Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why anti-cheat software utilizes kernel drivers (2020)

secret.club

Post reply on HN
Print view View original

11–20 of 68 posts

Re: Why anti-cheat software utilizes kernel drivers (2020)

#11

Post by jsheard »

mdean wrote: post #9

I think this post is addressing some of the weaker security arguments against putting anti-cheat software in the kernel. The issue isn't that such software provides no value (obviously it does if developers continue writing anti-cheat kernel drivers despite the backlash). The issue is that software running in the kernel can unintentionally enable vulnerabilities that would be impossible if the software was running in…

> The issue is that software running in the kernel can unintentionally enable vulnerabilities

You're not wrong, but there is some strong irony there regarding Vanguard. When it first launched its driver would block certain other drivers from loading, because those other drivers had known vulnerabilities that cheats (or anything else) could use to escalate from usermode to kernelmode without touching any of the standard entrypoints that are monitored by anticheats.

Would you be surprised to learn that the main response was for gamers to get angry at Vanguard for breaking their RGB keyboard driver, rather than get angry at the manufacturer of their RGB keyboard for shipping a buggy driver with critical security vulnerabilities? And Microsoft ended up adding a very similar driver blacklist to Windows itself later, because it's a good idea.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#13

Post by dgfitz »

haunter wrote: post #12

HN has a lot of very clever people. Solving online game cheating is a billion dollar business.

My first thought there would be to just build up randomness entropy on game launch, and when mouse movements/keyboard events break that, detected. I assume I’m missing something.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#14

Post by Hikikomori »

Muromec wrote: post #6
Hikikomori wrote: post #4

Earlier quoted context omitted.

It does stop some classes of hacks, ups the effort considerably as you hack needs to be in kernel or with hardware. But its pretty much impossible to stop on x86/windows PCs.

If the hack has to be in kernel, it will be in kernel, so what's the point anyway.

Doing something to protect the integrity of the competitive game they have? Compared to others Riot is somewhat successful at least.

There are plenty of games that do not require anti cheat but they aren't going to be the type that uses skill based matchmaking.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#15

Post by Hikikomori »

lomase wrote: post #8
Hikikomori wrote: post #4

Earlier quoted context omitted.

It does stop some classes of hacks, ups the effort considerably as you hack needs to be in kernel or with hardware. But its pretty much impossible to stop on x86/windows PCs.

People pay for cheats. Companies are built arround cheat making. That now you need hardware to cheat is a bussines oportunity for some.

Yep, even up to hundreds of dollars a month.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#16

Post by serf »

account199494 wrote: post #2

The problem with anti cheat is that is doesn't even work. Play any game with anti cheat and you will still be flooded by hackers.

all it really does in practice is produce a market for paid cheats.

if it's a pain in the ass to stay ahead of the anti-cheats, then people with the skills to do so will expect (and receive) payment from those wishing to cheat.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#17

Post by tapoxi »

mdean wrote: post #9

I think this post is addressing some of the weaker security arguments against putting anti-cheat software in the kernel. The issue isn't that such software provides no value (obviously it does if developers continue writing anti-cheat kernel drivers despite the backlash). The issue is that software running in the kernel can unintentionally enable vulnerabilities that would be impossible if the software was running in…

This is the main issue I have with these. Microsoft should be providing this at the platform level, give developers "Xbox Anti-Cheat" and ship it with Windows.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#19

Post by AshamedCaptain »

lomase wrote: post #3

Vanguard runs on Ring 0. -> Ring 3 software can also read your hdd so is not a problem. Why load on boot? -> Because we need to, don't worry. Why is scanning my serial port -> Is a bug, don't worry is not a problem. What if Riot is hacked? -> If Microsoft gets hacked is even worse, so is not a problem.

The same style of argument used by ChatControl proponents. I mean, what's another backdoor going to do in the swiss cheese that is Whatsapp/$INSERT_IM_PLATFORM_HERE security ?

Re: Why anti-cheat software utilizes kernel drivers (2020)

#20

Post by Hikikomori »

tapoxi wrote: post #17
mdean wrote: post #9

I think this post is addressing some of the weaker security arguments against putting anti-cheat software in the kernel. The issue isn't that such software provides no value (obviously it does if developers continue writing anti-cheat kernel drivers despite the backlash). The issue is that software running in the kernel can unintentionally enable vulnerabilities that would be impossible if the software was running in…

This is the main issue I have with these. Microsoft should be providing this at the platform level, give developers "Xbox Anti-Cheat" and ship it with Windows.

How much of Xbox anti cheat is "can only run signed code"? Might not be compatible with regular PC use but maybe if we had a gaming mode we could boot into.
Post reply on HN