Irdeto) too. They have been making DRM cards for austrian state TV for decades and thus making it a PITA to do something like broadcasting your TV signal over IP to the TVs in the house...
SomeHacker44 3mo ago
Is there some reliable tool which can list all the kernel anti cheat that may be installed on my Windows system, and the games I need to uninstall to remove them? Or remove them directly? Thanks!
valentynkit 3mo ago
[dead]

111 points by zdw 3mo ago

> So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private. Yeah except that’s not the options here. Even with ring-0 there are lots of cheaters. Without it the game would be completely infested with them.

bigstrat2003 3mo ago
I would still rather have that than let some game run in ring 0 TBH.
- jnwatson 3mo ago
  You're not forced to buy the games that require it.
- anon7000 3mo ago
  I think that’s a choice people can make for themselves. Thing is, cheating is an existential threat to the entire business model. Games like Valorant rely on a player base that keeps coming back, and a competitive scene where if you work hard, you can move up the ranks and maybe even make money one day. Players quit over cheating. You log in, you play hard and good, but you just can’t win because there are cheaters. These are games you’re trying to be good at… It’s incredibly demoralizing. Happens enough times, and you’ll find a different game not plagued by the same issue. And then your game is dead. You make money off it being a live service, and so maybe your business is dead too. So it makes a lot of sense for a company releasing a new FPS game centered around competitive gaming to pull out all the stops to prevent that issue. Now, the bigger question here is why can I play a game like Overwatch 2 on Linux, but not Valorant? Does Overwatch have a bigger cheating problem? If not, then Valorant should take a look at why their anticheat is just as effective without requiring kernel access.
  - vel0city 3mo ago
    > Does Overwatch have a bigger cheating problem? Yes, considerably. One can also look at Counterstrike running on Valve's matchmaking which uses userland cheat detection versus Faceit's kernel level anticheats for the exact same game. It's been incredibly rare for me to run into obvious cheaters on Faceit but I'll often run into cheaters in Valve's matchmaking. It's the same game, the same executables.
    - laughing_man 3mo ago
      I finally stopped playing Counterstrike because of all the cheating. It was difficult enough to detect that I never knew when I got killed because someone was good, because they were lucky, or because they were cheating.
      - frollogaston 3mo ago
        Or smurfing. Whether someone is cheating or just insanely good, neither person is having fun. I learned a while back to simply avoid any video game marketed as "competitive" because it means people treat it like a job or sport.
        laughing_man 3mo ago
        Heh. I used to play Dota back when the tournament prizes were really large. There were a lot of Asian guys trying to get rich as a professional playing on the US West server because the competition wasn't as fierce in the US. They would get so angry if you were on their team and weren't playing the way they thought you should.
  - ryandrake 3mo ago
    > I think that’s a choice people can make for themselves. Users do not have meaningful choice. On most games that use Anticheat, it is required to play the game. I can’t choose to use a non-anticheat version of games. It’s either submit to it or don’t play. Not much of a meaningful choice.
- _aavaa_ 3mo ago
  Nobody is forcing you to play a game with kernel anti-cheat. I want to play the game, not deal with mass cheating. Unless the people against kernel-level anti cheat can provide an alternative with similar level of protection, there isn’t anything to discuss as far as I’m concerned.

ChocolateGod 3mo ago

> Riot went as far as pushing a UEFI firmware update to Valorant players to close a hardware attack — the first time an anti-cheat has reached below the operating system to change your firmware I don't believe Vanguard did this at all? It told users they need to update their firmware to play, it didn't touch the firmware itself. > Cheats started in user space, so anti-cheat moved into the kernel to see them. Cheats followed into the kernel, and then below it into hypervisors I think cheats moved into kernel space before anti-cheats did.

sitzkrieg 3mo ago
long beforehand naturally. the arms race is as good of an excuse as any to trample user rights though
glitchc 3mo ago
Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations in memory in a specific order, which brings me to my point: An anti-cheat mechanism can always be defeated if the cheater can access a lower order of abstraction from the mechanism. An arms race is the inevitable outcome. It's either that or competitive gaming is not viable.
- gopher_space 3mo ago
  I mean the assumption here is that administration needs to be automated. Cheating is an intermittent problem at worst on moderated servers.
- ButlerianJihad 3mo ago
  > The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.

