Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why anti-cheat software utilizes kernel drivers (2020)

secret.club

Post reply on HN
Print view View original

51–60 of 68 posts

Re: Why anti-cheat software utilizes kernel drivers (2020)

#51

Post by gruez »

ndriscoll wrote: post #42
gruez wrote: post #37

Earlier quoted context omitted.

Most games require admin privileges to install, so if the game maker wants to be evil you're already screwed even if you have separate users. Moreover, most software isn't really designed for multi-user system security (because it's basically never used), so there's often sloppy coding practices that lead to trivial EoP between users (eg. cache directories accessible by all users).

Maybe this is a difference with Windows vs. Linux and admittedly I basically never have time for games anymore, but I don't remember any game ever asking me for my root password to install or run. I'm also not sure what software you have in mind that doesn't work in a multi-user environment. I see plenty of usage of `~/.cache`, and `~` has 700 for permissions. Other services on my computer run as their own user. In a…

>but I don't remember any game ever asking me for my root password to install or run.

Are you sure there isn't some sort of setuid executable that's doing all the root stuff for you? At least in theory for something like steam, you'd want either all installs to require root, or restrict all installs to per-user basis.

>In any case, something being programmed poorly isn't a good excuse to make things even worse.

The point is that if multi-user security is broke in practice, you shouldn't invest effort into using it, and use something better like virtualization and/or dual booting with full disk encryption.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#52

Post by ndriscoll »

gruez wrote: post #51
ndriscoll wrote: post #42

Earlier quoted context omitted.

Maybe this is a difference with Windows vs. Linux and admittedly I basically never have time for games anymore, but I don't remember any game ever asking me for my root password to install or run. I'm also not sure what software you have in mind that doesn't work in a multi-user environment. I see plenty of usage of `~/.cache`, and `~` has 700 for permissions. Other services on my computer run as their own user. In a…

>but I don't remember any game ever asking me for my root password to install or run. Are you sure there isn't some sort of setuid executable that's doing all the root stuff for you? At least in theory for something like steam, you'd want either all installs to require root, or restrict all installs to per-user basis. >In any case, something being programmed poorly isn't a good excuse to make things even worse. The p…

By default steam puts everything in ~/.local/share so I don't see why it would need root.

These drivers generally try to prevent you from using virtualization for the same reason they want root. The point is that fundamentally they want to live one level above wherever the user is, which means they compromise user ability to secure against them. The game industry isn't exactly known for slow, careful development, so they're kind of the worst group to give root.

Even without a VM, multi-user security does work, and Linux has other tools to isolate programs. Steam already runs in a sandbox[0] on NixOS to give it a normal FHS layout and work at all, so it wouldn't be unreasonable to add more isolation.

[0] apparently using https://github.com/containers/bubblewrap which can also do things like PID and network isolation.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#54

Post by musjleman »

lomase wrote: post #30
alekratz wrote: post #27

Earlier quoted context omitted.

> Why load on boot? -> Because we need to, don't worry. I believe the reason stated was "because we know it will not be tampered with after boot". Not saying it's a good or bad reason, but this is dishonest paraphrasing.

I said it because I think other kernel level anticheat don't do it. If I remember correctly I can just enable/disable the easy anticheat service, sane with the EA thing, I don't need to reboot the machine like with Vanguard. But thanks for pointing it out.

> I said it because I think other kernel level anticheat don't do it.

It is done by FACEIT and ESEA.

> If I remember correctly I can just enable/disable the easy anticheat service, sane with the EA thing, I don't need to reboot the machine like with Vanguard.

You can disable Vanguard as well, you'll only need to re-enable it and restart if you want to play the games.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#55

Post by therein »

ndriscoll wrote: post #49
Uehreka wrote: post #43

Earlier quoted context omitted.

