Anti-cheat kernel driver
na.leagueoflegends.com
na.leagueoflegends.com
these guys are pretty cavalier about shoving themselves into the kernel...
They don't think of themselves as guests who have the privilege of being installed on people's computers. They actually think they own our machines. In their opinion, the mere existence of cheats is an affront to their divine authority over our domains. To them, we are merely an adversary who must be attacked and defeated preemptively before we do something we aren't supposed to do. Our power, freedom and autonomy must be taken away for the sake of their security and the integrity of their video game.
This is unacceptable. Game companies don't get to decide what we can or can't do with our computers. Users are free and they own the machine. If they want to run client-side cheats, so be it. It's not like they're cracking and taking over the game company's servers. If they disrespect users by messing with their computers, they should not be surprised when users show them who's really in charge.
We have quality and trust issues with drivers written by hardware manufacturers and we're finally getting them to contribute free or open source versions. The situation is finally improving. Proprietary cheating prevention software is the last thing we need running in kernel mode right now.
Besides, the video games industry doesn't deserve our trust. For example, capcom.sys had privilege escalation as a feature:
https://twitter.com/TheWack0lian/status/779397840762245124/
https://www.theregister.co.uk/2016/09/23/capcom_street_fight...
The privacy policies and terms of service associated with existing cheating prevention software don't exactly inspire confidence either. They collect and transmit a lot of personal information and will even take screen shots. It's unwise to run this software in anything but a completely isolated environment, to say nothing of kernel mode. Unfortunately, the ability to run the game in a completely isolated and controlled environment is exactly what enables us to hack it and cheat. They're going to have to live with that.
It doesn't matter how bad the cheating gets. Sacrificing our computing freedom and privacy is simply not okay. These principles are far more important than having an online gaming experience that's free of cheaters. It is better to crack and remove the game's invasive modules than to let it run freely on our machines.
The truth is online multiplayer gaming is fundamentally broken. We're playing with strangers we don't know much less trust. We must play only with people we know personally and trust.
Seriously man, it's a game. If you don't like their methods of anticheat implementation, feel free not to play! It's easy. You won't be missed by those millions of internet strangers. I like that Riot was so upfront about this. They did a great job of describing what they were doing, why they were doing it, how it was being done, and did it in a way that wasn't dry as a chalk ball in the Sahara... So don't "sacrifice your computer freedom". Freedom to choose what's running on your OS is the same freedom they have choosing to use kernel level anticheat. Your attack of that freedom is pretty distasteful.
It's not like they're open to negotiation either. They only offer the game on their non-negotiable terms.
Fighting back without compromising is actually the only way to deal with these one-sided take-it-or-leave-it deals. It worked for obnoxious pop-up ads on the internet, it's likely to work for invasive ads and tracking and there's no reason to believe it wouldn't also work in this case.
> I want to install this game, except for the parts I don't like, even though they do what I want them to! It's wrong of them to include stuff I don't like in their thing I want to use!
Nothing wrong with any of this. If I don't like something, I should be able to get rid of it. It's software.
Anti-cheating software actually used to be optional. I used to have the option to host or search for servers with anti-cheating disabled. During installation, many games offered me the option to install the anti-cheating module. Battlefield 2 comes to mind.
Once installed and in use, it was still pretty invasive. However, it wasn't straight up forced on players like it is now.
> Freedom to choose what's running on your OS is the same freedom they have choosing to use kernel level anticheat.
People also have the freedom to get rid of the anti-cheating software and make it look like nothing's been tampered with. Banning someone who did this and proceeded to play without cheating would be a false positive. People are already getting banned for the crime of running an online game on Linux.
It was the same with Enemy Territory, you could choose not to enable PunkBuster. It worked quite well, since when PunkBuster stopped providing anti-cheat servers for ET, server admins had to be more proactive with banning - and it worked (and works) pretty well. The issue with games like Overwatch is that you don't host your own server, and you therefore can't choose to ban a certain player if you know they're a cheater.
If Blizzard were to implement host-your-own-server, like older MP games, it would fundamentally change their game dynamic, which is balanced matchmaking with other people in the queue. I'm not a fan of the random matchmaking model (it has destroyed the local community spirit of MP servers), but it does solve some problems - I can now be confident that I'll only be playing with people ranked similarly to me, and it provides a region ranking system where you can gain a higher skill rating and play against more experienced people. In ET, you could join your favourite server and spend a long time getting rolled by a really good player, consistently, and your only recourse would be to abandon that server and find another one, and hope there's not a really good player there either. It's not fun to consistently play against people miles ahead of you.
