Call of Duty Adds Kernel Level Driver for Anti-Cheat • Hacker News Board

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#101

Post by krono » Wed, Oct 13, 2021, 7:23 PM UTC

maccard wrote: post #97

krono wrote: post #81

Earlier quoted context omitted.

EA and Rockstar banned people from Battlefield 5 multiplayer and GTA online for having modded their single player games. Google for a few minutes and you'll come across plenty of horror stories and news items. But of course the real reason they would love to prevent anyone from tampering with the game is so they can sell more single player cheats such as experience booster packs.

They do? I googled it and it's full of "I accidentally left my mods on and connected to GTAO and got banned", not " I was banned for playing modded single player games"

Yeah, listed some random hits for you below.

I don't personally play either game, but from what I've come across on the subject over the years, publishers seem to be a lot less difficult about it today compared to a few years ago. I recall reading about them denying a ban was due to mod use when they were wrong, being ridiculously vague about what modding was and what wasn't allowed, refusing to fully restore a player's character even after a ban was rescinded, etc.

https://www.pcgamer.com/gta-online-players-report-multiple-u...

https://www.reddit.com/r/pcgaming/comments/g139nu/eas_volunt...

Interesting edge case: https://www.pcgamer.com/gtav-modders-reportedly-banned-for-c...

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#102

Post by gambiting » Wed, Oct 13, 2021, 7:28 PM UTC

VortexDream wrote: post #89

gambiting wrote: post #36

Earlier quoted context omitted.

Rampant cheating in online FPS games is a problem right now . I've had more games ruined by cheaters than I can count. So how about yes, let's focus on fixing the problem at hand, and if it's used for something else(like single player games) then I'll complain about it. Right now developers have my full support to use whatever methods they can to make sure the hackers stay out. The game can boot into its own OS for a…

By the time it becomes a problem, it'll be too late to reverse. You think publishers will willingly give up the ability lock down their games on PCs? It's been their dream for decades. I'd rather not give up what we can do with the software we've paid for (and I don't care what some piece of crap ToS says I can or cannot do with the software), just so you get less cheaters in online games.

But that's really not a great place to use this argument - this isn't surveillance infrastructure or encryption backdoors where yes, once it's built a) it will be used for nefarious purposes b) it's really hard to get rid of. Game sandboxing is already very easy to achieve(at least on windows) and doesn't require any special software to be developed or deployed. It's all part of the Microsoft GDK and is already used - a recent game that is deployed like that is The Ascent, which deservedly got into a lot of shit over it, because the Gamepass version runs poorly compared to the non-sandboxed version on Steam. Likewise, other games that have done this suffer for it and publishers shy away from it, just how aggressive DRM gets a lot of pushback and publishers either don't include it or are forced to remove it post launch.

That's why I'm not really worried about this tech "spilling" to single player games to protect MTX or anything like that, but I'd really really really like to see it deployed as aggressively as physically possible in online competitive games.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#103

Post by b5n » Wed, Oct 13, 2021, 7:30 PM UTC

ProAm wrote: post #41

dcdc123 wrote: post #2

Huh...that seems a bit excessive.

It's really not given the state of how bad cheating is in CoD. This is sorely overdue and has been requested by the userbase for some time. While it is a pretty significant change, it's for the betterment of the user experience.

> for the betterment of the user experience.

Giving Activision kernel level access on a private device, what an improvement.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#104

Post by NtGuy25 » Wed, Oct 13, 2021, 7:33 PM UTC

MR4D wrote: post #19

Can anyone tell me why Fortnite doesn't seem to have as bad of a problem as CoD? My son plays both, but CoD really sucks. It is so obvious when someone is cheating.

Fortnite has a decent anticheat, which also runs in Kernel. The skills to evade a solely usermode monitor isn't that hard, since you can literally just watch api calls and defend against some memory forensics. This is made harder for the cheat dev due to things like Discord running dynamic code, which looks EXACTLY like shellcode/cheat payload. Especially in a world with limited customer support, and even more limited on anyone who can help, false bans are a big concern.

DKOM(reading/modifying kernel structures directly) is alot harder to detect, and also alot more undocumented. To the point it takes someone in the field to make a cheat and bypass, vs someone with a decent level of application dev experience. And there's not many Kernel developers, and there's also such a limited amount of forensic/malware analysts that can code anything beyond powershell.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#105

Post by anonymousab » Wed, Oct 13, 2021, 7:33 PM UTC

endtype wrote: post #50

viccuad wrote: post #32

Earlier quoted context omitted.

Easy: code your game correctly and check for impossibilities server-side. But that costs money in development and infra.