vel0city 3mo ago

> I want to preface this with the fact that I’m not a gamer. So you're prefacing it as someone who has never really dealt with the games you like to play getting totally infested with and nearly unplayable with so many cheaters in practically every lobby. Its easy to think its something that's not needed if one never spends any time in the space. Do they stop all cheats? No. Do they make the bar extensively higher to cheat? Absolutely. Even they point this out: "A DMA cheat is a separate FPGA card that sits in a PCIe slot and reads the game’s memory directly over the bus, while a second computer processes what it sees and feeds back aim and wallhacks..." Any random person can go run some executable they found on a forum, what percentage of the playerbase has these FPGA cards and a second computer to properly run these cheats? And even then, more modern systems can even detect these kinds of things. Are there lots of problems with these anti-cheat platforms? Sure. Are they now often developed with ties to countries many wouldn't want have that deep of access to their computers? Sure. Is kernel-level anti-cheat overall as a concept overreach? Probably not for what a lot of players actively want. Players want systems to ensure everyone is playing on a somewhat equal playing field. Other than the games being rendered in the cloud I don't know any other real way to begin to enforce it. > I would rather share a match with the occasional cheater What if it wasn't "the occasional cheater" and instead was "nearly every match of every game you like to play"?

pibaker 3mo ago
Yes, it is very rich for someone with no skin in the literal game to police what others do to their computers. I don't play any games that use anticheat. But I also don't go out of my way to tell other players who knowingly, consensually installs games with anticheat so they can play them. It's like saying it is an invasion of privacy for cycling athletes to be subjected to doping tests. It's their game. Why does it bother you?
- frollogaston 3mo ago
  It's everyone's problem if those PCs get turned into a botnet, but otherwise whatever.

facepalmz 3mo ago

[flagged]

AgentMasterRace 3mo ago

what a goof. yes it's a privacy risk, but so is half the things people do on the internet. cs2 is infested with hackers, arc raiders died because of hackers... many games I've played and loved are dead because of hackers.

vips7L 3mo ago
Hackers were only one of the many straws that killed Arc Raiders. Mostly it was a dev team that didn’t care.
HDBaseT 3mo ago
"CS2 is infested with hackers" is either cope OR you have low trust factor.
- literallyroy 3mo ago
  My NA experience was bad at top level premier (or was ~1 year ago). Why assume a large swath of the community is coping or low trust factor and that instead your experience is the only accurate one?

Thaxll 3mo ago

Since you're not a gamer sorry but your opinion does not means much, you don't seem to realize how cheating is a problem in online games, it's not just an inconvenience, it kills games.

cowthulhu 3mo ago

This article reminds me of Chesterton Fence - the author is complaining about something, without ever experiencing why it exists.

ronsor 3mo ago
Unlike the Fence, kernel anti-cheat wasn't always there and won't be effective in the future with new AI-powered cheats growing.
- fastball 3mo ago
  The analogy of Chesterton's Fence does not imply / require that the fence has been "always there".
- ramon156 3mo ago
  Cheaters are a problem, that's the focus you should be taking, not that KAC is an overreach. Everyone knows its not a solution. Writing an article about a problem without addressing the problem shows the author never had the problem i. The first place
CursedSilicon 3mo ago
I must admit I immediately questioned the credibility of the article when the author admitted they "aren't a gamer" and then started making allusions to vague political threads. Not to say these criticisms aren't valid, but they're a weird jumping off point The reality is none of the companies want to do these things. Every step in this process locks out some subset of customers. And that's not including the ones who meet the technical requirements but are turned off enough by the decision to just avoid the games anyway They're an unfortunate response to how utterly profitable and expansive cheating in online games has become. They cost the companies precious development time that could be spent making the game better to instead make it just vaguely "playable" for normal people
- orbital-decay 3mo ago
  >The reality is none of the companies want to do these things. (...) They're an unfortunate response to (...) This reasoning can be used to justify pretty arbitrary behavior, don't you think? Intent is irrelevant for malice, incentives are enough.

grg0 3mo ago

The tl;dr from the post is that kernel anti-cheat presents both an attack vector for malware and a backdoor for firms. The former is already known to be exploited. I don't know why comments here are so negative. PC gamers should be wary of installing this stuff, and PC users in general wary of attempts to lock down their computer. If game companies want a fully locked down PC, they already have one; it's called a console.

frollogaston 3mo ago
There are people who treat their PC almost like a console, cause all they use it for is video games anyway, but they want more than what a console offers (and will spend a lot). They install whatever. Kernel anti-cheat isn't even the worst thing on those, that'd be Windows. It's fine. Personally I keep my Mac clean. It can play a few games, which is enough for me. I also found a spare PC in e-waste, and occasionally boot it up to play games in Win10, but wouldn't care if it died.

