Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Anti-cheat kernel driver

na.leagueoflegends.com

Post reply on HN
Print view View original

91–100 of 115 posts

Re: Anti-cheat kernel driver

#91

Post by chopin »

tinus_hn wrote: post #86
matheusmoreira wrote: post #61

Earlier quoted context omitted.

Yes. I don't see how that is relevant though. It doesn't matter how bad the cheating gets. Sacrificing our computing freedom and privacy is simply not okay. These principles are far more important than having an online gaming experience that's free of cheaters. It is better to crack and remove the game's invasive modules than to let it run freely on our machines. The truth is online multiplayer gaming is fundamentall…

Consider real life athletics where you have to submit almost 24/7 ‘whereabouts’ and consent to unannounced blood and urine tests, or you’re banned.

This would end quickly if every honest athlete abstained (being part of the game). Or even a majority.

Professional sports is corrupted so far that the best move is not to play.

Re: Anti-cheat kernel driver

#92

Post by kick »

matheusmoreira wrote: post #61
nitrogen wrote: post #59

Earlier quoted context omitted.

Have you ever played a multiplayer game when someone else is cheating?

Yes. I don't see how that is relevant though. It doesn't matter how bad the cheating gets. Sacrificing our computing freedom and privacy is simply not okay. These principles are far more important than having an online gaming experience that's free of cheaters. It is better to crack and remove the game's invasive modules than to let it run freely on our machines. The truth is online multiplayer gaming is fundamentall…

Sacrificing our computing freedom and privacy is simply not okay.

The anti-cheat kernel driver is already just going to be for Windows, so bringing this argument up probably holds less weight than you intended.

Re: Anti-cheat kernel driver

#93

Post by vb6sp6 »

dmitrygr wrote: post #27

> This isn’t giving us any surveillance capability we didn’t already have. If we cared about grandma’s secret recipe for the perfect Christmas casserole, we’d find no issue in obtaining it strictly from user-mode and then selling it to The Food Network. The purpose of this upgrade is to monitor system state for integrity (so we can trust our data) and to make it harder for cheaters to tamper with our games (so you ca…

They went the snarky route instead of the professional one. It may be the correct choice considering their core demographic

Re: Anti-cheat kernel driver

#94

Post by JohnFen »

comex wrote: post #73
matheusmoreira wrote: post #58

Earlier quoted context omitted.

The fact is online multiplayer games are fundamentally broken. It depends on trust and that's rare because almost no one knows each other. Everyone's a stranger. It's just random people playing together. People find ways to cheat even on trusted platforms like game consoles. People should be playing online with others they personally know and trust.

Fundamentally broken in theory. In practice: - The percentage of people who want to cheat is not that high. - Any cheat that spreads widely enough can be obtained by the developers and detected. Cheat developers can and do sell exclusive cheats to smaller groups of people, but fewer people using the cheat also means less disruption. - With tactics like delayed ban waves, game developers can make cheating risky enough…

But these games commonly employ intrusive anticheating software, do they not? Regardless of its effectiveness, that counts as a large part of the genre being fundamentally broken.

Re: Anti-cheat kernel driver

#95

Post by nkrisc »

matheusmoreira wrote: post #72
stavrus wrote: post #71

Earlier quoted context omitted.

You don't have to sacrifice your computing freedom and privacy. These anti-cheating modules tend to be explained to you upon game installation, so if you're not comfortable with what they do then just cancel the installation. You're not forced to play the game, but the modules are part of the game's rules and you have to adhere to them if you want to play it. All the participants of a game agree to a common set of ru…

> Just please don't force your principled stance on others. I'm not forcing it on anyone. Users are free to install and use the invasive software if they don't care about the implications. They're also free to circumvent the software and play the game without it. It's an individual decision. People shouldn't have to abstain from playing a game they bought because the game company doesn't have total access to their ma…

> They're also free to circumvent the software and play the game without it.

They're free to do it, but then they should also fully expect to be kicked out of the game for doing so.

Re: Anti-cheat kernel driver

#96

Post by sudosysgen »

nebulous1 wrote: post #51
akersten wrote: post #15

Earlier quoted context omitted.

Yep. The article even smugly tries to boast about how they're adults and understand these things : > We haven’t needed both arms yet, primarily because we have the advantage of steady paychecks and the lack of strict bedtimes at our immediate disposal. But as much as we might like the idea of an ever-escalating appsec war with teenagers, And yet they fail to realize that they're playing in to the very cat-and-mouse g…

> Spoilers: the teenagers will always win; you can never trust a client no matter how many technical barriers you erect. I think if we accept sgx type technology onto our systems then they can at some stage win this battle, at least theoretically. This is assuming that the sgx-like tech cant be practicably attacked, which isnt currently a valid assumption but could, at least theoretically, be in the future. This diff…

Even SGX based methods could be bypassed.

You could do DMA on the video-game memory, you could plug the monitor HDMI cable into a raspberry pi 5 or 6 camera input and do framebuffer based aimbot, you could stealthily modify the GPU drivers to give you data before some processing stages (you could probably do that without leaving anything in CPU RAM for too long), and so on.

Re: Anti-cheat kernel driver

#97

Post by sudosysgen »

himinlomax wrote: post #75
xenadu02 wrote: post #31

Earlier quoted context omitted.

Probably only because most hypervisors don't bother to hide themselves. There's no reason you couldn't prevent detection. Not to mention some people are creating FPGA boards that use DMA to read memory, something no one is setup to prevent (would require an IOMMU and an OS that bothered to configure it properly; also very difficult to differentiate legit cards from cheating cards and an area game developers have zero…

It's pretty easy to detect an hypervisor. There was an article recently on using CPUID timing to that effect. It takes a few cycles on bare metal, but hundreds when virtualized. There are ways to defeat the time measurement, but it gets complicated fast, and the counter-measure itself is trivial to detect.

You can just edit that code out from outside the hypervisor and no one will be any wiser.

Re: Anti-cheat kernel driver

#98

Post by sudosysgen »

DSingularity wrote: post #65
bob1029 wrote: post #42

Ah yes. A kernel-level security feature provided by a software company wholly-owned by a Chinese conglomerate. I do not think I will continue running their software on my machines. Also, many other posters here have commented that kernel-level mitigations are futile in the face of hypervisor or hardware attacks. What's to stop me from altering system memory arbitrarily using a PCIe device I control externally? How wo…

It can be done. Main way to detect is to detect the footprint of the VMExits.

And a program from outside the hypervisor can just magically edit the instructions of the game to avoid such checks.

Re: Anti-cheat kernel driver

#99

Post by sudosysgen »

exikyut wrote: post #80

Two points: 1. I'm reminded of the exploitability of the rootkits folded into games like MapleStory a few years ago. Anybody with the rootkits installed had kernel-level authority available for the taking. Unfortunately don't remember exact details, but my vague memory suggests this was unfixed for years. 2. Link-chaining a bit I got to https://www.youtube.com/watch?v=rj6ukLPiY10 , "The Norwegian CS Cheating Scandal"…

You know that most cheats aren't free to begin with? They can actually get quite expensive. No reason you couldn't buy the device.

Cheat production is a very big and very profitable industry.

Re: Anti-cheat kernel driver

#100

Post by wrmsr »

Back in the day someone figured out that punkbuster blindly scanned physmem for illegal string literals and banned on detecting them no matter what process they belonged to. They then posted one of those strings to #findscrim on gamesurge (or whichever it was at the time) and the channel quickly exploded with hundreds of people saying they just got pb banned for no reason. It was magical.

Short of baking it directly into silicon clientside security is an oxymoron.

Post reply on HN