Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

/dev/null: Anti-Cheat Kernel Driver (2020)

leagueoflegends.com

Post reply on HN
Print view View original

71–80 of 142 posts

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#71

Post by ivegotnoaccount »

prvit wrote: post #56
ivegotnoaccount wrote: post #46

Earlier quoted context omitted.

I agree that getting hacked through a browser is a far higher risk. However, the said browser is hopefully running with admin privileges, and if it is needed by the malware, it will need something else to exploit. If it was some small editor, it would serve no purpose for this. But we're talking about Riot Games, whose software is installed on hundreds of millions of machines and thus have a non-neglictible odd of be…

Admin privileges don’t matter, all the stuff you care about lives in your homedir. Have you ever seen a real world example of super common and super insecure AV drivers being exploited for LPE? Probably not, it’s not worth the trouble.

I don't know if it has been exploited on the wild, but the subject seemingly interested some enough to find escalations bugs in https://en.m.wikipedia.org/wiki/SafeDisc.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#72

Post by maccard »

10000truths wrote: post #49

What a load of baloney. It's an open secret that client side cheat detection is a losing battle, and yet many games still persist with these unacceptably hacky half measures. The correct approach has always been to perform the cheat detection on the server side and use statistical analysis to detect and ban cheaters. No brittle assumptions about client environment resulting in potential breakages or false bans. No in…

> yet many games still persist with these unacceptably hacky half measures.

Unfortunately what you're suggesting is a hacky half measure.

From a servers perspective there is no difference between a client with a shitty connection and a client who is pretending they have a shitty connection to cheat. The reality is that servers trust clients for some cases (and verifies that those things are possible) because it provides a better experience for a large number of players.

> No brittle assumptions about client environment resulting in potential breakages or false bans.

Let's be honest, server side anticheat is no less susceptible to this than client side. If you're banning on heuristics there's going to be false bans at some point, and you are making assumptions about a perfect client environment with this approach.

> No opportunity for the client to reverse engineer or instrument the binary to patch out the cheat detection methods.

Except you can analyse the ban rates based on how "aggressive" your cheat is across all your players and adjust the effectiveness to keep it under that threshold. If we're going to make the claim that cheaters can always adapt to client side cheats, we can make the same claim for server side cheats.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#73

Post by prvit »

ivegotnoaccount wrote: post #71
prvit wrote: post #56

Earlier quoted context omitted.

Admin privileges don’t matter, all the stuff you care about lives in your homedir. Have you ever seen a real world example of super common and super insecure AV drivers being exploited for LPE? Probably not, it’s not worth the trouble.

I don't know if it has been exploited on the wild, but the subject seemingly interested some enough to find escalations bugs in https://en.m.wikipedia.org/wiki/SafeDisc .

Yes, there are tons of these bugs and tons of PoCs. However, in real life, nobody bothers to exploit them because there’s very little to gain by doing so.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#74

Post by maccard »

neilv wrote: post #21

Due to cheaters, anti-cheats, and a general trend towards invasiveness... I've been thinking that individuals compartmentalizing gaming to dedicated machines (e.g., gaming consoles, dedicated PC gaming rigs) is a good idea. Separating out the requirement to run games, from the general-purpose computing requirements, opens up more options. It also pushes fewer people towards buying into Windows way of life for everyth…

It's a fantastic idea, and the reason I own a console. The extra advantage of consoles is that both I and the developers know that the other players on my platform are all on locked down hardware so measures like this are unnecessary for everyone.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#75

Post by maccard »

judge2020 wrote: post #59
maccard wrote: post #23

Earlier quoted context omitted.

For Microsoft you need a code signing certificate [0], shell out about $500 and to follow some instructions. Apple do allow this through kernel extensions, but its very much opt in from users. [0] https://docs.microsoft.com/en-us/windows-hardware/drivers/de...

While i'm not sure if it works for device drivers, Microsoft is working on Azure Code Signing, which moves it from third-party vendors to MS directly. For Apple, kexts have been deprecated for a while, with more modern APIs available for ensuring privacy and security in device drivers[1]. 1: https://developer.apple.com/support/kernel-extensions/

But kexts are only deprecated and not removed. Someone having enabled kexts is just as likely to be cheating as they are using an old audio interface device with their DAW.