AuthAuth 3mo ago

>it hasn’t stopped cheating No but it has largely reduced it to where you can play competitively and not run into cheaters. Go play f2p csgo and enjoy a hacker in nearly every single game blatantly spinning in spawn head shotting everyone.

dannersy 3mo ago
It doesn't take kernel level anticheat to detect that kind of behavior. This is just laziness.
laughing_man 3mo ago
It's hard to know. If I were cheating on a competitive server, I'd be using cheats that gave me an edge without making me dominant. That sort of thing is very difficult to detect.
- AuthAuth 3mo ago
  But because you were cheating you'd be above your level. So there would be a mismatch somewhere. You'd need to vastly improve your aim to compensate for bad game sense or use wall hacks to compensate for bad map awareness. Either way its not to hard for people to notice if they watch a replay. Not many cheaters are doing tiny adjustments because that would suggest they're already at that skill level.
  - laughing_man 3mo ago
    Oh, I agree that it only makes sense if you're already a world-class player playing other world-class players.

sgjohnson 3mo ago

I’m actually surprised how a lot of commenters here are defending kernel-level anticheat.

sushid 3mo ago
Have you played games with a ton of cheaters? It's infuriating, and I'm glad that kernel-level anti-cheat makes it such that you can have an enjoyable gaming experience. Now, I no longer play competitive shooters due to my age, but this was a huge issue back in the day.
- Akronymus 3mo ago
  On private/community hosted/moderated servers my experience was that cheating was mostly a non-issue. Only with the advent of forced matchmaking/only official servers and such has it become a real problem.
  - dannersy 3mo ago
    I think this is the answer. You get a lot more false positives, but at least the players can do something about it and aren't at the mercy of devs who can stop support at any time and also are fighting a losing battle.
  - deleted 3mo ago
    [deleted]
  - iscoelho 3mo ago
    That's a different type of game entirely. Private/community servers cannot be competitive at the scale of modern competitive games.
    - slumberlust 3mo ago
      Why? I have a hard time imagining anyone would care more about the integrity of the game than the community. Private servers are an IP play, allowing companies to pull the plug completely when it is convenient for them.

charcircuit 3mo ago

The overreach of kernel anticheats that this article complains about can be done just as easily from user mode anticheats. It's not whether an anticheat is kernel mode or not for whether it is overreaching or not. >The hardware requirements lock out Linux and the Steam Deck Because their security is out of date. Meanwhile macOS has modern security good enough to not even require Vanguard to need kernel mode to be effective.

giov4 3mo ago

Uninstalled riot years ago, not playing games that dont run on linux with proton, problem solved and you should do the same. Avoiding to play games that take over my system on a low-level is a no go, I can live without LoL or BF6 and I live even better :) ignoring this problems means you don't care about your identity, data, privacy and you prefer to keep ignoring this and play the games that hype abd you like, but inside you know that long term your are profiled and such profiling will be used against you!

deleted 3mo ago
[deleted]
Parae 3mo ago
I play fighting games. Didn't even bother to try 2XKO on Windows because I knew I won't be able to play on Linux due to Vanguard.

bob1029 3mo ago

I don't think kernel goes far enough. We are pushing down the wrong path. We don't need kernel level anti cheats. I think there should be real world legal consequences for exploiting information systems like this. "Gaming" shouldn't magically exempt a business sector from reasonable protection against fraud and abuse. Just because it's easy to do or involves bits in a computer (that isn't physically on the game developer's premises) should not magically exempt bad actors from prosecution. Yes, it's your computer, those are technically your bits, but this is about how these things are used and the context within which they are. We have the CFAA in the US, but you'd need a fairly loose interpretation to cover most forms of cheating today. I don't really see the distinction between client and server when the actions taken on the client side cause a dramatic loss in quality of service for other clients connected to that same server or p2p relay. South Korea has laws on the books as of 2016. https://dotesports.com/overwatch/news/ow-hacker-sentenced-prison https://dotesports.com/overwatch/news/ow-hacker-sentenced-pr...

