Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Message About Vanguard From Our Security and Privacy Teams

riotgames.com

Post reply on HN
Print view View original

61–70 of 103 posts

Re: A Message About Vanguard From Our Security and Privacy Teams

#61

Post by blattimwind »

ruialmeida wrote: post #12

This will always be a cat and mouse game. There are some anti-cheat software more intrusive than others. Even Valve Anti-Cheat (VAC) which is considered by many to not be very intrusive, used to intercept DNS queries to detect communication with paid cheats DRM. Most anti-cheats also scan all processeses memory and even files to detect know cheat signatures. They tend to run with high privileges and some take in-game…

> Even Valve Anti-Cheat (VAC) which is considered by many to not be very intrusive, used to intercept DNS queries to detect communication with paid cheats DRM.

I was surprised hearing this. It seems like what they actually did was if VAC already found something, it checked the hashes of the contents of the DNS cache against a list as a second check. That's quite a bit different from "intercepting DNS queries".

Overall VAC always made a reasonable impression on me as far as privacy and security are concerned (no SYSTEM services, no kernel driver, no screenshots, no scanning and uploading random files etc.), although this non-intrusive approach naturally limits the kinds of cheats it is able to discover. I feel like the approach taken by Vale is, on the whole, well balanced.

Source: https://www.pcgameshardware.de/Steam-Software-69900/Specials...

Re: A Message About Vanguard From Our Security and Privacy Teams

#62

Post by blattimwind »

houzi wrote: post #16
SpaceManNabs wrote: post #9

I skimmed, but it seems none of this addressed why the service (edit) runs at boot-time? Also, expecting a service to not not look at your data if they have access is not security. If Valve can mitigate hacking in CSGO without such an intrusive service, I am sure Riot can. I, myself, did a very, very, very poor job with an autoencoder to detect anomalous matches in Dota and caught a large amount of players abusing th…

Hackers in standard CSGO games are rampant from what I understand. Serious players pay extra to queue up in a dedicated service for high tickrate servers and anti-cheats which I believe are rootkits as well.. not sure about any of this though.

It's not a solved problem for CSGO, but surprisingly the situation now, as a F2P game, is much better than what it was before F2P. It's really quite rare to run into cheaters, most people are just smurfing.

Re: A Message About Vanguard From Our Security and Privacy Teams

#63

Post by dsr_ »

If people want to play games in anti-cheat environments, the only sensible solution I can see involves the reinvention of the cartridge.

In this case, make the cartridge a bootable SSD which entirely avoids touching any other disk in the system (perhaps with the exception of an SD card or USB storage stick for saves.)

The downsides include:

- the game company now has to ship a complete OS and do hardware support. They nearly have to do that anyway, so whatever.

- you'll need to reboot your computer for each game.

The upsides, I think, are obvious.

Re: A Message About Vanguard From Our Security and Privacy Teams

#64

Post by gruez »

smoyer wrote: post #3

Explaining your rationale doesn't change the fact that gamers (many unwittingly) are potentially giving the keys to their computer kingdom to Riot. This behavior on a console would be completely acceptable but unless you're running a dedicated PC for gaming, I wouldn't install this software. As a thought experiment, I wonder what happens when the FISA court orders Riot to install a modified version on a suspected ter…

>I wonder what happens when the FISA court orders Riot to [...]

FISA? Try the CCP.

Re: A Message About Vanguard From Our Security and Privacy Teams

#65

Post by gruez »

blattimwind wrote: post #58
dharmab wrote: post #17

Earlier quoted context omitted.

My next gaming PC will run a Linux hypervisors and use PCI passthru to run Windows as a full-performance guest. Then if I need to use a web browser, I can switch to a Linux guest without interrupting the game.

Most anti-cheats and some "DRM solutions" do not allow you to run inside a VM, trying to mask the fact you do might be enough to get banned. Even with PCI passthru you can't expect full performance (CPU is also still virtualized). It's much simpler to just have a second PC/laptop or dual-boot (less secure).

>or dual-boot (less secure).

There shouldn't be any risks to that if your main OS is encrypted and the keys are sealed by a TPM.