It's not the impossibilities I'm worried about. Those are easy to see and report. It's the slight corrections which look "natural" but are actually the work of cheats "assisting" players.

If the hackers are no longer rampantly ruining the game and rendering it effectively unplayable as someone instantly headshots everyone on sight; if the hackers or botters have become indistinguishable from other competent players, then... Well, excellent! Mission Accomplished. All you have remaining is a matchmaking problem, which they're already, separately trying to solve.

(As an aside, we already have games using built in assistance/cheats as an accessibility feature to level the playing field for people using certain hardware or controllers e.g. games with PC and console crossplay, so perhaps there's some approaches and lessons from that which we can apply here as well.)

The only thing at stake then is the integrity of leaderboards or tournament brackets, which is a problem that already had some different, separate approaches to solve. But IMO that a problem is absolutely subservient to the integrity and playability of the base game.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#106

Post by edave64 » Wed, Oct 13, 2021, 7:35 PM UTC

dcdc123 wrote: post #2

Huh...that seems a bit excessive.

It's the logical conclusion. The clients machine is inherently untrusted. So how do ensure integrity? Best you can do is try to get to try to get as few layers between you and the machine as possible.

It's essentially the same problem as DRM, which generelly can only hope to prevent piracy for a few weeks. The solution of the movie industry there was to add there garbage directly to the hardware.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#107

Post by munk-a » Wed, Oct 13, 2021, 7:57 PM UTC

maccard wrote: post #96

munk-a wrote: post #87

Earlier quoted context omitted.

I think, honestly, the biggest issue in terms of cheating right now is a lack of responsibility from the companies involved in actually reading and acting on reporting - some companies in particular (EA) are extremely lax in actually dealing with human reports and their games suffer greatly for it.

Dealing with human reports is hard. People will report good players for cheating. People will report bad players for cheating. People will brigade reports. There's also a sense of scale; last I heard cod warzone had 100 million players. If even a _mild_ portion of those players actively use report systems, it's not feasible to manually evaluate them (and is also prone to bias and social factors)

You're saying it's not feasible to manually evaluate reports - but really what you're saying is that nobody wants to pay for it. Set up a very modest subscription model (like 2$/mo) to fund report checking for your game, possibly with a free tier that starts with low trust, and nuke people by credit card number.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#108

Post by jti107 » Wed, Oct 13, 2021, 8:25 PM UTC

mauz wrote: post #21

Aside: are there any good tutorials that provide an overview on how to write such an anti-cheat?

riot had a good white paper on their valorant anticheat and why they designed it to be a kernel level anticheat

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#109

Post by endtype » Wed, Oct 13, 2021, 8:59 PM UTC

anonymousab wrote: post #105

endtype wrote: post #50

Earlier quoted context omitted.

It's not the impossibilities I'm worried about. Those are easy to see and report. It's the slight corrections which look "natural" but are actually the work of cheats "assisting" players.

If the hackers are no longer rampantly ruining the game and rendering it effectively unplayable as someone instantly headshots everyone on sight; if the hackers or botters have become indistinguishable from other competent players, then... Well, excellent! Mission Accomplished. All you have remaining is a matchmaking problem, which they're already, separately trying to solve. (As an aside, we already have games using…

"if the hackers or botters have become indistinguishable from other competent players, then... Well, excellent! Mission Accomplished"

"... that a problem is absolutely subservient to the integrity and playability of the base game."

If you use hacks/cheats to help you play higher than your natural skill/ability, doesn't that ruin the integrity of the game? The mission is not accomplished in this case. Instead it's just tricky to determine who's hacking.

Headshotting everyone on-sight also sounds like the old days of hacks in games. In my experience, there is more nuance to the way these cheats are used these days. Most people aren't trying to be obvious about it.

Re: Call of Duty Adds Kernel Level Driver for Anti-Cheat

#110

Post by atatatat » Wed, Oct 13, 2021, 10:07 PM UTC

gambiting wrote: post #36

VortexDream wrote: post #27

Earlier quoted context omitted.

How about no? This will just lead these companies to implement anti-cheat to protect the "integrity" of their single player games (and their MTX) as well. Say goodbye to mods and other forms of benign game hacking (particularly hacks that fix games like Dark Souls).

Rampant cheating in online FPS games is a problem right now . I've had more games ruined by cheaters than I can count. So how about yes, let's focus on fixing the problem at hand, and if it's used for something else(like single player games) then I'll complain about it. Right now developers have my full support to use whatever methods they can to make sure the hackers stay out. The game can boot into its own OS for a…

Play with only/mostly your friends...?

Don't ruin my ability to run graphics mods on GTA, ha