giov4 3mo ago
yes but you are going off topic, the point is companies installing low level malware on any gamer's system to prevent cheaters and monitoring all of them as a consequence. And not that there are not enough laws against cheaters and against people tampering with a software or system, also tampering imho has always been the base for the rest of the reversing :)
dTal 3mo ago
No thanks. >We don't need kernel level anti cheats. More than that, they'd be illegal by your own standard, if applied fairly. You can't steal control of someone's computer just because they bought a game from you. That's a strictly more severe "exploit" with strictly more impact on "quality of service" than sending bogus data to a server. Cuts both ways. But we all know how it'd really play out. If lying to a server counts as "hacking", but corporate rootkits and locked bootloaders are fine, all you've really done is solidify "felony infringement of business model". You haven't protected anyone. Video games are a stupid thing to immolate computing freedom for.

wronex 3mo ago

I play a lot. Competitive shooters mostly. Most of them are unplayable for one or two reasons. Cross play (controllers with aim assist) and cheaters. As a PC player I would like to see no aim assist and actual consequences for cheating. I’ll gladly verify my real world identity, if it meant cheaters where banned once and forever. I’ve heard this is how it works in Korea (claim not verified) and could see it work here too as most of Europe has access to very UX friendly state sponsored digital ID. If there were actual stakes to cheating, it would be less prevalent. Now you can create another account and keep playing. Often for free! On a side note. How come replay analysis doesn’t catch more cheaters?

iscoelho 3mo ago
> "How come replay analysis doesn’t catch more cheaters?" 1) There's too many players. 2) Closet cheaters are extremely subjective: automated & manual moderation would be full of false positives. In these cases, functional anti-cheats actually serve to vindicate these players.

galkk 3mo ago

> So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private. You’re not a gamer so you don’t have a word here. I was a competitive gamer and I would happily accept even the game where you need a government id to be allowed to play in ranked/matchmaking. I do dual boot for gaming/home stuff though.

nubinetwork 3mo ago

> During setup, I did a clean Windows 11 install > Unfortunately the install was legacy MBR > I was forced to convert the disk with mbr2gpt and spent about an hour manually rebuilding the boot drive to work under UEFI. I'm surprised Windows 11 even booted on MBR, I was under the impression that after 7 all Windows installs had to be GPT/EFI, regardless of whether secure boot was on or not.

iscoelho 3mo ago

In my opinion, the debate about kernel anti-cheat on Windows is disingenuous fear-mongering. I'm confused why Hacker News of all places misrepresents the technical details. You can already completely compromise the average user's privacy with an underprivileged process (nearly all of your personal information is accessible with zero privileges!), and you can already persist with administrator privileges (that is routinely given on Windows). In regard to the "RCE attacker risk", attackers can RCE to escalate just as easily into vulnerable Windows services (there's too many to count). Kernel drivers aren't that special. In regard to the "CrowdStrike risk", that's not privacy related and is extremely overblown. What exactly does a kernel driver change regarding privacy? Nothing I can think of. It's this simple: If games want your personal data, they don't need a kernel driver to get it.

ChocolateGod 3mo ago
> In my opinion, the debate about kernel anti-cheat on Windows is fear-mongering I don't think a lot of people who complain about kernel anti-cheat actually play competitive games.
- iscoelho 3mo ago
  I feel someone doesn't need to play competitive games to be able to give an honest assessment of the privacy & security risks. I'm sad I'm not seeing that honesty elsewhere in this thread.
  - Reubachi 3mo ago
    It certainly is helpful to understand the mindset of a person who: a.) their hobby is to play competitive games which mandate kernel level (or similar intrusive anti-cheat) b.) either accepts the requirements or builds sufficient security gapping to make it a nonconsideration. These people exist, and would say in an honest assesmment that the above behavior is no more rights-intrusive than what 99 percent of the tech absorbing population allow today.
    - 3mo ago

n3rv 3mo ago

Letting RIOT into your ring ZERO is not a risk I'm willing to take. It just sits nagging in the back of your mind. So why take the risk.

