Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

/dev/null: Anti-Cheat Kernel Driver (2020)

leagueoflegends.com

Post reply on HN
Print view View original

91–100 of 142 posts

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#91

Post by smileybarry »

cowtools wrote: post #60
maccard wrote: post #42

Earlier quoted context omitted.

The hardware isn't banned, the player is banned if the anticheat detects the hardware being used. The hardware might be reprogrammable and self modifying at some point in the future, but until it is and it's widely available a root level anticheat is adequate protection.

The player is not banned. The player's account is banned. It is a free game- they can make as many accounts as they like. The hardware will become widely available once kernel-level anticheat becomes widely used. >if the anticheat detects the hardware being used. The only thing the anticheat will be able to detect is ordinary hardware. My cheating device will capture input from HDMI or PCI, the software sees it as a…

Games have been using fake memory addresses to catch cheats for decades, there’s no reason to assume games won’t try and find memory inspectors by having multiple stores of value and catching the one being processed or modified.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#92

Post by phendrenad2 »

wswope wrote: post #33
phendrenad2 wrote: post #9

You basically can't have a PC game in 2022 without a kernel rootkit to detect cheating.

They’ve never actually rolled this out for League. I’ve played hundreds if not thousands of hours of competitive matches over a decade and never seen a blatant cheater (maybe 1-2 cass botters, but couldn’t be sure). Given that it’s one of the biggest online PvP games around, I don’t think you or Riot are really making a strong case here.

To understand why it's a strong argument, you have to understand the difference between 2D games like League and 3D games like Valorant. In a 2D game, the game is slow enough that you can keep most of the state server-side. The potential to cheat in League is very low. Things you might want to do include (1) macros to do combos (2) automatically run away when low health (3) bigger alerts when an enemy is charging your lane (4) skillshot aiming. None of those are going to really push you up in rank. You'd be better off just getting good at them yourself, as you'll have more flexibility than relying on a tool to do them for you (and then having to fight the tool when you don't want them).

A 3D game like Valorant or Call of Duty is much more fast-paced and also introduces a third dimension. This means that transferring the visible game state to the player every frame is much more difficult, both for the server to keep track of, and for the network bandwidth available to the players. This means that in 3D games, there is often client-side data that the user is not supposed to see (such as the exact position of an enemy who has ducked behind a wall, but the server hasn't stopped sending you position data for yet). This poses a huge advantage to whoever can get access to that data and display it somehow. These are called cheats... And they can run in kernel space. This is why they need their own kernel rootkit to detect them.

This article seems to be a bit unclear, but it seems like their point is to justify kernel-mode anti-cheat in broad strokes. I don't think they're just talking about League here. Adding anti-cheat to League is probably not a priority, for reasons I've outlined above.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#93

Post by prvit »

magixx wrote: post #86
blibble wrote: post #45

Earlier quoted context omitted.

they paying a monthly subscription for "undetectable" cheats these days anyway and they're not cheap, $59.99/month would be pretty middle of the road a cheap $30 card is nothing

The video mentions people being willing to pay up to 2k for such devices. With the DMA device itself costing a couple of hundred, plus cheat development time, plus extra hardware, I don't expect these setups become very affordable any time soon.

People are willing to pay up to $2k for regular software-based hacks.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#94

Post by smileybarry »

Youden wrote: post #85

Riot's anti cheat is the only one I've found that causes my KVM virtual machine running Windows to BSoD. Ironic that the post title indicates Linux-awareness but the post content breaks any chance of playing Riot's games on a Linux computer.

Riot Vanguard outright states that virtual machines are not supported (for valid reasons; how do you ensure the guest OS memory isn’t just tampered with by cheats outside?). It doesn’t surprise me that it doesn’t work.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#95

Post by smileybarry »

robalni wrote: post #84

This is a pattern I see very often and that I think all of us can see all the time. The developers of software try to control how the users use the software. This is not just a regular customer or user relationship between the user and the developer. This is something else, some kind of controlling behavior that we need to get rid of. You can't force someone to stop doing something as long as they do it on their own…

…and on that same note, the developers have total say over what someone does on their computer — the server.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#96

Post by PaulsWallet »

lalopalota wrote: post #22
PaulsWallet wrote: post #6

> This isn’t giving us any surveillance capability we didn’t already have. I think this is an important line. Regardless of how people feel about anti-cheating efforts, I don't believe many people realize how much access games already have to their system to the point where it's kind of a miracle there aren't more malicious games out in the wild.

Games? You mean literally every piece of software on (most) computers? Most default Windows, Linux, Mac single user setups are vulnerable to having everything be intercepted/exfiltrated by every program installed. Why would games be of concern specifically?

Because games are generally thought of as harmless. Most people aware a rogue piece of productivity software or something can cause them issues. Games, for whatever reason, don't get that same consideration.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#97

Post by gizmondo »

prvit wrote: post #3

Of course, this is just a blog post by a gaming company for their gamer audience, but lots of this stuff is downright dishonest. For example: > Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk Kernel…

> They will inevitably render clientside anticheat obsolete.

Doubt it. There is no alternative on open platforms. Serverside anticheats are dead on arrival, they are and will always be easy to fool.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#98

Post by robalni »

smileybarry wrote: post #95
robalni wrote: post #84

This is a pattern I see very often and that I think all of us can see all the time. The developers of software try to control how the users use the software. This is not just a regular customer or user relationship between the user and the developer. This is something else, some kind of controlling behavior that we need to get rid of. You can't force someone to stop doing something as long as they do it on their own…

…and on that same note, the developers have total say over what someone does on their computer — the server.

No player runs code on the developer's server. They just send packets to it, just like my web browser sends packets to web servers. Nobody is trying to put anti-cheat software in my web browser.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#99

Post by prvit »

phendrenad2 wrote: post #9

You basically can't have a PC game in 2022 without a kernel rootkit to detect cheating.

What definition of “rootkit” are you using here? I’d consider myself fairly well-versed with rootkits, but don’t understand how game anticheats could reasonably be described as such.

Re: /dev/null: Anti-Cheat Kernel Driver (2020)

#100

Post by prvit »

gizmondo wrote: post #97
prvit wrote: post #3

Of course, this is just a blog post by a gaming company for their gamer audience, but lots of this stuff is downright dishonest. For example: > Now, while most players might find the idea of a corrupted Windows installation objectionable, a disturbing number of cheaters have shown themselves to be downright enthusiastic about the opportunity to jump onto some guy’s botnet in exchange for the ability to orbwalk Kernel…

> They will inevitably render clientside anticheat obsolete. Doubt it. There is no alternative on open platforms. Serverside anticheats are dead on arrival, they are and will always be easy to fool.

Serverside anticheats can at least ensure that cheaters won’t be able to perform vastly better than real humans at the highest levels.
Post reply on HN