All the participants of a game agree to a common set of rules required to make the game fun, fair, and enjoyable. And this is true of any game, from online games such as LoL to offline games like poker and soccer. Unfortunately the prevalence of cheating has made the anti-cheating modules another bullet point on that set of rules for online games. There's still plenty of games out there that you can play with people you know personally and can trust, but I certainly cannot find and organize 59 other people to play Battle Royale shooters with me within minutes of wanting to play a match on my schedule, so I'm ok with the trade-offs involved in making that possible. Just please don't force your principled stance on others.
I'm not forcing it on anyone. Users are free to install and use the invasive software if they don't care about the implications. They're also free to circumvent the software and play the game without it. It's an individual decision. People shouldn't have to abstain from playing a game they bought because the game company doesn't have total access to their machine.
The point I'm making is game companies shouldn't be shipping invasive software at all regardless of what it's used for. They need to come up with better ways to detect cheaters. Methods that work on the server side. For example, traffic analysis can be used to detect bots:
https://www.iis.sinica.edu.tw/~swc/pub/bot_identification.ht...
Imagine we're playing soccer. We both know the rules. However I don't really like how those rules restrict me from using my hands when I'm not a goalie. You could say that I feel like the rules shouldn't have total access to dictate what I can and can't do with my body. But you want to play soccer and the rules that go with it. Who should abstain from playing the game?
For the sake of this example, please don't suggest saying that the rules should be changed by the players to accommodate both. This isn't a possibility in video games for the players. They can either choose to play with the existing ruleset or not play at all.
If your suggestion is to just avoid players that don't want follow the rules, with the game providing this as an in-game mechanism, please be aware this doesn't really work and is very ripe for abuse. There was a case early on in Overwatch where they had a top player complaining that they were no longer getting into games successfully. An investigation revealed that they were so good at the character they were playing -- a sniper -- that their opponents didn't want to play against him/her and thus used the in-game avoidance feature to do so. This had the net result of the match-making system not finding enough players for him/her to play against anymore.
> They need to come up with better ways to detect cheaters. Methods that work on the server side.
But they are coming up with better ways to detect cheaters, and it's through these kernel drivers. Ultimately, differentiating between a regular player and a cheater is a matter of how many signals you can analyze. The quality of the model you can build for identifying cheaters increases as you add more signals. And with a good enough model you can reach a certainly level that allows you to comfortably start issuing bans. You can see it with the link you provided, where the researchers found a way to add more signals to the model by analyzing the network traffic patterns.
Unfortunately, server-side detection can only get you so far. If a player turns on a wallhack, what signal can the server use to figure out what's going on? If my LoL champion has a defensive ability that I can use to dodge attacks, and my cheat program can detect incoming attacks that'll hurt me and activate it for me, with it programmed to have a minimum time to activation in order to pretend the reaction time is human, what can the server do to detect this?
Ultimately, to answer these questions you have to start asking the client to assist you by providing more signals, but when the client is under user-control it's trivial to lie to it. Hence the need to move some of the anti-cheat code to driver-space.
By the way, server-side detection doesn't really account for the reality of how cheaters actually cheat. Fancy detection methods like dynamic Bayesian networks for statistically analyzing shooting accuracy in FPS's sound great in theory, but aimbots don't really snap to player's heads anymore. Instead they guide the player's aim when toggled on and only do this gently, so that even human reviewers have a tough time seeing what's going on. The intent there is to increase the uncertainty level of the model declaring the player a cheater, as companies fear banning players accidentally and will only issue bans once they are positively sure the player is a cheater.
I'm sure Riot and many other game companies are using as many server-side detection methods as they can, so what exactly do you expect the game companies to do when they run out of available server-side detection methods and still have a cheater problem to deal with that affects their bottom line?
Depends on what they have total access to. There is no problem with having total access to the playing field and monitoring it. I would object if they came up with a brain implant that could figure out whether players were diving and made it mandatory for every player to wear it in order to play.
> For the sake of this example, please don't suggest saying that the rules should be changed by the players to accommodate both.