Edit: good to know about MS, I didn't actually know that!

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#76

Post by pilgrimfff »

josephcsible wrote: post #64
pilgrimfff wrote: post #50

Earlier quoted context omitted.

That's why I have to qualify it with ultimately Right now, the analog option is out of reach except to those with the right skills. But the hardware isn't that expensive even now, and will only get cheaper. All it takes is someone to commodify it.

> Right now, the analog option is out of reach except to those with the right skills. What skills? Buying something online, then plugging it in once it shows up on your doorstep?

If there are out-of-the-box options now, then yeah, it could be as you describe.

If you're assuming everyone knows how to wire up motors to a microcontroller and get the software set up and calibrated, that's not accurate. If you want to minimize that to a term besides "skills," that's your prerogative.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#77

Post by drdaeman »

josephcsible wrote: post #64
pilgrimfff wrote: post #50

Earlier quoted context omitted.

That's why I have to qualify it with ultimately Right now, the analog option is out of reach except to those with the right skills. But the hardware isn't that expensive even now, and will only get cheaper. All it takes is someone to commodify it.

> Right now, the analog option is out of reach except to those with the right skills. What skills? Buying something online, then plugging it in once it shows up on your doorstep?

I don't think there are any commercial-grade hardware gaming aids on the market right now. If we don't count gaming keyboards and mouses with macro functionality (some folks consider those "cheats")

All the devices I've seen were hobbyist DIY proof-of-concept hardware. And if we're talking about real hardware assist (a machine that sees a screen and helps human operator with their inputs), it needs a machine vision trained for a specific game/setup and that's also quite an effort.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#78

Post by musjleman »

prvit wrote: post #3

Of course, this is just a blog post by a gaming company for their gamer audience, but lots of this stuff is downright dishonest. For example: > Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk Kernel…

> However, popular cheats aren’t malware, so they can’t do that

It is a rather popular practice to bundle things like discord token stealers amongst cheat developers to find people acting against them. While more uncommon, it isn't unheard of shipping a whole RAT alongside with the cheat.

> It’s a lost battle anyway, DMA cheats keep getting better every day. They will inevitably render clientside anticheat obsolete.

If an anti-cheat manages to stop all client-side cheating - it has already won. Requiring a hardware device to be shipped / being unable to start cheating right after a quick online purchase will deter most of the people that are considering purchasing cheats.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#79

Post by maccard »

blibble wrote: post #61
maccard wrote: post #42

Earlier quoted context omitted.

The hardware isn't banned, the player is banned if the anticheat detects the hardware being used. The hardware might be reprogrammable and self modifying at some point in the future, but until it is and it's widely available a root level anticheat is adequate protection.

> The hardware isn't banned, the player is banned if the anticheat detects the hardware being used. how? it can report itself as any pci device

The cheat software can report itself as any software, so that is the secret sauce. Can't say I'm privy to how exactly that is. The difference between "reports itself as X" and "reports itself as Y" are the same problem space.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#80

Post by j245 »

mentos wrote: post #11
pilgrimfff wrote: post #2

No matter how low-level they get in the OS, this is ultimately a losing battle. Aimbots have gone analog (src: https://hackaday.com/2022/04/30/aimbot-does-it-in-hardware/ ) What can they do next? Demand webcam access with your mouse visible, I guess?

I could see a webcam pointed at your hand/keyboard to verify input being something legit players would happily opt into.

So many problems with this idea..

Can you imagine your child saying “Mom / Dad I need to buy a webcam to play this game”. Alarm bells will be going off immediately.

Financially speaking, every player needs to buy a webcam to play even a free to play game ?

Do you need a camera of a specific quality ? What if the light in your room is off and the object detection can’t work out where your hand is ?

Do you get kicked from the game because the sun went down and you didn’t turn on the light ?

Can’t imagine the compute resources required to pull this off. The skins in the game will probably have to cost 10x more.

This is just what comes to mind after thinking about this for 2 mins.

Post reply on HN