Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kernel anti-cheat is an overreach

nooneshappy.com

Post reply on HN
Print view View original

71–80 of 119 posts

Re: Kernel anti-cheat is an overreach

#71

Post by slumberlust »

iscoelho wrote: post #57
Akronymus wrote: post #36

Earlier quoted context omitted.

On private/community hosted/moderated servers my experience was that cheating was mostly a non-issue. Only with the advent of forced matchmaking/only official servers and such has it become a real problem.

That's a different type of game entirely. Private/community servers cannot be competitive at the scale of modern competitive games.

Why? I have a hard time imagining anyone would care more about the integrity of the game than the community. Private servers are an IP play, allowing companies to pull the plug completely when it is convenient for them.

Re: Kernel anti-cheat is an overreach

#72

Post by Reubachi »

iscoelho wrote: post #68
ChocolateGod wrote: post #61

Earlier quoted context omitted.

> In my opinion, the debate about kernel anti-cheat on Windows is fear-mongering I don't think a lot of people who complain about kernel anti-cheat actually play competitive games.

I feel someone doesn't need to play competitive games to be able to give an honest assessment of the privacy & security risks. I'm sad I'm not seeing that honesty elsewhere in this thread.

It certainly is helpful to understand the mindset of a person who: a.) their hobby is to play competitive games which mandate kernel level (or similar intrusive anti-cheat)

b.) either accepts the requirements or builds sufficient security gapping to make it a nonconsideration.

These people exist, and would say in an honest assesmment that the above behavior is no more rights-intrusive than what 99 percent of the tech absorbing population allow today.

Re: Kernel anti-cheat is an overreach

#73

Post by km144 »

> So I would rather share a match with the occasional cheater than run un-auditable ring-0 software on the same machine I use for anything private.

The article makes an argument that anti-cheat is not worth the trade-off, yet the author admits they are a non-gamer. Then they go on to present one example of anti-cheat that tells us all we need to know about actual gamers' preferences—FACEIT. For those who don't know, FACEIT is a third-party matchmaking service, primarily for CS2. People choose to go through the hoops of using third-party service that installs kernel-level anti-cheat on their computer because it helps to keep cheaters out of their games. This seems like pretty strong evidence that the author's argument is not a good representation of gamers' thoughts on this. I don't know what the actual solution is. I suspect if Valve made their own kernel-level anti-cheat people might trust it more, but it's still the same problem.

Re: Kernel anti-cheat is an overreach

#74

Post by pona-a »

ChocolateGod wrote: post #59
pona-a wrote: post #56

Earlier quoted context omitted.

But really, if HID becomes suspect too, then why do you even need kernel level anti-cheat, if all you can do is behavioral detection?

If you're in the kernel you at least have raw access to the USB controller and input events, thus can try pick out real mouses from fake ones.

If the point of those events is to be registered by the game program, you already have all the data you need, otherwise you're building a keylogger.

The most the kernel can try to tell you is what's plugged in, but the cheater can easily make the fake HID interposed between the real keyboard and USB.

Re: Kernel anti-cheat is an overreach

#76

Post by vel0city »

slumberlust wrote: post #71
iscoelho wrote: post #57

Earlier quoted context omitted.

That's a different type of game entirely. Private/community servers cannot be competitive at the scale of modern competitive games.

Why? I have a hard time imagining anyone would care more about the integrity of the game than the community. Private servers are an IP play, allowing companies to pull the plug completely when it is convenient for them.

Say you've got a game that's specifically designed for 5v5 play. In this game, things become imbalanced and overly chaotic when there's more than that many players, the main game mechanics start to fall apart.

So now let's say you only have private servers. A bunch of 10-seat servers, and each match takes ~30-40 minutes. How does this work in practice? You have servers with like 8 or 9 players sitting around waiting, hoping for someone to join. How long will they sit there waiting? We potentially have hundreds of these partially filled servers waiting for other players to join. Wouldn't it be nice if there was some system that would automatically send people towards your nearly full server? Some kind of...matchmaking system?

How do we ensure somewhat even levels of skill among those players? Some kind of system that tracked past performance against players of other skill levels and could help you find other players around your skill level? Some kind of service to help you find matches, like some kind of...matchmaking service?