I'm not saying that. My problem is purely with the invasive detection software.
> please be aware this doesn't really work and is very ripe for abuse
> This had the net result of the match-making system not finding enough players for him/her to play against anymore.
This is a problem but it's a match making problem. People prefer to play with others of similar skill since being beaten over and over again is too frustrating. The better the player gets, the harder it is to find others of similar ability. I don't know the answer to this problem.
In this case people are still playing with strangers they don't know or trust, players who could be cheating. I think people should play with real life friends who they know and trust in real life. Much smaller groups that can police themselves. I've met competitive players who are part of local groups and who play only with each other so there are people doing this.
> Ultimately, to answer these questions you have to start asking the client to assist you by providing more signals, but when the client is under user-control it's trivial to lie to it. Hence the need to move some of the anti-cheat code to driver-space.
Kernel mode is still under the control of the user. Their detection software got way more invasive but it still can't make any guarantees.
They are trying to secure their game client against an adversary who has full physical and logical access to the entire system. Nothing they do can take control away from the user. They can only make it hard enough to prevent most people from trying.
> so what exactly do you expect the game companies to do when they run out of available server-side detection methods and still have a cheater problem to deal with that affects their bottom line?
I don't have an answer. I just hope they can come up with something that doesn't require me to place so much trust in them.
Make it fun to lose too.
In the before times, in the long long ago, there was a Half-Life mod called Natural Selection that I played entirely too much of. It was an asymmetrical FPS/RTS hybrid. In the earlier versions (pre 3.0, I think), Aliens were considered to have a slight advantage over Marines, however this was ok because losing as Marines was a lot more fun than losing as Aliens because they got to roleplay the Alamo by locking down their last base with ludicrous defensive measures and holding out against wave after wave of Alien attacks. This strategy would actually rarely result in a sudden turn around in the game as it was possible for a skilled Marine to escape through the Alien horde and find a quiet spot to begin construction of a stealth hail-marry base, or get in position to just barely kill a hive before they could be taken out. For mechanical reasons, this strategy was not possible on the Alien side and consequently losing as Aliens was an exercise in waiting to be curb stomped and no fun at all.
Don't take this the wrong way...but, is this serious?
They're free to do it, but then they should also fully expect to be kicked out of the game for doing so.
This is all assuming that the developers of anti-cheating software have any sense of self-restraint and strictly limit themselves to anti-cheating, which is obviously not the case given their track record. The reality is much, much worse and no amount of legal gibberish they stick in front of their users before installation would make it any better.
We don't expect to just be able to start a random game with untrusted strangers in real life and be assured they're not going to cheat.
Could you imagine if any time you wanted to play sports in real life you had to consent to wearing something that could read your mind so that it could determine you weren't cheating? That seems as ridiculous as the end-game of client-side cheat prevention.
I understand there are competitive settings where money is involved and that's where you need referrees. Otherwise, I think we've gone down this road where we take cheating far, far too seriously. I say this as someone that absolutely loves videogames, so I'm not meaning to disregard them.
Trusting strangers is ultimately a problem you'll never solve completely. I just don't think there's a technical solution to it.
Also, far out I hate some of the big companies in gaming. The attitude that Riot is displaying here just sucks.
Professional sports is corrupted so far that the best move is not to play.
The anti-cheat kernel driver is already just going to be for Windows, so bringing this argument up probably holds less weight than you intended.
Lack of Linux compatibility means people have to choose between playing the games they enjoy and running a free operating system. They will indirectly sacrifice their privacy and freedom in order to get access to the games.
There's also the fact that, just like the hardware manufacturers, the company will eventually stop supporting old version of its proprietary drivers. Eventually, they will no longer run even in newer versions of Windows. The games may be rendered unplayable due to lack of maintenance. Installing old versions of user space libraries like DirectX isn't going to help in this case.
That said, the existence of cheaters is one of the big reasons why I don't play such games -- and that games include anticheating software is another one of the big reasons, equal to the existence of cheating in terms of how objectionable I find it.
From my point of view, this situation is nothing but a massive train wreck.
This doesn't work with all types of games obviously, and perhaps all online games from here on out will have kernel-level protection. In the meantime, I think we will keep running UT2004 in compatibility mode (or in my case, Wine).
I can play the UT2003 native version for linux just fine (doesn't seem to play nice with amdgpu, but the intel driver seems to be fine).
