Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message About Vanguard From Our Security and Privacy Teams

riotgames.com

Post reply on HN
Print view View original

31–40 of 103 posts

Re: A Message About Vanguard From Our Security and Privacy Teams

#31

Post by LeifCarrotson »

devit wrote: post #26
smoyer wrote: post #3

Explaining your rationale doesn't change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you're running a dedicated PC for gaming, I wouldn't install this software. As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected ter…

All software that you install on the main desktop operating systems is given the "keys to their computer kingdom": there is no privilege separation or sandboxing, except for the "user vs root" division, which can be trivially bypassed in countless ways (and anyway, most installers require root privileges). And yes, obviously you need to have a dedicated gaming PC and certainly not install any games or any software th…

The user vs root division does not need to be bypassed for a game. Riot does bypass it with their kernel-mode driver for the anti-cheat mechanism.

Re: A Message About Vanguard From Our Security and Privacy Teams

#32

Post by [deleted] »

ds wrote: post #18
_kxbd wrote: post #11

Earlier quoted context omitted.

The future of anti-cheat is machine learning specific to the game. CS:GO already does this, where it used the Overwatch community review program to train it, and it can now automatically ban some cheaters. I don't think it's a viable model because players are willing to do it for free, as CS:GO's Overwatch shows.

Valve also put a significant amount of work into this system. Asking every game developer to build that system for their game seems like alot to ask- Especially when they can just drop in a few lines of code // third party software package and have cheating 'handled'. 'Not invented here' is a blessing and a curse.

[deleted]

Re: A Message About Vanguard From Our Security and Privacy Teams

#33

Post by swiley »

League of legends is a real pain in the ass to play even when you’re doing everything right. Personally I don’t even like the game, it’s just popular so I played it to hang out with friends. The way their launcher handles updates is crazy inefficient and so it always takes hours to launch if it launches at all. It also runs terribly in wine.

Re: A Message About Vanguard From Our Security and Privacy Teams

#34

Post by ds »

Kaveren wrote: post #27
ds wrote: post #18

Earlier quoted context omitted.

Valve also put a significant amount of work into this system. Asking every game developer to build that system for their game seems like alot to ask- Especially when they can just drop in a few lines of code // third party software package and have cheating 'handled'. 'Not invented here' is a blessing and a curse.

Public relations for a startup like this would be hard to manage. I can already see the front page Reddit post with 4,000 upvotes on the game's subreddit asking why they lost $400 worth of items because one of the outsourced employees being paid $3/hour illegitimately banned them. Easy target to blame a company like this. Cheater effort and quantity scales roughly with game revenue and popularity. So the first tier o…

To be fair, this happens regardless, every day. Nobody believes anyone suspected of cheating, ever. And I mean ever. Just go look at the steam forums and the thousands of "i was falsely banned posts". If what you are saying was true, we would have seen this already happen for steam on reddit every day, which it doesnt.

Also, thats not to say you cant have a second and third tier of support to escalate your case to if you think you were wrongly banned, which wouldnt go to the grunts.

Re: A Message About Vanguard From Our Security and Privacy Teams

#35

Post by Sholmesy »

fendy3002 wrote: post #20
dharmab wrote: post #17

Earlier quoted context omitted.

My next gaming PC will run a Linux hypervisors and use PCI passthru to run Windows as a full-performance guest. Then if I need to use a web browser, I can switch to a Linux guest without interrupting the game.

I wanna try this but PCI pass through seems hard. And with KVM win7 guest, I get too many cert invalid error during accessing https, which is annoying.

I've done it all.

It's a hassle, mostly because you need to disable the GPU from the linux host; before passing through; which means you need a second GPU to power the linux host (integrated GPU is fine).

Then there's a bunch of config regarding IOMMU groups and other shit to make sure it picks it up fine, and when it finally does you get 90-95% of the performance for average FPS and then 60-70% min-fps (spikes are way worse).

