Call of Duty Adds Kernel Level Driver for Anti-Cheat • Hacker News Board

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#61

Post by bick_nyers » Wed, Oct 13, 2021, 5:51 PM UTC

Tade0 wrote: post #29

stefan_ wrote: post #9

Earlier quoted context omitted.

Yes, it's an impossible fight. Give up early and just detect the supernatural aim server-side or have a working report system.

Or increase the role of aim and reflex when determining rank. Should also reduce smurfing somewhat - you'd only be able to dominate a match once with a given account.

Never thought about that approach before, that is super interesting. Tying it entirely to rank isn't the best, but placing you in lobbies on an axis that is independent (but correlated with) rank would achieve the same effect without clogging high-ranks with cheaters and giving cheaters a reward.

Then the cheaters organically get placed in lobbies with other cheaters, ruining the fun for them. If the system doesn't work the best right out of the box, that's fine, because you are still gravitating those cheaters upwards in rank, which will most guarantee that they get reported from other players.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#62

Post by cstrahan » Wed, Oct 13, 2021, 5:51 PM UTC

VWWHFSfQ wrote: post #13

It's cheating really that big of a deal? How do they try to stop it now? Do they really need a kernel driver?

Yeah, it's pretty bad.

> How do they try to stop it now?

Generally, they don't. They have an in game reporting function, but it doesn't seem to do much good. Many cheaters live stream their exploits, seeing people through walls, getting 100%-accuracy-all-head-shots, etc. The net code that's responsible for reporting where you are aiming is separate from the data/code that reports where your bullets are sent, so some cheaters show off by shoot directly at the ground below their feet while magically killing people several hundred feet up above in a helicopter.

The experience is often pretty bad, and yet people still play the game...

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#63

Post by novok » Wed, Oct 13, 2021, 5:51 PM UTC

schmorptron wrote: post #37

gigatexal wrote: post #11

“ When you shut down Call of Duty: Warzone, the driver turns off.” is that really how drivers work?

They have to make this distinction, because Riot Games' Vanguard runs at system start, to not have cheats start before it according to the developers. I don't like the practice, but I had to install it anyways to play Valorant with friends.

What I don't get about this, what prevents your cheats from starting at boot too?

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#64

Post by vkou » Wed, Oct 13, 2021, 5:53 PM UTC

VWWHFSfQ wrote: post #13

It's cheating really that big of a deal? How do they try to stop it now? Do they really need a kernel driver?

> It's cheating really that big of a deal?

Yes, it makes competitive/casual play crap. In CoD in particular, it is out of control.

> How do they try to stop it now?

A variety of ways, ranging from server-side analytics, player-driven report systems, manual review, the game inspecting its own state, processes that spy on your computer, and rootkits. Each and every one of these has different advantages and drawbacks.

> Do they really need a kernel driver?

Given how ineffective anti-cheat efforts in CoD have been, it's possible that they need a kernel driver to bring it under control. It's possible that a more talented team would not.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#65

Post by endtype » Wed, Oct 13, 2021, 5:53 PM UTC

jpgvm wrote: post #48

This is an arms race that game developers won't win, it's just whack-a-mole. They should invest instead in server-side models for detecting cheating, then it can't be circumvented and you don't need to bother learning all the different ways they can produce inhuman inputs.

Most cheats replicate things humans can do. They correct issues people have with their aim or reaction times.

Inhuman inputs are a thing of the past. Kids these days can do some pretty wild stuff at high levels of play.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#66

Post by CoolGuySteve » Wed, Oct 13, 2021, 5:53 PM UTC

rafale wrote: post #8

Microsoft should implement an Xbox mode for Windows that has these protection features for all games. It will probably require some virtualization and performance degradation but it's better than each game rolling out their own half assed drivers.

Windows should suspend background services and liquidate more physical memory for the game anyways. ie: Just get out of the fucking way.

Anticheat would just be icing on the cake of a dedicated game mode.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#67

Post by DizzyDoo » Wed, Oct 13, 2021, 5:53 PM UTC

Thaxll wrote: post #56

jpgvm wrote: post #48

This is an arms race that game developers won't win, it's just whack-a-mole. They should invest instead in server-side models for detecting cheating, then it can't be circumvented and you don't need to bother learning all the different ways they can produce inhuman inputs.

"They should invest instead in server-side models for detecting cheating" Which is already the case and can't work for all use cases. how the server knows that you see behind walls exactly? And ML / heuristic stuff is very limited as well. Detecting cheating, client or server side is very complicated and not even close to be a solved problem.

I once had an unusually good match in a popular FPS game, triggered some statistical tripwire, and received an automatic ban for 48 hours. "Just in case". Streamers and pro-players often have their accounts whitelisted from this system, because it would be laughable to happen publicly and show off just how 'security theater' it truly is.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#68

Post by jccalhoun » Wed, Oct 13, 2021, 5:54 PM UTC

Cheaters are going to figure out a way to cheat. Even if it means some kind of TASBot device to physically press the buttons on a controller there will always be a way for someone to cheat.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#69

Post by ju57u5 » Wed, Oct 13, 2021, 5:55 PM UTC

mgsk wrote: post #24

q_andrew wrote: post #5

Not to say this isn't a worrying practice, but it's unfortunately industry standard. Almost every mainstream fps game has intrusive software, to the point where you're expected to be thankful that it's not a rootkit (which is not unheard of).

Then there's CS:GO, whose developers refuse to use intrusive practices to counter cheating. And the game is ruined by rampant cheating. (Neither for nor against. Just saying.)

CS:GO would need to separate Linux and Windows users for any reasonable attempt at creating a kernel level detection that works, wouldn't they?

Because of the steam deck that would be pretty bad business, so maybe it's less about intrusiveness and more about that valve can't, without destroying their hedge against a Windows monoculture in gaming.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#70

Post by Sohcahtoa82 » Wed, Oct 13, 2021, 5:55 PM UTC

stefan_ wrote: post #9

DizzyDoo wrote: post #4

Earlier quoted context omitted.

If I write a cheat for your game that operates on the kernel level, how would you detect it from the game that runs in user space?

Yes, it's an impossible fight. Give up early and just detect the supernatural aim server-side or have a working report system.

> detect the supernatural aim server-side

Not possible. Sure, it might be possible to detect a player instantly snapping to the center of an opponent's head and clicking, but cheats could easily make the aim move over the course of several frames, and make the target off of the center of the head by a couple pixels to simulate someone just being really good.

I've watched some really good gamers in person. People's ability to quickly flick their mouse and pop shot to a target only 1/4" inch wide on their screen in a tiny fraction of a second is insane to me.

So being able to differentiate between a cheat that tries to behave like a god-like player (rather than simply aiming to a head in a single frame) and an actual god-like player is not possible.

> a working report system.

Also not possible because of the sheer number of reports. There are people that will report 100% of the time they lose a firefight, even if a replay makes it very obvious that the person they lost against was not cheating.

And again, even with a replay, it can be impossible to differentiate between a cheater and a really good player, except in the case of OBVIOUS cheats, like shooting through a wall with 100% accuracy, or firing into nowhere and scoring hits on targets a mile away.

At best, you could ban people from using the report system when it's obvious they're abusing it, but evaluating reports has to be a manual process, but manual processes doesn't scale when you've got a player base of 7 figures or more.