Live data from Hacker News

/dev/null: Anti-Cheat Kernel Driver (2020)

leagueoflegends.com

11–20 of 142 posts

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#11

No matter how low-level they get in the OS, this is ultimately a losing battle. Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/ ) What can they do next? Demand webcam access with your mouse visible, I guess?

I could see a webcam pointed at your hand/keyboard to verify input being something legit players would happily opt into.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#13

> This isn’t giving us any surveillance capability we didn’t already have. I think this is an important line. Regardless of how people feel about anti-cheating efforts, I don't believe many people realize how much access games already have to their system to the point where it's kind of a miracle there aren't more malicious games out in the wild.

Why limit your argument to games? All softwares that are ran without sandbox sadly have this issue. Any software could be malicious, not only games.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#15

No matter how low-level they get in the OS, this is ultimately a losing battle. Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/ ) What can they do next? Demand webcam access with your mouse visible, I guess?

The difference in effort, for a cheater, between installing a cheat as a user process and a kernel driver is about one button click.

I can decide to cheat, stick my CC info into a website and download a program in less than 5 minutes. To get hardware I need to provide my shipping info and wait a couple of days. If the hardware is banned, I need to wait a few days before my replacement hardware is there, or with software I just update and restart.

It's not an all or nothing thing, it's a game of cat and mouse. The aim isn't to completely stamp out cheaters at any cost, it's to raise the bar sufficiently high to make it so that enough games aren't destroyed by cheaters.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#16

> Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk. So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware, in the very same blo…

> So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware

Which is utter nonsense. Nothing will touch this kernel mode stuff unless they’ve already owned your machine. All the data you care about is accessible from usermode anyway.

The risks of kernel mode anticheat have been wildly overstated, Riot is engaging in the same to spread silly FUD regarding cheats.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#17
post #11

No matter how low-level they get in the OS, this is ultimately a losing battle. Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/ ) What can they do next? Demand webcam access with your mouse visible, I guess?

I could see a webcam pointed at your hand/keyboard to verify input being something legit players would happily opt into.

This is already the standard for speedruns and high-score records for certain games. Partly just because it makes the recording more interesting to watch, but increasingly it's for evidence of not-cheating.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#18

> Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk. So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware, in the very same blo…

Not to mention them saying "if you use AAA games, you may already have such a thing running already so one more won't kill you." whereas, in real life, it increases the odds that a system will get hacked due to it since the attack surface increases (The number of bugs in "EA+Riot" could not be less than "EA", but could be higher, and the other way around)

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#20
post #15

No matter how low-level they get in the OS, this is ultimately a losing battle. Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/ ) What can they do next? Demand webcam access with your mouse visible, I guess?

The difference in effort, for a cheater, between installing a cheat as a user process and a kernel driver is about one button click. I can decide to cheat, stick my CC info into a website and download a program in less than 5 minutes. To get hardware I need to provide my shipping info and wait a couple of days. If the hardware is banned, I need to wait a few days before my replacement hardware is there, or with softw…

> If the hardware is banned, I need to wait a few days before my replacement hardware is there, or with software I just update and restart.

Except perhaps the first few iterations, the hardware won’t be banned. You’ll just have to load a software update for your DMA hardware.

Post reply on HN