Re: A Message About Vanguard From Our Security and Privacy Teams

#66

Post by ruialmeida »

blattimwind wrote: post #61
ruialmeida wrote: post #12

This will always be a cat and mouse game. There are some anti-cheat software more intrusive than others. Even Valve Anti-Cheat (VAC) which is considered by many to not be very intrusive, used to intercept DNS queries to detect communication with paid cheats DRM. Most anti-cheats also scan all processeses memory and even files to detect know cheat signatures. They tend to run with high privileges and some take in-game…

> Even Valve Anti-Cheat (VAC) which is considered by many to not be very intrusive, used to intercept DNS queries to detect communication with paid cheats DRM. I was surprised hearing this. It seems like what they actually did was if VAC already found something, it checked the hashes of the contents of the DNS cache against a list as a second check. That's quite a bit different from "intercepting DNS queries". Overal…

Yes, thanks for clearing up the intercept part, I didn't remember how they did it exactly. They do make right decisions in my opinion to balance security/privacy issues at the cost of less ability to detect cheats. I think they also have a pretty good record of not banning inocent people.

Re: A Message About Vanguard From Our Security and Privacy Teams

#67

Post by sbarre »

hellcow wrote: post #44
haunter wrote: post #14

>we wouldn’t work here if we didn’t deeply care about player trust and privacy Bold message from a chinese company. People freak out about Huawei but Tencent is 1000% worse. And here they are installing a kernel driver on your PC.

This is being downvoted, but this is an important point. The Chinese government has repeatedly shown they'll work with Chinese companies to carry out the government's agenda. Do you really think that after 100M people install this kernel driver that the Chinese government won't lean on Tencent to gain access, or use it beyond its original purpose?

So let me ask you a question then..

Do you feel the same way about Microsoft and Apple, and every other company that provides a hardware driver for a modern computer, and whether state governments (USA included) put pressure on them to let them advance their agenda by using back doors in their drivers or software?

Why is Riot special in all this? What, in your view, makes them more likely to be so secretly and so deeply corrupted in the manner you suggest?

Note I'm not asking you if you run MacOS or Windows.

Re: A Message About Vanguard From Our Security and Privacy Teams

#68

Post by gpderetta »

ruialmeida wrote: post #38
lol768 wrote: post #10

Earlier quoted context omitted.

> Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform. > It involved a second computer, which man-in-the-middled all network data to the client computer. Out of interest, was there no transport level encryption to deal with here? Or did you need to do something special to capture keys on the client?

In order for your game to render other players you have to know their position, so the game server has to send them to all players. As an example, for CSGO in the past, the server always sent all player positions from anywhere, so it was possible to create cheats to draw players anywhere in the map. They changed the way it's done, coordinates are only sent when other players are nearly visible, although distant, or c…

>In order for your game to render other players you have to know their position, so the game server has to send them to all players

I know nothing about game engines, but I have always wondered why is that the case. The server could compute visibility and only send the opponent position if there is a chance the player might see it. Computing visibility server side is not cheap, but it would still be significantly cheaper than fully rendering a scene, right?

Re: A Message About Vanguard From Our Security and Privacy Teams

#69

Post by sbarre »

dsr_ wrote: post #63

If people want to play games in anti-cheat environments, the only sensible solution I can see involves the reinvention of the cartridge. In this case, make the cartridge a bootable SSD which entirely avoids touching any other disk in the system (perhaps with the exception of an SD card or USB storage stick for saves.) The downsides include: - the game company now has to ship a complete OS and do hardware support. The…

The other option that is touted a lot is cloud gaming, with services like Stadia.

There are outstanding issues to resolve there, like input lag and visual fidelity, but it certainly removes the ability to cheat at the system level by hooking into game processes and memory.

Aimbots would be still be theoretically possible through MITM video feed analysis (as has been speculated) but that would also work in your cartridge scenario.

Re: A Message About Vanguard From Our Security and Privacy Teams

#70

Post by TrueDuality »

> ...some of you want to know more about the tech behind Vanguard. We can’t get too deep into the technical specifics without potentially compromising Vanguard...

That in itself tells me enough about the efficacy of the system. Security through obscurity is only a hand wave of security. Making the trade off of all the security architecture put in place over the past decades for something that needs to be hidden to remain secure is a really poor value statement.

I understand why they want this in place, it does raise the level of effort on cheating but there are other ways this can be accomplished without compromising a user's security.

Post reply on HN