Not all games need matchmaking services, I agree. A lot of games do benefit considerably from having matchmaking services.

Re: Kernel anti-cheat is an overreach

#77

Post by Hikikomori »

iscoelho wrote: post #58

In my opinion, the debate about kernel anti-cheat on Windows is disingenuous fear-mongering. I'm confused why Hacker News of all places misrepresents the technical details. You can already completely compromise the average user's privacy with an underprivileged process (nearly all of your personal information is accessible with zero privileges!), and you can already persist with administrator privileges (that is rout…

>You can already completely compromise the average user's privacy with an underprivileged process (nearly all of your personal information is accessible with zero privileges!), and you can already persist with administrator privileges (that is routinely given on Windows).

Most complaints about kernel level are indeed about privacy, and as you say a user space process can already do so much that this argument is moot. Most people are not aware or ignore it to fear monger because anything kernel sounds really bad.

Re: Kernel anti-cheat is an overreach

#78

Post by myrmidon »

iscoelho wrote: post #70
Hikikomori wrote: post #60

Earlier quoted context omitted.

Aimbot will always be possible, it only uses what you see. ESP/wallhack can be somewhat curbed and has already been done in cs and valorant, but it really only works well with small player count and simple geometry maps. Stadia is dead, but it and geforce now had way too much delay to be enjoyable for competitive games where anti cheats are needed.

Aimbot is actually very solvable! 1) When DMA is fully blocked, Aimbot resorts to being a pixel bot. 2) Once you're relying on a pixel bot, all the anti-cheat has to do is "bait" the bot. After you click the bait a few times, you're banned. (: RuneScape is actually the pioneer of this technique.

Baiting alone is not a reliable long-term solution, because it both interferes with competitive games (a lot) and because it requires you to basically stay on top of a captcha escalation (especially once cheaters limit themselves to "realistic" reaction time constraints), and this is a bad position to be in (because it means continuous effort for the developer).

The most helpful approach in my view is to make fresh accounts expensive for cheaters so they can't iterate easily; if the game developer can extract profit from such ban circumvention attempts then all the better.

Re: Kernel anti-cheat is an overreach

#79

Post by myrmidon »

throwing_away wrote: post #45
sgjohnson wrote: post #25

I’m actually surprised how a lot of commenters here are defending kernel-level anticheat.

Same. I write cheats for CS2 for my own amusement and it's 100% detectable by replay analysis. If I'm reacting to information that I shouldn't have at a rate much much greater than the general population, then I'm not psychic, I'm just cheating. This is also true for aiming, spray control, etc. All current cs2 cheaters are producing a very large and detectable audit trail of very suspicious plays in game, even if the…

Heuristic detection is iffy IMO, because while this might look trivial now (=> before cheaters optimize for it) false positives could easily ruin the user experience after a few rounds of cat & mouse: Even if you manage to keep sensitivity high (detecting >90% of cheaters), if you have like single digit percentages of cheaters and false positives, a lot of your bans are innocent.

If you keep the heuristics "tolerant", on the other had, you end up perpetually chasing in a cat-and-mouse game, and a lot of cheaters go undetected inbetween detection upgrades.

I feel heuristic detection is a "metagame" that developers don't really want to engage in, because you basically can't really win and it's perpetual work/spending.

Re: Kernel anti-cheat is an overreach

#80

Post by giov4 »

Hikikomori wrote: post #67
n3rv wrote: post #66

Letting RIOT into your ring ZERO is not a risk I'm willing to take. It just sits nagging in the back of your mind. So why take the risk.

Are you playing games on a different user? If not a user space program can already access all your files and memory of running processes.

yama? ptrace scope? namespaces? selinux? apparmor?

of course depends also on system defaults, but then why I cannot dump ssh-agent process from same user?

oh maybe that's also the reason why the move to the kernel level in general? or that's not necessary with different privileges and they could stay on user space without taking over kernel? (insert here philosoraptor meme pls)

again having low leve drivers from external corps that could ready anything anytime from my system and exfiltrate without me even knowing is even more scary than running a recent microsoft os! and should be avoided if possible!

Post reply on HN