Live data from Hacker News

Call of Duty Adds Kernel Level Driver for Anti-Cheat

callofduty.com

261–270 of 332 posts

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#261

Earlier quoted context omitted.

Hint: game companies don't actually give a shit about cheaters, especially if they're giving them money. The only point at which a company cares about cheaters is when the community starts to really get riled up about them and revenue drops. COD Warzone has a full stats API and cheaters leap off the page. We're talking people with K/D ratios of, say, 10-20:1 or more. All they'd have to do is zap or flag those account…

Given that the solution provided here is actively trying to root out cheaters, I don't know how your initial "hint" statement even holds water. The issue with any kind of wave of ban style action like you are suggesting is that the users can just create new accounts for free and continue to cheat. It greatly reduces the integrity of the overall matchmaking and game experience for everyone else. If you think there is…

I also said:

> The only point at which a company cares about cheaters is when the community starts to really get riled up about them and revenue drops.

My point is not contraindicated by Activision releasing new anti-cheat software a year and a half after a game came out.

Activision likely saw falling player signups/playtime/cosmetics spending, did some surveys, and decided improving their anti-cheat was the way to go.

> If you think there is a better solution to ban repeat bots and cheats please provide it or at least offer a creative response to what COD is trying.

In another comment I pointed out that the games are full of cheaters so blatant their K/D ratios are better than the top pros in the game, sometimes by a factor of ten. It would be trivial for Activision to automatically ban them simply on that alone, or at least auto-flag them for a manual review. A K/D ratio of 1.0 is considered "good" for an average player. 2-3 would be world-class. The top player on one of the CoD:WZ trackers has a K/D ratio of twenty six.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#262

The most annoying one to me is that a bunch of these kernel mode anti-cheat systems also go after the VFIO gamers who don't want to run Windows on bare metal. They consider running Windows in a VM "cheating".

These anti cheats have no other choice than become more and more restrictive to the user. Cloud gaming for everyone coupled to a game controller relying on a secure cryptoprocessor may put a end to cheating in the large.

What's the point of a "secure cryptoprocessor" in a controller when you can de-solder the buttons and trigger them via another MCU? Do you make them like POS terminals that self destruct when they are opened? I can just use a servo to press the buttons.

With the release of YOLOv5, the rat race for cheater free games just got even more one sided.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#263
I really dislike that, I prefer having an occasional cheater than a kernel mode anti-cheat.

Everybody agrees it's a cat-and-mouse game. What's the endgame? Requiring signed peripherals to play? With mouse and keyboard detecting a heartbeat from the player, and gaze tracking?

Short of requiring implants with DRM and a proof of identity, I don't think cheating issues can be solved that way.

Some suggest streaming is the solution. It doesn't protect against ML-based bots, though restricting client info to the bare minimum is probably a good idea: if latency is good enough to allow streaming video, why not stream player position just in time, to prevent against the wallhacks-class of exploits?

ML-powered cheat detection on server side also sounds good, with the usual sanity checks (don't allow large speed, etc).

How to distinguish a good player from a cheater? Maybe have them pass a test on a trusted machine at a cyber café or so, and give them a "good player" badge to crank the anti-cheat detection threshold higher for them. There can't be that many good players, and identifying them sounds promising for future tournaments. Maybe a web-of-trust ring would help as well, with players vouching for each other, and staking their accounts too: when someone gets banned 10 years (permanent bans are just not nice), ban those who referred them 3 years, then 6 months, then 2, etc.

Also, I've been thinking lately at how this could be handled in open-source games, and if there's a way forward, I think it's that one.

At a high-level, game theory kind of approach, I don't think cheating can be prevented in incomplete information games. Two players could collude and exchange information, giving them an edge. This could be made part of gameplay (including vocal chats is probably part of this). Moves can still be checked against a given set of rules retrospectively: use a CRDT-like, directed graph structure to store player actions, check their validity, and when multiple players come in contact with new info, have them exchange that info and cross-validate it. Picture a card game for instance, but it's the same for a FPS.

The alternative is complete-information, where there is nothing to hide, and only the legality of a move has to be checked. For reflex-based games, it's hard to evaluate what level of proficiency to expect from a player. For strategy games, likewise (a player could use some AI tools to help them with their next move).

