/dev/null: Anti-Cheat Kernel Driver (2020)
leagueoflegends.com
/dev/null: Anti-Cheat Kernel Driver (2020)
1–10 of 142 posts
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#2No matter how low-level they get in the OS, this is ultimately a losing battle.
Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/)
What can they do next? Demand webcam access with your mouse visible, I guess?
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#3Of course, this is just a blog post by a gaming company for their gamer audience, but lots of this stuff is downright dishonest. For example:
> Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk
Kernel mode cheats do not require joining some guy’s botnet or installing a rootkit, even if they use similar techniques. If this claim was true, Riot would have every incentive to publish more detailed analysis in order to deter people from cheating. However, popular cheats aren’t malware, so they can’t do that. Instead, they’ll just stick to vague insinuations.
It’s a lost battle anyway, DMA cheats keep getting better every day. They will inevitably render clientside anticheat obsolete.
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#4>2 years ago
So (2020)?
Also kinda funny a Unix-y element is referenced (/dev/null) whereas the target is only Windows.
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#5> Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk.
So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware, in the very same blog post where they tell you that from now on, they demand the ability to run their own third-party stuff in kernel mode on your machine.
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#6> This isn’t giving us any surveillance capability we didn’t already have.
I think this is an important line. Regardless of how people feel about anti-cheating efforts, I don't believe many people realize how much access games already have to their system to the point where it's kind of a miracle there aren't more malicious games out in the wild.
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#7No matter how low-level they get in the OS, this is ultimately a losing battle. Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/ ) What can they do next? Demand webcam access with your mouse visible, I guess?
[deleted]
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#8Good luck vs ring-3 DMA.
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#9You basically can't have a PC game in 2022 without a kernel rootkit to detect cheating.
Re: /dev/null: Anti-Cheat Kernel Driver (2020)
#10Does Microsoft have to approve these drivers? I would argue Microsoft should not allow this kind of thing if they really want to provide security.
Apple would never approve such a mechanism, for sure.