Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

/dev/null: Anti-Cheat Kernel Driver (2020)

leagueoflegends.com

Post reply on HN
Print view View original

121–130 of 142 posts

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#121

Post by robalni »

ThatPlayer wrote: post #119
robalni wrote: post #107

Earlier quoted context omitted.

It becomes the developer's problem because they put themselves in a position where their money and future depends on what random people do in a game. Nobody should expect it to go well when you connect random people on the internet and require them to behave. Just look at Twitter and places like that. We need a different structure.

What do you have in mind for a different structure?

One old and tested solution is that you play with your friends or people you trust. This has worked perfectly for board games and other pre-internet games for many years.

Otherwise if you want to play at a bigger scale, I don't know how you would do that. Maybe that's just the lesson you have to learn, that random people on the internet can't be trusted.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#122

Post by mentos »

j245 wrote: post #120
mentos wrote: post #115

Earlier quoted context omitted.

I imagine it would start with competitive leagues first and then slowly expand into mainstream if the technology proved itself.

Can’t imagine a significant number of users ever accepting this solution, there’s too much hassle involved. Users who are not attempting world record attempts or playing tournaments where money or fame is on the line.. in other words.. 99.99% of the user base will have no incentive to bother with webcam hand recording anti-cheat systems. They will just move onto another less bothersome game that doesn’t require it, a…

There will always be servers for the players that don’t care about hackers to play on.

For the ones that are sick of having their games ruined by hackers they’ll angle their webcam down at their hands (or use the app on their smartphone) and join the server that supports it.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#123

Post by aussieshibe »

Putting aside the technical aspect, the tone of this post feels familiar to me.

In one of my earlier roles, I was responsible for a system used to filter internet access for about a million school students. The students were absolutely easily able to bypass our filtering in a bunch of ways we could not address, as we had no control over the client devices.

Being a team of professionals in a situation where we were constantly being defeated by a bunch of kids felt humiliating, even as we acknowledged the uneven battleground we were fighting on.

I suspect a similar feeling was behind this blog post. Why else say things like "as much as we might like the idea of an ever-escalating appsec war with teenagers"? This comes off as bitter and insincere to me. As though they're trying to put down their adversary while simultaneously acknowledging they're losing the battle and need to deploy the nuclear option.

Edit: not that "teenager" is necessarily a put down. If there's one thing I learned from that job, it's that teenagers are incredibly resourceful.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#124

Post by ok123456 »

josephcsible wrote: post #65
ok123456 wrote: post #54

Doesn't every machine with thunderbolt have the ability to have its memory edited undetectably?

Don't IOMMU's prevent that these days?

That's not much protection, as it pertains to "trusted computing," if it can be silently turned on or off as a bios setting.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#125

Post by charcircuit »

gregsadetsky wrote: post #70
charcircuit wrote: post #31

Earlier quoted context omitted.

>DMA cheats keep getting better every day These require buying physical harder instead of someone being able to just download a cheat for free. Also if you are writing memory to cheat / sending weird packets you can detect that and ban them.

From this video demo'ing a real DMA cheating device -- https://www.youtube.com/watch?v=AIbkt6Rl8FA -- the DMA is read, but the input to the computer is automated "movements" from a device masquerading as a USB mouse i.e. no DMA/memory writing.

Not all cheats can be done via a mouse or keyboard. Take for example a name changer where you steal the name of a teammate to confess people. Or for changing your movement speed or setting your client to think it's actually alive when dead.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#126

Post by charcircuit »

prvit wrote: post #37
charcircuit wrote: post #31

Earlier quoted context omitted.

>DMA cheats keep getting better every day These require buying physical harder instead of someone being able to just download a cheat for free. Also if you are writing memory to cheat / sending weird packets you can detect that and ban them.

> instead of someone being able to just download a cheat for free Decent hacks are already rather expensive, it’s not unusual for people to pay above $100/mo. > Also if you are writing memory to cheat […] you can detect that and ban them. There is no generic way to detect this.

>There is no generic way to detect this.

You have the anticheat hook the game to monitor the game setting the memory and then the anticheat waits for the cheat to modify a location in memory.

It's a cat and mouse game, but that's the nature of anticheats.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#127

Post by wswope »

phendrenad2 wrote: post #92
wswope wrote: post #33

Earlier quoted context omitted.

They’ve never actually rolled this out for League. I’ve played hundreds if not thousands of hours of competitive matches over a decade and never seen a blatant cheater (maybe 1-2 cass botters, but couldn’t be sure). Given that it’s one of the biggest online PvP games around, I don’t think you or Riot are really making a strong case here.

To understand why it's a strong argument, you have to understand the difference between 2D games like League and 3D games like Valorant. In a 2D game, the game is slow enough that you can keep most of the state server-side. The potential to cheat in League is very low. Things you might want to do include (1) macros to do combos (2) automatically run away when low health (3) bigger alerts when an enemy is charging you…

Having started my technical career long ago as an angsty teen looking to develop cheats, I'm aware of the architectural issues. This is probably a hot take, but for FPS and the like, I view wallhack-type cheats as fully inevitable, and more of a game design challenge than a technical one.

Compared to old school FPS like COD and CSGO, I'll throw out Overwatch as a good example of a game that de-emphasizes the relative importance of knowing an enemy's position by dramatically raising TTK and placing importance on team coordination, mechanics, and character selection. A cheating sniper in OW can easily get shut down by the coordinated actions of two enemy tank players. Designing the game in a way that limits the ability of a single wall-hacking sniper to ruin the experience is IMO much more effective than getting into a kernel-level AC arms race. Valorant still has cheats available for it, after all.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#129

Post by seba_dos1 »

charcircuit wrote: post #125
gregsadetsky wrote: post #70

Earlier quoted context omitted.

From this video demo'ing a real DMA cheating device -- https://www.youtube.com/watch?v=AIbkt6Rl8FA -- the DMA is read, but the input to the computer is automated "movements" from a device masquerading as a USB mouse i.e. no DMA/memory writing.

Not all cheats can be done via a mouse or keyboard. Take for example a name changer where you steal the name of a teammate to confess people. Or for changing your movement speed or setting your client to think it's actually alive when dead.

...and those kinds of cheats are best avoided with a bit of server-side validation.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#130

Post by Mandatum »

prvit wrote: post #117
Mandatum wrote: post #116

Earlier quoted context omitted.

Proctoring means someone watching over your shoulder and surrounding environment. That is, setting up cameras for a side-on view, and behind you - with visibility of your screen(s). Only relevant for tournaments.

That’s what I would’ve taken it to mean, but I’m rather confused with regards to where you might actually run into that?

Every pro-league is going to end up doing this. Either through publicly visible time-delayed streams of the user's room, desk, front-of-user - or through a private entity dedicating a resource to manually review reports from proctored games who will only view suspicious or manually reported encounters/events.

Obviously this doesn't scale, so it'll be limited to paid leagues and tournaments.

Post reply on HN