Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why anti-cheat software utilizes kernel drivers (2020)

secret.club

Post reply on HN
Print view View original

31–40 of 68 posts

Re: Why anti-cheat software utilizes kernel drivers (2020)

#31

Post by valval »

jsheard wrote: post #11
mdean wrote: post #9

I think this post is addressing some of the weaker security arguments against putting anti-cheat software in the kernel. The issue isn't that such software provides no value (obviously it does if developers continue writing anti-cheat kernel drivers despite the backlash). The issue is that software running in the kernel can unintentionally enable vulnerabilities that would be impossible if the software was running in…

> The issue is that software running in the kernel can unintentionally enable vulnerabilities You're not wrong, but there is some strong irony there regarding Vanguard. When it first launched its driver would block certain other drivers from loading, because those other drivers had known vulnerabilities that cheats (or anything else) could use to escalate from usermode to kernelmode without touching any of the standa…

Who would you say should have more control over your computer: 1. The operating system provider 2. A video game company

Re: Why anti-cheat software utilizes kernel drivers (2020)

#32

Post by Qwertious »

account199494 wrote: post #2

The problem with anti cheat is that is doesn't even work. Play any game with anti cheat and you will still be flooded by hackers.

Working isn't binary. Anticheat definitely catches some cheaters. It definitely misses some cheaters too.p

The worst case scenario is the TF2 catbot scenario, which anticheat seems to stop.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#35

Post by mjard »

valval wrote: post #31
jsheard wrote: post #11

Earlier quoted context omitted.

> The issue is that software running in the kernel can unintentionally enable vulnerabilities You're not wrong, but there is some strong irony there regarding Vanguard. When it first launched its driver would block certain other drivers from loading, because those other drivers had known vulnerabilities that cheats (or anything else) could use to escalate from usermode to kernelmode without touching any of the standa…

Who would you say should have more control over your computer: 1. The operating system provider 2. A video game company

3. Me, and only me.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#36

Post by gruez »

lomase wrote: post #28
Hikikomori wrote: post #21

Earlier quoted context omitted.

Point is that it doesn't need ring 0 access to to bad stuff.

Ring 3 and Ring 0 can try to do the same bad stuff. But the point is that in one the OS security layers or antivirus will catch it.

>But the point is that in one the OS security layers or antivirus will catch it.

Doesn't antivirus have detections for ring0 as well? Otherwise virus makers can just code their viruses to be in drivers and evade all the antiviruses.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#37

Post by gruez »

ndriscoll wrote: post #24
Hikikomori wrote: post #5

Earlier quoted context omitted.

>Vanguard runs on Ring 0. -> Ring 3 software can also read your hdd so is not a problem. Can also read process memory of the same user.

Can't read files or access memory of other users though, which is kind of the point. It's trivially easy to run games as a different user than the one you use for e.g. banking, and operating systems have had fast user switching for decades.

Most games require admin privileges to install, so if the game maker wants to be evil you're already screwed even if you have separate users. Moreover, most software isn't really designed for multi-user system security (because it's basically never used), so there's often sloppy coding practices that lead to trivial EoP between users (eg. cache directories accessible by all users).

Re: Why anti-cheat software utilizes kernel drivers (2020)

#38

Post by lomase »

Hikikomori wrote: post #14
Muromec wrote: post #6

Earlier quoted context omitted.

If the hack has to be in kernel, it will be in kernel, so what's the point anyway.

Doing something to protect the integrity of the competitive game they have? Compared to others Riot is somewhat successful at least. There are plenty of games that do not require anti cheat but they aren't going to be the type that uses skill based matchmaking.

Dota and CS don't have kernel anticheat and they are as competitive as LoL or Valorant.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#39

Post by gruez »

tapoxi wrote: post #17
mdean wrote: post #9

I think this post is addressing some of the weaker security arguments against putting anti-cheat software in the kernel. The issue isn't that such software provides no value (obviously it does if developers continue writing anti-cheat kernel drivers despite the backlash). The issue is that software running in the kernel can unintentionally enable vulnerabilities that would be impossible if the software was running in…

This is the main issue I have with these. Microsoft should be providing this at the platform level, give developers "Xbox Anti-Cheat" and ship it with Windows.

No good deed goes unpunished. In the current regulatory environment, that seems like a good way to attract attention from regulators for anti-trust violations.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#40

Post by gruez »

dgfitz wrote: post #13
haunter wrote: post #12

HN has a lot of very clever people. Solving online game cheating is a billion dollar business.

My first thought there would be to just build up randomness entropy on game launch, and when mouse movements/keyboard events break that, detected. I assume I’m missing something.

???

how does that defeat cheats?

Post reply on HN