Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anti-cheat kernel driver

na.leagueoflegends.com

Post reply on HN
Print view View original

51–60 of 115 posts

Re: Anti-cheat kernel driver

#51

Post by nebulous1 »

akersten wrote: post #15
mkj wrote: post #4

I guess next step is for cheat software to run in a hypervisor. Now what're you gonna do!

Yep. The article even smugly tries to boast about how they're adults and understand these things : > We haven’t needed both arms yet, primarily because we have the advantage of steady paychecks and the lack of strict bedtimes at our immediate disposal. But as much as we might like the idea of an ever-escalating appsec war with teenagers, And yet they fail to realize that they're playing in to the very cat-and-mouse g…

> Spoilers: the teenagers will always win; you can never trust a client no matter how many technical barriers you erect.

I think if we accept sgx type technology onto our systems then they can at some stage win this battle, at least theoretically. This is assuming that the sgx-like tech cant be practicably attacked, which isnt currently a valid assumption but could, at least theoretically, be in the future.

This differs from non-hardware drm which is basically just obfuscation, and which the method they're currently describing is merely an extension of.

Re: Anti-cheat kernel driver

#52

Post by int_19h »

stealthascope wrote: post #40
some-guy wrote: post #17

Earlier quoted context omitted.

This is why I appreciate still being close high school LAN party friends close online--I can start a group chat and get a game going between each other, and maybe they can invite a friend of theirs to get the number of players up for a game. If you can manage to maintain these relationships then online gaming can be very rewarding without having to worry about the trainwreck you described. This doesn't work with all…

Did they ever release a version of 2k4 for linux? I can play the UT2003 native version for linux just fine (doesn't seem to play nice with amdgpu, but the intel driver seems to be fine).

It came with the Linux installer on the DVD, same as UT2003.

Re: Anti-cheat kernel driver

#53

Post by toast0 »

nebulous1 wrote: post #51
akersten wrote: post #15

Earlier quoted context omitted.

Yep. The article even smugly tries to boast about how they're adults and understand these things : > We haven’t needed both arms yet, primarily because we have the advantage of steady paychecks and the lack of strict bedtimes at our immediate disposal. But as much as we might like the idea of an ever-escalating appsec war with teenagers, And yet they fail to realize that they're playing in to the very cat-and-mouse g…

> Spoilers: the teenagers will always win; you can never trust a client no matter how many technical barriers you erect. I think if we accept sgx type technology onto our systems then they can at some stage win this battle, at least theoretically. This is assuming that the sgx-like tech cant be practicably attacked, which isnt currently a valid assumption but could, at least theoretically, be in the future. This diff…

SGX is theoretically strong, but the implementation matters. If the motivation and budget is there, SGX enabled chips could be decapped and reverse engineered. It would be an immense challenge though, so I doubt the budget would be there for cheating. Implementation errors are a more realistic target.

But, assuming you can't cheat on the system itself, you can probably cheat with the video/audio signal and generating USB inputs. It's harder than reading ram, but it's not feasible to stop it. At that point, you have to depend on behavioral targeting and what not (which they're already doing)

Re: Anti-cheat kernel driver

#54

Post by gclawes »

tomc1985 wrote: post #34
jitl wrote: post #30

Earlier quoted context omitted.

I decided to downvote you for both a gate-keeping attitude (how dare a non-SWE else understand a bit of this stuff?) and for name calling, etc. Please consider learning some empathy.

How is desiring technical depth in a technical post "gatekeeping"? The ananlogies are horribly pained. It is an excess of empathy that ruins technical writing that could otherwise be quite rich with information. This attitude of writers having to do all the work needs to end; let the reader do some of it edit- its reductivist to think that only SWEs would understand this stuff. Have you forgotten about the legions of…

Unfortunately, richness of information is probably something they want to avoid, lest they give cheat programmers any help.

Not that I'm defending this crap, in my mind it's basically a rootkit that can snoop on anything in your system. Currently trying to figure out how to run games in a hypervisor.

Re: Anti-cheat kernel driver

#55

Post by tomc1985 »

gclawes wrote: post #54
tomc1985 wrote: post #34

Earlier quoted context omitted.

How is desiring technical depth in a technical post "gatekeeping"? The ananlogies are horribly pained. It is an excess of empathy that ruins technical writing that could otherwise be quite rich with information. This attitude of writers having to do all the work needs to end; let the reader do some of it edit- its reductivist to think that only SWEs would understand this stuff. Have you forgotten about the legions of…

Unfortunately, richness of information is probably something they want to avoid, lest they give cheat programmers any help. Not that I'm defending this crap, in my mind it's basically a rootkit that can snoop on anything in your system. Currently trying to figure out how to run games in a hypervisor.

I get that, but it's not like a dedicated attacker can't find relevant information elsewhere.

If your adversary controls the hardware, you've already lost

Which explains why most of the moneymen in this industry push so hard to control hardware we've bought and paid for -- and in many cases built.

