Live data from Hacker News

Kernel anti-cheat is an overreach

nooneshappy.com

41–50 of 119 posts

Re: Kernel anti-cheat is an overreach

#41

>it hasn’t stopped cheating No but it has largely reduced it to where you can play competitively and not run into cheaters. Go play f2p csgo and enjoy a hacker in nearly every single game blatantly spinning in spawn head shotting everyone.

It doesn't take kernel level anticheat to detect that kind of behavior. This is just laziness.

Re: Kernel anti-cheat is an overreach

#42
post #27

Earlier quoted context omitted.

Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations i…

> The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.

You can buy an autoclicking device or software that recognizes screen pixels of enemy avatars and instantly clicks to kill them. This works in "remote streaming" situations and is ~30% of the cheating dataset detected by Riot's kernel level anticheat:

https://www.riotgames.com/en/news/vanguard-on-demand

> A “pixelbot” is a computer vision cheat that injects player input for the purposes of aiming at heads or casting spells with perfect timing. Coming in “external” (hardware microcontroller) and “internal” (python script) varieties, pixelbots can be extremely impactful in VALORANT due to the low time-to-kill, sometimes just simply pulling the trigger for the cheater when an enemy enters their reticle (also known as a “triggerbot”).

Re: Kernel anti-cheat is an overreach

#43

>it hasn’t stopped cheating No but it has largely reduced it to where you can play competitively and not run into cheaters. Go play f2p csgo and enjoy a hacker in nearly every single game blatantly spinning in spawn head shotting everyone.

It's hard to know. If I were cheating on a competitive server, I'd be using cheats that gave me an edge without making me dominant. That sort of thing is very difficult to detect.

Re: Kernel anti-cheat is an overreach

#44
post #27

> Riot went as far as pushing a UEFI firmware update to Valorant players to close a hardware attack — the first time an anti-cheat has reached below the operating system to change your firmware I don't believe Vanguard did this at all? It told users they need to update their firmware to play, it didn't touch the firmware itself. > Cheats started in user space, so anti-cheat moved into the kernel to see them. Cheats f…

Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations i…

Windows has no security between processes reading and writing each other's memory as long as they are from the same user. You doing need kernel level access to do it.

Re: Kernel anti-cheat is an overreach

#45

I’m actually surprised how a lot of commenters here are defending kernel-level anticheat.

Same. I write cheats for CS2 for my own amusement and it's 100% detectable by replay analysis.

If I'm reacting to information that I shouldn't have at a rate much much greater than the general population, then I'm not psychic, I'm just cheating.

This is also true for aiming, spray control, etc. All current cs2 cheaters are producing a very large and detectable audit trail of very suspicious plays in game, even if they think they're being sneaky. The resolution of the data looks like keeping track of your location and where you're aiming about every 15ms.

Here's some recent research that's related: https://arxiv.org/html/2508.06348v1

I can hide from a kernel module, but I can't hide from my own data trail.

There's only really two paths:

* We do kernel anti-cheat in trusted execution environments, which is bad for all the reasons in the article. When I break through this, you'll get the full "having a cheater" experience in your game.

* We do AI/ML heuristic-based detection to the point where cheaters are forced to behave exactly like non-cheating teammates or risk detection, cheating maybe only 10-20% above their previously established skill patterns. When I break through this, you'll have a normal game and I'll be kind of bored and nobody will be having the "cheaters in my game" experience even though I'm actually cheating.

In either case, I'm still going to try and beat the system for fun. Because video games.

Re: Kernel anti-cheat is an overreach

#46
post #27

> Riot went as far as pushing a UEFI firmware update to Valorant players to close a hardware attack — the first time an anti-cheat has reached below the operating system to change your firmware I don't believe Vanguard did this at all? It told users they need to update their firmware to play, it didn't touch the firmware itself. > Cheats started in user space, so anti-cheat moved into the kernel to see them. Cheats f…

Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations i…

> An arms race is the inevitable outcome. It's either that or competitive gaming is not viable.

I'd rather just give my passport and do one of those face turning challenges to play competitive video games. Then if I get caught cheating, my real life identity can't play anymore, rather than make a new account and "get better at cheating".

If I am a habitual cheater in literally any other sport on Earth, governing body figures that out and issues me a lifetime ban. At that point, I'm blacklisted. Even my Tuesday night dodgeball league can issue bans that actually stick because they know my real identity.

Re: Kernel anti-cheat is an overreach

#47
Uninstalled riot years ago, not playing games that dont run on linux with proton, problem solved and you should do the same.

Avoiding to play games that take over my system on a low-level is a no go, I can live without LoL or BF6 and I live even better :)

ignoring this problems means you don't care about your identity, data, privacy and you prefer to keep ignoring this and play the games that hype abd you like, but inside you know that long term your are profiled and such profiling will be used against you!

Re: Kernel anti-cheat is an overreach

#48
I don't think kernel goes far enough. We are pushing down the wrong path. We don't need kernel level anti cheats.

I think there should be real world legal consequences for exploiting information systems like this. "Gaming" shouldn't magically exempt a business sector from reasonable protection against fraud and abuse. Just because it's easy to do or involves bits in a computer (that isn't physically on the game developer's premises) should not magically exempt bad actors from prosecution. Yes, it's your computer, those are technically your bits, but this is about how these things are used and the context within which they are.

We have the CFAA in the US, but you'd need a fairly loose interpretation to cover most forms of cheating today. I don't really see the distinction between client and server when the actions taken on the client side cause a dramatic loss in quality of service for other clients connected to that same server or p2p relay.

South Korea has laws on the books as of 2016.

https://dotesports.com/overwatch/news/ow-hacker-sentenced-pr...

Re: Kernel anti-cheat is an overreach

#49
post #33

Earlier quoted context omitted.

Have you played games with a ton of cheaters? It's infuriating, and I'm glad that kernel-level anti-cheat makes it such that you can have an enjoyable gaming experience. Now, I no longer play competitive shooters due to my age, but this was a huge issue back in the day.

On private/community hosted/moderated servers my experience was that cheating was mostly a non-issue. Only with the advent of forced matchmaking/only official servers and such has it become a real problem.

[deleted]

Re: Kernel anti-cheat is an overreach

#50
I play a lot. Competitive shooters mostly. Most of them are unplayable for one or two reasons. Cross play (controllers with aim assist) and cheaters. As a PC player I would like to see no aim assist and actual consequences for cheating. I’ll gladly verify my real world identity, if it meant cheaters where banned once and forever. I’ve heard this is how it works in Korea (claim not verified) and could see it work here too as most of Europe has access to very UX friendly state sponsored digital ID.

If there were actual stakes to cheating, it would be less prevalent. Now you can create another account and keep playing. Often for free!

On a side note. How come replay analysis doesn’t catch more cheaters?

Post reply on HN