Hikikomori 3mo ago
Are you playing games on a different user? If not a user space program can already access all your files and memory of running processes.
- giov4 3mo ago
  yama? ptrace scope? namespaces? selinux? apparmor? of course depends also on system defaults, but then why I cannot dump ssh-agent process from same user? oh maybe that's also the reason why the move to the kernel level in general? or that's not necessary with different privileges and they could stay on user space without taking over kernel? (insert here philosoraptor meme pls) again having low leve drivers from external corps that could ready anything anytime from my system and exfiltrate without me even knowing is even more scary than running a recent microsoft os! and should be avoided if possible!
  - Hikikomori 3mo ago
    Talking about Windows here as we're discussing kernel anti cheat. >again having low leve drivers from external corps What do you think drivers are then?
- frollogaston 3mo ago
  Userspace program at least needs admin privs to read others' memory, right?
  - Hikikomori 3mo ago
    That's the thing, they don't for processes of the same user.

km144 3mo ago

> So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private. The article makes an argument that anti-cheat is not worth the trade-off, yet the author admits they are a non-gamer. Then they go on to present one example of anti-cheat that tells us all we need to know about actual gamers' preferences—FACEIT. For those who don't know, FACEIT is a third-party matchmaking service, primarily for CS2. People choose to go through the hoops of using third-party service that installs kernel-level anti-cheat on their computer because it helps to keep cheaters out of their games. This seems like pretty strong evidence that the author's argument is not a good representation of gamers' thoughts on this. I don't know what the actual solution is. I suspect if Valve made their own kernel-level anti-cheat people might trust it more, but it's still the same problem.

nomel 3mo ago
I suspect the only technical alternative would be the extreme of "this is not your system at all" mode, and necessarily involve dedicated hardware, where you can boot your computer as a "game console". I also suspect this would mean that mode would necessarily be the "primary" mode [1], PS2 style. [1] https://en.wikipedia.org/wiki/Linux_for_PlayStation_2 https://en.wikipedia.org/wiki/Linux_for_PlayStation_2
avadodin 3mo ago
Faceit has cheaters too by all accounts and some of the cheats have advanced to the point that not even kernel access under secure boot helps as they don't even run on the same device. Behavioral patterns are a much better target. If your cheats make you play like a legit player, who cares? It's the same as in the gym. People are bothered by people who look like Ahnold, and still can't lift one plate. Not the fattie who takes t to look like a normal person. I think that's the spirit of VAC. The only issue is it can't —or won't— detect people helicopter–hopping no–scope sniping around the map or terrible players who shoot you in the face every time in 12ms.
- literallyroy 3mo ago
  Saying FACEIT has cheaters “by all accounts” feels like a bad faith argument without including that it has significantly fewer cheaters (at least at higher ranks). As well as having the ability to report to real human moderators. I have too many hours in cs:go and cs2 and am level 10 FACEIT. I have had many awful cheater experiences in the native competitive systems but have never had an obvious cheater (never reported someone) in a FACEIT match. It works. It raises the bar high enough that cheating is significantly less frequent.

josefritzishere 3mo ago

That sounds like malware.

nhggfu 3mo ago

online real-money and crypto poker sites have a big cheating problem too - and face similar issues for detection. Alarmingly the software for one popular operator has some very invasive features - verging on spyware - including harvesting screenshots of all screens (sent to some unknown biz in india, stored under "who-knows-what" security), hardware fingerprinting, and 'remote access' wired in for future releases. https://pokerindustrynews.com/features/coinpoker-anti-cheat-spyware-remote-access-kyc-leaks-updated/ https://pokerindustrynews.com/features/coinpoker-anti-cheat-...

SwellJoe 3mo ago

I have purchased every Civilization (and closely related) game since III. I have played more hours of any single Civ than all other games combined. I didn't buy Civ VII, because I don't buy malware. As long as it's got Denuvo, it's not a game I'm buying or playing.

preisschild 3mo ago
Fuck Denuvo's parent company (Irdeto) too. They have been making DRM cards for austrian state TV for decades and thus making it a PITA to do something like broadcasting your TV signal over IP to the TVs in the house...

SomeHacker44 3mo ago

Is there some reliable tool which can list all the kernel anti cheat that may be installed on my Windows system, and the games I need to uninstall to remove them? Or remove them directly? Thanks!

valentynkit 3mo ago

[dead]