Regardless, it'll still run on modern systems if you acquire old libc binaries[1] (and preload them), use SDL 1.2 (possibly a patched version[2] which enables Alt+Tab) and start the game using aoss[3] for sound.
[1] https://www.unix-ag.uni-kl.de/~deusser/UT2004/
People should be playing online with others they personally know and trust.
- The percentage of people who want to cheat is not that high.
- Any cheat that spreads widely enough can be obtained by the developers and detected. Cheat developers can and do sell exclusive cheats to smaller groups of people, but fewer people using the cheat also means less disruption.
- With tactics like delayed ban waves, game developers can make cheating risky enough to create an effective deterrence, even if they don't actually catch all cheats.
- If all else fails, game developers can have players manually review other players' replays for cheating, like with Overwatch for CS:GO (not to be confused with Overwatch the game). So obvious cheating will be caught, and if people make their cheating non-obvious, well, that also makes it less likely to annoy other players.
These measures can't stop all cheating, but they don't have to; they just have to deter it enough that it doesn't unduly hamper most players' experiences. In practice, it seems like most games are able to accomplish this.
If you're interested in the technical details you can read about it here:
https://www.unknowncheats.me/forum/overwatch/361279-pareidol...
> We haven’t needed both arms yet, primarily because we have the advantage of steady paychecks and the lack of strict bedtimes at our immediate disposal. But as much as we might like the idea of an ever-escalating appsec war with teenagers,
And yet they fail to realize that they're playing in to the very cat-and-mouse game they deride. I can't wait until this escalates into "ok, well, now you need Intel TSX with Secure Enclave to verify that you're using the League video driver, and our proprietary USB dongle to play our game."
Spoilers: the teenagers will always win; you can never trust a client no matter how many technical barriers you erect. Look to the entire legacy of DRM for how this strategy has been tried and has failed. Server-side statistics are the only hope against serial cheaters - they're barking up the wrong tree here.
This type of battle can't be won, but if you do it right, you can push most of the cheaters somewhere else. Of course, if you do it wrong, you push legitimate players out too.
You don't even need a hypervisor to bypass this, just a driver that pretends to be their kernel driver.
Seriously, no voice chat after a decade because of "toxicity"?
I think if we accept sgx type technology onto our systems then they can at some stage win this battle, at least theoretically. This is assuming that the sgx-like tech cant be practicably attacked, which isnt currently a valid assumption but could, at least theoretically, be in the future.
This differs from non-hardware drm which is basically just obfuscation, and which the method they're currently describing is merely an extension of.
But, assuming you can't cheat on the system itself, you can probably cheat with the video/audio signal and generating USB inputs. It's harder than reading ram, but it's not feasible to stop it. At that point, you have to depend on behavioral targeting and what not (which they're already doing)
You could do DMA on the video-game memory, you could plug the monitor HDMI cable into a raspberry pi 5 or 6 camera input and do framebuffer based aimbot, you could stealthily modify the GPU drivers to give you data before some processing stages (you could probably do that without leaving anything in CPU RAM for too long), and so on.
The SGX won't allow you do this as the memory is encrypted
> plug the monitor HDMI cable into a raspberry pi 5 or 6
I don't know if the pi is powerful enough for that or not, and a HDCP type extension to what's coming out of the SGX could stop it, but ultimately yeah, you could have a robot play the game for you.
> stealthily modify the GPU drivers
Again, SGX type systems aren't going to allow that. This side of SGX type systems is all about trying to make your computer act how the developer wanted it to, regardless of your wishes or a malicious actor's wishes.
A game fidling with the OS kernel ? Like, seriously ??
this was one reason I stopped gaming under Windows inside KVM (the main reason being input lag/jitter)
eventually all the cheats will move into the hypervisor and every competitive game will ban the use of virtualisation
Not to mention some people are creating FPGA boards that use DMA to read memory, something no one is setup to prevent (would require an IOMMU and an OS that bothered to configure it properly; also very difficult to differentiate legit cards from cheating cards and an area game developers have zero experience with right now).
and then there's the statistical methods (measuring anything that causes a VMEXIT is a good candidate)
modern OSes already support the IOMMU (macOS enables it on by default apparently), however outside of that hardware support is patchy at best
ultimately if they're trying to guard the top of the ladder (say the top 0.05%), they could demand you use a certain set of hardware, and the hardcore would put up with it
Do you have any links handy where one could read more about this? I'm really curious about the kinds of projects people are doing which requires this kind of hardware.