> Solving online game cheating is a billion dollar business. The existence of an incentive does not guarantee the existence of a solution. > HN has a lot of very clever people. From the way people are talking about this issue (in this and the other thread) I don’t think any solution is going to come from HN commenters. Most of the people here are thinking about the problem from first principles and generating ideas t…

Obvious, cheap solution (to this controversy): make it optional. If people don't want to install a rootkit, let them play with other people who are willing to play in a rootkit-disabled session. I seem to recall this was how e.g. punk buster worked 20 years ago.

This is technically already the case for many games already. For example for EasyAntiCheat, the EAC kernel module won't be loaded unless you join a server with EAC enabled.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#56

Post by therein »

raptorfactor wrote: post #50
talldayo wrote: post #10

> Why does this pose an issue in game-hacking? Well.. As we all know, game-hackers go to extreme lengths to achieve their common goal: winning. This is the sad reality of the cat-and-mouse game of game-hacking, as cheaters will not abide by any rules or morals. I feel like this is a flawed basis of assumption and also just a mis-framed situation as a whole. Cheat developers and the people that use them en-masse aren'…

> They might sell their software or distribute it to people that do play to cheat, but the cheat designers are rarely motivated by a desire to be at the top of a leaderboard that will boot them off for obvious manipulation. So the entire concept of blaming the players for wanting to win so bad is really just an emotional "we're the poor developers" deflection. Are you sure you're not deflecting the issue onto a group…

I did develop my own custom kernel level cheat for Rust before. Completely undetected for over 8-9 months. A couple of my friends also used it. It was fun but we did get bored of it eventually and didn't get a ban except for once or twice during initial development because I did indeed step on the toes of the anti-cheat and had it not been for the kernel level anti-cheat, it would be so much simpler for me to develop this whole thing. Eventually, Windows kernel updated, I had to update some offsets for DKOM and I lost interest eventually.

There is a lot of money to be made in this industry. There are many people that would pay 5-7$ per day for undetected hacks like this.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#57

Post by Hikikomori »

lomase wrote: post #38
Hikikomori wrote: post #14

Earlier quoted context omitted.

Doing something to protect the integrity of the competitive game they have? Compared to others Riot is somewhat successful at least. There are plenty of games that do not require anti cheat but they aren't going to be the type that uses skill based matchmaking.

Dota and CS don't have kernel anticheat and they are as competitive as LoL or Valorant.

And CS is completely overrun with cheaters. I don't play Dota like games but afaik they all have effective obfuscation, so ESP/wallhack like cheats aren't effective. But they have some auto aim cheats for abilities.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#58

Post by lomase »

Hikikomori wrote: post #57
lomase wrote: post #38

Earlier quoted context omitted.

Dota and CS don't have kernel anticheat and they are as competitive as LoL or Valorant.

And CS is completely overrun with cheaters. I don't play Dota like games but afaik they all have effective obfuscation, so ESP/wallhack like cheats aren't effective. But they have some auto aim cheats for abilities.

CS and Dota are not overrun by cheaters, millions of people play those games every day with no problem.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#59

Post by Muromec »

Hikikomori wrote: post #14
Muromec wrote: post #6

Earlier quoted context omitted.

If the hack has to be in kernel, it will be in kernel, so what's the point anyway.

Doing something to protect the integrity of the competitive game they have? Compared to others Riot is somewhat successful at least. There are plenty of games that do not require anti cheat but they aren't going to be the type that uses skill based matchmaking.

Everybody is "doing something". It's a question of what is something. Account-banning people after proven cheating is also something. I would imagine a competitive game with a skill-based match-making, especially a successful one can do that.

Asking people to swear to not cheat in ToS is also something. Only installing the game on the proper trusted computing or doing server-side anticheat is something too.

The issue is with the company deciding to disregard customers concerns about security and privacy to get this something for cheap from a third-party vendor.

Re: Why anti-cheat software utilizes kernel drivers (2020)

#60

Post by lxgr »

haunter wrote: post #12

HN has a lot of very clever people. Solving online game cheating is a billion dollar business.

And software-only trusted computing is a very hard problem – just ask DRM vendors how well that is going.

There being a market for something is necessary, but not sufficient for commercial success. That something also needs to be possible.

Post reply on HN