In the end, I think we have to go back to what makes playing a game fun. I have fun playing against bots, when they're my level. The only issue is being pitted against bots when I have no chance of winning. In that case, ML-based approaches can work to identify skill levels, and pitch opponents of similar skill against each other. Hopefully aimbots will play against aimbots this way. Also, legalize it, and have people declare what kind of assist they use. Heck, integrate it in the game. There's some people I like playing with, even though they are way less skilled: this could make it better for everyone. It would make games even more accessible to everyone, and make cheat providers redundant.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#264

While I don't particularly like this sort of anti-cheat, I think we should all be more worried about cloud gaming than anything else. It's been obvious for a while that the big gaming companies have it in mind, and the only reason it isn't as big as it could be, is due to tech limitations FOR NOW. When (not if) cloud gaming truly takes off, and it will, we'll lose any and all control over our games. So long to moddin…

I agree that your point on cloud gaming is probably valid for companies trying to maintain a rigid grip over software piracy when the companies still build things that can be stolen -- But I don't think it's strictly necessary for the development of anti-cheat systems. In the next version of Windows, we're seeing a rapid acceleration in the amount of hardware/software fingerprinting and secure storage going on in hom…

I am almost certain the MS store built into the Win11 will be this antichrist of consumer control. They have all the pieces. They just need to put them together in the coming years.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#266
post #204

Client-side anti-cheat is a futile endeavor these days and besides being ineffective probably is user-hostile too. Server-side machine learning is the way to go. Also the server should not send info a legitimate client have no use of.

>Server-side machine learning is the way to go. If it has 99% accuracy, then you're banning thousands of players have fun dealing with tickets for them & review process >Also the server should not send info a legitimate client have no use of. do not games send "too much" in order to play around networking constrains?

> If it has 99% accuracy, then you're banning thousands of players

Obviously you can't just automatically permaban people if the system is not based on a technical inspection of the player's system. Instead you have to bar them from playing for a few days or so.

Even VAC reverses bans sometimes.

If you are looking for a perfect solution there will never be one.

> do not games send "too much" in order to play around networking constrains?

Maybe the newest games does that. CSGO and other popular games send complete positions and what-not to every player.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#267
post #128

Earlier quoted context omitted.

No, but TPM would allow unavoidable hardware ban. So when someone is caught, with manual review for example, they won't be able to play again on the same hardware.

That, or hackers would just use a TPM compatible device you can reassign the keys on. Not necessarily useful from a security point of view, but would get you around bans by hardware id.

Does not work like that. The keys are signed by the vendor of the hardware. You are essentially paying for the hardware AND the signed keys within it. The server can choose to only trust vendor signed keys.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#268

Earlier quoted context omitted.

Because the only people in this lobby will be cheaters lol. Most people don't care about running garbage-tier CoD kernel code on their machines... so I wind up having to because they do, because it's the default. Although I concede that basically what I'm asking for here is for the default to be _my_ usecase...

Well this guy only wants to play with friends, so he doesn’t care if everyone else in the lobby are cheaters. He isn’t playing with anyone besides his friends. And why do you care if a lobby exists that you are never going to go to? Why does it bother you if cheaters want to use cheats against each other? As long as you don’t interact with them, I don’t understand why you would care.

In my experience, people that cheat in games like this typically do it to get an edge over everyone else in the lobby. It's not the cheating itself they enjoy but the winning. If everyone in the lobby has the same advantage I doubt they would be content just enjoying the game like the rest of us.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#269

The only realistic solution to this problem is to move the audio and video rendering server-side and stream final output to clients from the edge. You have to attack this from an information theory perspective. If the client receives the information in any manner whatsoever, you must assume it is being used in the most adversarial way possible. The AI problem is more complex, but that's more a function of how deep th…

Sorry to say. There are cheat solutions that can ingest video and emulate keyboard/mouse over usb to pretend to be the user. The kernel driver cheat detection might be able to detect this by only supporting keyboard or mouse device IDs on a whitelist? The cheaters could pretend to be one of those too.

Are these widespread? Easily available? Because yhats the difference. For any major gane you can google and enter your cregit card details and have a kernel level cheat installed in less than 10 minutes.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#270
post #63

Earlier quoted context omitted.

They have to make this distinction, because Riot Games' Vanguard runs at system start, to not have cheats start before it according to the developers. I don't like the practice, but I had to install it anyways to play Valorant with friends.

What I don't get about this, what prevents your cheats from starting at boot too?

I'm not an expert, but from what I've come to understand, anti cheat is for the most part about making it as hard or inconvenient to cheat as possible. You'll never be able to stop it, but putting in hurdles for both the cheat developer and user is key to keeping it limited.

The huge problem is that cheaters are very willing to go to extreme lengths of inconvenience or even risk, as in running random cheats as kernel level drivers.

So anything that makes the developers have to bypass another hurdle and another component you can patch in your anti cheat "rootkit" gives you a small boost in the cat and mouse game.

Your component starting at boot makes it more likely the cheat devs and cheaters will have to do the same and have a more complicated setup.

Post reply on HN