There are ways to defeat the time measurement, but it gets complicated fast, and the counter-measure itself is trivial to detect.
if there's a VMEXIT it will be measurable, and you have no ability to virtualise the server's clock
Although if you're trying to circumvent something in the kernel, using a Docker container isn't going to work. Docker containers share the host kernel.
If they want anti-cheats, let them develop AI that looks for non human and unnatural behavior on the server side. They should have no business snooping on the user, let alone having kernel access while doing it.
If you don't live in north america, you'll get redirected to a local subdomain and get a 404
Short of baking it directly into silicon clientside security is an oxymoron.
I do not think I will continue running their software on my machines.
Also, many other posters here have commented that kernel-level mitigations are futile in the face of hypervisor or hardware attacks. What's to stop me from altering system memory arbitrarily using a PCIe device I control externally? How would you even detect this from the perspective of the OS kernel? What if I compromise the private key in the game's network "security" layer and start reading & altering packets? Unless you 100% control the hardware (including mouse, keyboard and monitor, network, internet backbone, etc), you will always have this problem. The only way to have a cheat-proof gaming experience is to set up a LAN tournament and have all hardware provided to players (and even then, you should pour epoxy into the USB ports).
At some point you are going to have to start looking in other directions for solutions to this problem. I believe other games have started using statistical and machine learning systems to detect cheaters rather than trying to match arbitrary binary hashes on my machine (which is what I presume Riot is going to do here). I feel statistical soft-ban systems are a much more reasonable way to handle this problem than the 100% confirmed binary signature permaban systems that seem an obsessive fantasy for some in the industry. Statistical methods directly deal with the impact of the problem whereas perfect match only gets at one of an infinite number of possible causes.
The number of Linux gamers who can't/won't boot into Windows for a game is a tiny portion of an already tiny market.
https://www.phoronix.com/scan.php?page=news_item&px=Blizzard...
https://www.bleepingcomputer.com/news/gaming/linux-gamers-ba...
1. I'm reminded of the exploitability of the rootkits folded into games like MapleStory a few years ago. Anybody with the rootkits installed had kernel-level authority available for the taking. Unfortunately don't remember exact details, but my vague memory suggests this was unfixed for years.
2. Link-chaining a bit I got to https://www.youtube.com/watch?v=rj6ukLPiY10, "The Norwegian CS Cheating Scandal". I didn't watch the video but I did read the top comment, which rightfully highlighted the utter inability for software to detect cheating via DMA (in the noted case over PCI-e, but potentially theoretically doable over ThunderBolt and FireWire too).
Hopefully these rootkits are a bit better at doing one thing and doing it better than the iPhone SecureROM ;)
Most seem to not realize that poking PCI-e isn't that expensive, but thankfully the specialist reverse engineering skills required are still well outside the 14-year-old script kiddie attention span.
Cheat production is a very big and very profitable industry.
How about he just writes technically and lets reddit comments translate? I'm so sick of writers' concerns for illiterate proles (along with, in this case, a seeming need to maintain the energy and punch of a memetastic for-12-year-olds YouTuber) ruining perfectly good technical writing
The ananlogies are horribly pained. It is an excess of empathy that ruins technical writing that could otherwise be quite rich with information. This attitude of writers having to do all the work needs to end; let the reader do some of it
edit- its reductivist to think that only SWEs would understand this stuff. Have you forgotten about the legions of IT professionals and computer nerds that many SWEs came from? The rich history of hacking, much of which this post laments? Or is that kind of nerditry simply unfashionable nowadays?
Not that I'm defending this crap, in my mind it's basically a rootkit that can snoop on anything in your system. Currently trying to figure out how to run games in a hypervisor.
If your adversary controls the hardware, you've already lost
Which explains why most of the moneymen in this industry push so hard to control hardware we've bought and paid for -- and in many cases built.
This is you right now
Are physical threats what Hacker News is about now?
https://www.reddit.com/r/playrust/comments/c8h81n/please_fac...
In all likelihood – unless these guys are uncharacteristically careful – it will stay there even when you are not playing and become an attack vector.
Might it be an attack vector even while the game is playing?