Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kernel anti-cheat is an overreach

nooneshappy.com

Post reply on HN
Print view View original

51–60 of 119 posts

Re: Kernel anti-cheat is an overreach

#51

Post by giov4 »

bob1029 wrote: post #48

I don't think kernel goes far enough. We are pushing down the wrong path. We don't need kernel level anti cheats. I think there should be real world legal consequences for exploiting information systems like this. "Gaming" shouldn't magically exempt a business sector from reasonable protection against fraud and abuse. Just because it's easy to do or involves bits in a computer (that isn't physically on the game devel…

yes but you are going off topic, the point is companies installing low level malware on any gamer's system to prevent cheaters and monitoring all of them as a consequence. And not that there are not enough laws against cheaters and against people tampering with a software or system, also tampering imho has always been the base for the rest of the reversing :)

Re: Kernel anti-cheat is an overreach

#52

Post by galkk »

> So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private.

You’re not a gamer so you don’t have a word here. I was a competitive gamer and I would happily accept even the game where you need a government id to be allowed to play in ranked/matchmaking. I do dual boot for gaming/home stuff though.

Re: Kernel anti-cheat is an overreach

#53

Post by nubinetwork »

> During setup, I did a clean Windows 11 install

> Unfortunately the install was legacy MBR

> I was forced to convert the disk with mbr2gpt and spent about an hour manually rebuilding the boot drive to work under UEFI.

I'm surprised Windows 11 even booted on MBR, I was under the impression that after 7 all Windows installs had to be GPT/EFI, regardless of whether secure boot was on or not.

Re: Kernel anti-cheat is an overreach

#54

Post by dTal »

bob1029 wrote: post #48

I don't think kernel goes far enough. We are pushing down the wrong path. We don't need kernel level anti cheats. I think there should be real world legal consequences for exploiting information systems like this. "Gaming" shouldn't magically exempt a business sector from reasonable protection against fraud and abuse. Just because it's easy to do or involves bits in a computer (that isn't physically on the game devel…

No thanks.

>We don't need kernel level anti cheats.

More than that, they'd be illegal by your own standard, if applied fairly. You can't steal control of someone's computer just because they bought a game from you. That's a strictly more severe "exploit" with strictly more impact on "quality of service" than sending bogus data to a server. Cuts both ways.

But we all know how it'd really play out. If lying to a server counts as "hacking", but corporate rootkits and locked bootloaders are fine, all you've really done is solidify "felony infringement of business model". You haven't protected anyone. Video games are a stupid thing to immolate computing freedom for.

Re: Kernel anti-cheat is an overreach

#55

Post by iscoelho »

jjmarr wrote: post #42
ButlerianJihad wrote: post #31

Earlier quoted context omitted.

> The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.

You can buy an autoclicking device or software that recognizes screen pixels of enemy avatars and instantly clicks to kill them. This works in "remote streaming" situations and is ~30% of the cheating dataset detected by Riot's kernel level anticheat: https://www.riotgames.com/en/news/vanguard-on-demand > A “pixelbot” is a computer vision cheat that injects player input for the purposes of aiming at heads or casting…

This isn't possible in Valorant. Their kernel module is extremely particular about input devices:

1) only allows a single mouse input device at a time

2) completely ignores virtual mouse input

3) flags "special"/"uncommon" input devices

Their anti-cheat is actually much more involved and effective than most would assume.

Re: Kernel anti-cheat is an overreach

#56

Post by pona-a »

jjmarr wrote: post #42
ButlerianJihad wrote: post #31

Earlier quoted context omitted.

> The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.

You can buy an autoclicking device or software that recognizes screen pixels of enemy avatars and instantly clicks to kill them. This works in "remote streaming" situations and is ~30% of the cheating dataset detected by Riot's kernel level anticheat: https://www.riotgames.com/en/news/vanguard-on-demand > A “pixelbot” is a computer vision cheat that injects player input for the purposes of aiming at heads or casting…

But really, if HID becomes suspect too, then why do you even need kernel level anti-cheat, if all you can do is behavioral detection?

Re: Kernel anti-cheat is an overreach

#57

Post by iscoelho »

Akronymus wrote: post #36
sushid wrote: post #33

Earlier quoted context omitted.

Have you played games with a ton of cheaters? It's infuriating, and I'm glad that kernel-level anti-cheat makes it such that you can have an enjoyable gaming experience. Now, I no longer play competitive shooters due to my age, but this was a huge issue back in the day.

On private/community hosted/moderated servers my experience was that cheating was mostly a non-issue. Only with the advent of forced matchmaking/only official servers and such has it become a real problem.

That's a different type of game entirely. Private/community servers cannot be competitive at the scale of modern competitive games.

Re: Kernel anti-cheat is an overreach

#58

Post by iscoelho »

In my opinion, the debate about kernel anti-cheat on Windows is disingenuous fear-mongering. I'm confused why Hacker News of all places misrepresents the technical details.

You can already completely compromise the average user's privacy with an underprivileged process (nearly all of your personal information is accessible with zero privileges!), and you can already persist with administrator privileges (that is routinely given on Windows).

In regard to the "RCE attacker risk", attackers can RCE to escalate just as easily into vulnerable Windows services (there's too many to count). Kernel drivers aren't that special.

In regard to the "CrowdStrike risk", that's not privacy related and is extremely overblown.

What exactly does a kernel driver change regarding privacy? Nothing I can think of.

It's this simple: If games want your personal data, they don't need a kernel driver to get it.

Re: Kernel anti-cheat is an overreach

#59

Post by ChocolateGod »

pona-a wrote: post #56
jjmarr wrote: post #42

Earlier quoted context omitted.

You can buy an autoclicking device or software that recognizes screen pixels of enemy avatars and instantly clicks to kill them. This works in "remote streaming" situations and is ~30% of the cheating dataset detected by Riot's kernel level anticheat: https://www.riotgames.com/en/news/vanguard-on-demand > A “pixelbot” is a computer vision cheat that injects player input for the purposes of aiming at heads or casting…

But really, if HID becomes suspect too, then why do you even need kernel level anti-cheat, if all you can do is behavioral detection?

If you're in the kernel you at least have raw access to the USB controller and input events, thus can try pick out real mouses from fake ones.

Re: Kernel anti-cheat is an overreach

#60

Post by Hikikomori »

ButlerianJihad wrote: post #31
glitchc wrote: post #27

Earlier quoted context omitted.

Almost all trainers from time immemorial operate in the kernel space because they require direct access to memory addresses. The whole cheats paradigm started with altering values stored at specific addresses. Alter the right value and the player character gets infinite ammo or lives or whatnot, and it went from there. Modern day cheats embed more sophisticated logic that ultimately boils down to altering locations i…

> The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.

Aimbot will always be possible, it only uses what you see. ESP/wallhack can be somewhat curbed and has already been done in cs and valorant, but it really only works well with small player count and simple geometry maps. Stadia is dead, but it and geforce now had way too much delay to be enjoyable for competitive games where anti cheats are needed.
Post reply on HN