Re: A Message About Vanguard From Our Security and Privacy Teams

#36

Post by smoyer »

devit wrote: post #26
smoyer wrote: post #3

Explaining your rationale doesn't change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you're running a dedicated PC for gaming, I wouldn't install this software. As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected ter…

All software that you install on the main desktop operating systems is given the "keys to their computer kingdom": there is no privilege separation or sandboxing, except for the "user vs root" division, which can be trivially bypassed in countless ways (and anyway, most installers require root privileges). And yes, obviously you need to have a dedicated gaming PC and certainly not install any games or any software th…

To some degree that's true. I keep an eye out for programs that insist on running as root. And if someone breaches my account, they've still got to put the work in to escalate their privilege through one of these programs.

I've also been installing more and more software into ~/bin rather than the more traditional /opt and /usr/local/bin. I think that the trend towards usermode software will take over in the next five years.

Re: A Message About Vanguard From Our Security and Privacy Teams

#38

Post by ruialmeida »

lol768 wrote: post #10
ds wrote: post #7

The inherent issue with anti cheats as compared to anti-virus software is user intention. A user who installs a anti virus program wants that program to do its job and find bad actors. The virus on the other hand is completely unwanted by both the user and the software- Its existence is threatened by all fronts. However, a anti-cheat lives in a extremely adversarial environment. The cheater (and the cheat) wants the…

> Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform. > It involved a second computer, which man-in-the-middled all network data to the client computer. Out of interest, was there no transport level encryption to deal with here? Or did you need to do something special to capture keys on the client?

In order for your game to render other players you have to know their position, so the game server has to send them to all players.

As an example, for CSGO in the past, the server always sent all player positions from anywhere, so it was possible to create cheats to draw players anywhere in the map. They changed the way it's done, coordinates are only sent when other players are nearly visible, although distant, or close by. This limited the way that wallhacks work, it's not possible to see where players are from far away :)

What needs to be done is reverse engineer the communication protocol. If encryption is made, some kind of key to decrypt has to be somewhere in your game client. Then you can convert 3D coordinates to 2D and even draw a radar on your smartphone if you make an app.

Re: A Message About Vanguard From Our Security and Privacy Teams

#39

Post by judge2020 »

ds wrote: post #34
Kaveren wrote: post #27

Earlier quoted context omitted.

Public relations for a startup like this would be hard to manage. I can already see the front page Reddit post with 4,000 upvotes on the game's subreddit asking why they lost $400 worth of items because one of the outsourced employees being paid $3/hour illegitimately banned them. Easy target to blame a company like this. Cheater effort and quantity scales roughly with game revenue and popularity. So the first tier o…

To be fair, this happens regardless, every day. Nobody believes anyone suspected of cheating, ever. And I mean ever. Just go look at the steam forums and the thousands of "i was falsely banned posts". If what you are saying was true, we would have seen this already happen for steam on reddit every day, which it doesnt. Also, thats not to say you cant have a second and third tier of support to escalate your case to if…

How do you know if someone is lying on a virtual forum? All of the cheaters that got rightfully banned have just as much reason to write the same forum posts as those who were wrongly banned. That combined with the fact that the large majority of people (probably >99%) who don't cheat never get wrongfully VAC banned makes it hard to believe that the system made a mistake.

Re: A Message About Vanguard From Our Security and Privacy Teams

#40

Post by jackewiehose »

LeifCarrotson wrote: post #31
devit wrote: post #26

Earlier quoted context omitted.

All software that you install on the main desktop operating systems is given the "keys to their computer kingdom": there is no privilege separation or sandboxing, except for the "user vs root" division, which can be trivially bypassed in countless ways (and anyway, most installers require root privileges). And yes, obviously you need to have a dedicated gaming PC and certainly not install any games or any software th…

The user vs root division does not need to be bypassed for a game. Riot does bypass it with their kernel-mode driver for the anti-cheat mechanism.

As parent comment noticed there is no need to bypass anything. Just ask the user for root permissions like any other installer and the user will accept.
Post reply on HN