Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kernel anti-cheat is an overreach

nooneshappy.com

Post reply on HN
Print view View original

61–70 of 119 posts

Re: Kernel anti-cheat is an overreach

#61

Post by ChocolateGod »

iscoelho wrote: post #58

In my opinion, the debate about kernel anti-cheat on Windows is disingenuous fear-mongering. I'm confused why Hacker News of all places misrepresents the technical details. You can already completely compromise the average user's privacy with an underprivileged process (nearly all of your personal information is accessible with zero privileges!), and you can already persist with administrator privileges (that is rout…

> In my opinion, the debate about kernel anti-cheat on Windows is fear-mongering

I don't think a lot of people who complain about kernel anti-cheat actually play competitive games.

Re: Kernel anti-cheat is an overreach

#62

Post by Hikikomori »

iscoelho wrote: post #55
jjmarr wrote: post #42

Earlier quoted context omitted.

You can buy an autoclicking device or software that recognizes screen pixels of enemy avatars and instantly clicks to kill them. This works in "remote streaming" situations and is ~30% of the cheating dataset detected by Riot's kernel level anticheat: https://www.riotgames.com/en/news/vanguard-on-demand > A “pixelbot” is a computer vision cheat that injects player input for the purposes of aiming at heads or casting…

This isn't possible in Valorant. Their kernel module is extremely particular about input devices: 1) only allows a single mouse input device at a time 2) completely ignores virtual mouse input 3) flags "special"/"uncommon" input devices Their anti-cheat is actually much more involved and effective than most would assume.

Websites that sell DMA devices also sell devices that merge mouse usb and hdmi signals that allows you to run the cheat on another machine and let it display en ESP overlay and do aimbot. It's likely that a naive implementation of such an usb device would be detected. But can you create such a device that uses a normal mouse usb driver and looks like a normal mouse?

Re: Kernel anti-cheat is an overreach

#64

Post by Hikikomori »

throwing_away wrote: post #45
sgjohnson wrote: post #25

I’m actually surprised how a lot of commenters here are defending kernel-level anticheat.

Same. I write cheats for CS2 for my own amusement and it's 100% detectable by replay analysis. If I'm reacting to information that I shouldn't have at a rate much much greater than the general population, then I'm not psychic, I'm just cheating. This is also true for aiming, spray control, etc. All current cs2 cheaters are producing a very large and detectable audit trail of very suspicious plays in game, even if the…

Valve has already discussed using ai? There's also some commercial alternatives. I haven't seen that it works well yet, so it doesn't seem easy to solve.

But it seems that will just push cheat devs to adjust their aimbot to become more human in behavior? For the average gamer the top 0.1% will look like cheaters anyway.

Re: Kernel anti-cheat is an overreach

#65

Post by iscoelho »

Hikikomori wrote: post #62
iscoelho wrote: post #55

Earlier quoted context omitted.

This isn't possible in Valorant. Their kernel module is extremely particular about input devices: 1) only allows a single mouse input device at a time 2) completely ignores virtual mouse input 3) flags "special"/"uncommon" input devices Their anti-cheat is actually much more involved and effective than most would assume.

Websites that sell DMA devices also sell devices that merge mouse usb and hdmi signals that allows you to run the cheat on another machine and let it display en ESP overlay and do aimbot. It's likely that a naive implementation of such an usb device would be detected. But can you create such a device that uses a normal mouse usb driver and looks like a normal mouse?

At least in Valorant, DMA is becoming impossible due to IOMMU / Memory Integrity enforcement. The only option is becoming pixel bots.

As for faking the input device: I'm sure it's possible, but I'm also sure that perfectly spoofing an input device is much easier said than done.

Even if it is possible, all they have to do is make it hard enough to where the percentage of players cheating is at the point where you will rarely if ever encounter a cheater in your matches. As far as I'm aware, Valorant is one of the only games that has accomplished that.

Re: Kernel anti-cheat is an overreach

#67

Post by Hikikomori »

n3rv wrote: post #66

Letting RIOT into your ring ZERO is not a risk I'm willing to take. It just sits nagging in the back of your mind. So why take the risk.

Are you playing games on a different user? If not a user space program can already access all your files and memory of running processes.

Re: Kernel anti-cheat is an overreach

#68

Post by iscoelho »

ChocolateGod wrote: post #61
iscoelho wrote: post #58

In my opinion, the debate about kernel anti-cheat on Windows is disingenuous fear-mongering. I'm confused why Hacker News of all places misrepresents the technical details. You can already completely compromise the average user's privacy with an underprivileged process (nearly all of your personal information is accessible with zero privileges!), and you can already persist with administrator privileges (that is rout…

> In my opinion, the debate about kernel anti-cheat on Windows is fear-mongering I don't think a lot of people who complain about kernel anti-cheat actually play competitive games.

I feel someone doesn't need to play competitive games to be able to give an honest assessment of the privacy & security risks.

I'm sad I'm not seeing that honesty elsewhere in this thread.

Re: Kernel anti-cheat is an overreach

#69

Post by iscoelho »

wronex wrote: post #50

I play a lot. Competitive shooters mostly. Most of them are unplayable for one or two reasons. Cross play (controllers with aim assist) and cheaters. As a PC player I would like to see no aim assist and actual consequences for cheating. I’ll gladly verify my real world identity, if it meant cheaters where banned once and forever. I’ve heard this is how it works in Korea (claim not verified) and could see it work here…

> "How come replay analysis doesn’t catch more cheaters?"

1) There's too many players.

2) Closet cheaters are extremely subjective: automated & manual moderation would be full of false positives. In these cases, functional anti-cheats actually serve to vindicate these players.

Re: Kernel anti-cheat is an overreach

#70

Post by iscoelho »

Hikikomori wrote: post #60
ButlerianJihad wrote: post #31

Earlier quoted context omitted.

> The whole cheats paradigm You are limited in envisioning a game where the client device is being trusted for ground truth about the game. In client-server models, it is possible to limit trust such that many cheat modes and methods are impossible. Furthermore is the “remote GPU streaming” model like Stadia, which nearly obsoletes conventional techno-cheating, and likewise obsoletes kernel-mode anti-cheat.

Aimbot will always be possible, it only uses what you see. ESP/wallhack can be somewhat curbed and has already been done in cs and valorant, but it really only works well with small player count and simple geometry maps. Stadia is dead, but it and geforce now had way too much delay to be enjoyable for competitive games where anti cheats are needed.

Aimbot is actually very solvable!

1) When DMA is fully blocked, Aimbot resorts to being a pixel bot.

2) Once you're relying on a pixel bot, all the anti-cheat has to do is "bait" the bot. After you click the bait a few times, you're banned. (:

RuneScape is actually the pioneer of this technique.

Post reply on HN