Re: Anti-cheat kernel driver

#56

Post by matheusmoreira »

dmitrygr wrote: post #27

> This isn’t giving us any surveillance capability we didn’t already have. If we cared about grandma’s secret recipe for the perfect Christmas casserole, we’d find no issue in obtaining it strictly from user-mode and then selling it to The Food Network. The purpose of this upgrade is to monitor system state for integrity (so we can trust our data) and to make it harder for cheaters to tamper with our games (so you ca…

Yes. It betrays a fundamental lack of respect for the user of the computer.

They don't think of themselves as guests who have the privilege of being installed on people's computers. They actually think they own our machines. In their opinion, the mere existence of cheats is an affront to their divine authority over our domains. To them, we are merely an adversary who must be attacked and defeated preemptively before we do something we aren't supposed to do. Our power, freedom and autonomy must be taken away for the sake of their security and the integrity of their video game.

This is unacceptable. Game companies don't get to decide what we can or can't do with our computers. Users are free and they own the machine. If they want to run client-side cheats, so be it. It's not like they're cracking and taking over the game company's servers. If they disrespect users by messing with their computers, they should not be surprised when users show them who's really in charge.

We have quality and trust issues with drivers written by hardware manufacturers and we're finally getting them to contribute free or open source versions. The situation is finally improving. Proprietary cheating prevention software is the last thing we need running in kernel mode right now.

Besides, the video games industry doesn't deserve our trust. For example, capcom.sys had privilege escalation as a feature:

https://twitter.com/TheWack0lian/status/779397840762245124/

https://www.theregister.co.uk/2016/09/23/capcom_street_fight...

The privacy policies and terms of service associated with existing cheating prevention software don't exactly inspire confidence either. They collect and transmit a lot of personal information and will even take screen shots. It's unwise to run this software in anything but a completely isolated environment, to say nothing of kernel mode. Unfortunately, the ability to run the game in a completely isolated and controlled environment is exactly what enables us to hack it and cheat. They're going to have to live with that.

Re: Anti-cheat kernel driver

#57

Post by Fire-Dragon-DoL »

bob1029 wrote: post #42

Ah yes. A kernel-level security feature provided by a software company wholly-owned by a Chinese conglomerate. I do not think I will continue running their software on my machines. Also, many other posters here have commented that kernel-level mitigations are futile in the face of hypervisor or hardware attacks. What's to stop me from altering system memory arbitrarily using a PCIe device I control externally? How wo…

Problem with those systems are the forums full of completely innocent people being banned

Re: Anti-cheat kernel driver

#58

Post by matheusmoreira »

JohnFen wrote: post #2

I understand why anticheat software exists, and why it's getting increasingly intrusive (and therefore risky). I'm not arguing that there's anything wrong with it. That said, the existence of cheaters is one of the big reasons why I don't play such games -- and that games include anticheating software is another one of the big reasons, equal to the existence of cheating in terms of how objectionable I find it. From m…

The fact is online multiplayer games are fundamentally broken. It depends on trust and that's rare because almost no one knows each other. Everyone's a stranger. It's just random people playing together. People find ways to cheat even on trusted platforms like game consoles.

People should be playing online with others they personally know and trust.

Re: Anti-cheat kernel driver

#59

Post by nitrogen »

matheusmoreira wrote: post #56
dmitrygr wrote: post #27

> This isn’t giving us any surveillance capability we didn’t already have. If we cared about grandma’s secret recipe for the perfect Christmas casserole, we’d find no issue in obtaining it strictly from user-mode and then selling it to The Food Network. The purpose of this upgrade is to monitor system state for integrity (so we can trust our data) and to make it harder for cheaters to tamper with our games (so you ca…

Yes. It betrays a fundamental lack of respect for the user of the computer. They don't think of themselves as guests who have the privilege of being installed on people's computers. They actually think they own our machines. In their opinion, the mere existence of cheats is an affront to their divine authority over our domains. To them, we are merely an adversary who must be attacked and defeated preemptively before…

Have you ever played a multiplayer game when someone else is cheating?

Re: Anti-cheat kernel driver

#60

Post by TheAceOfHearts »

xenadu02 wrote: post #31
blibble wrote: post #23

Earlier quoted context omitted.

quite a few games prevent you running on a hypervisor (e.g. CSGO) this was one reason I stopped gaming under Windows inside KVM (the main reason being input lag/jitter) eventually all the cheats will move into the hypervisor and every competitive game will ban the use of virtualisation

Probably only because most hypervisors don't bother to hide themselves. There's no reason you couldn't prevent detection. Not to mention some people are creating FPGA boards that use DMA to read memory, something no one is setup to prevent (would require an IOMMU and an OS that bothered to configure it properly; also very difficult to differentiate legit cards from cheating cards and an area game developers have zero…

> some people are creating FPGA boards that use DMA to read memory

Do you have any links handy where one could read more about this? I'm really curious about the kinds of projects people are doing which requires this kind of hardware.

Post reply on HN