Hacker News Reader

Comment by fooqux | Hacker News Reader

I find it interesting that in their "Should I panic" section, they miss one of the biggest panic-inducing points for me: That a program running in ring 0 has some form of internet access.

They don't go into detail here about how far this goes, but I wouldn't be at all surprised to hear that it is directly sending and receiving data from the internet. That is such a bad idea for obvious reasons.

View on HN

Why would they do that? They don't need to send the data through the kernel, they can just IPC it to the process and use the existing telemetry stack.

Also, what gives you panic here? What more damage can they do than running in user mode? They can already access all your files, steal all your cookies etc.

well because if an attack vector is found in their anti-cheat driver, attackers could use it to access memory space of other processes and not just user accessible files or launch a privileged process for keeping tab on your system.

They delegate to a userland process for most things and apparently have had multiple audits on this driver, according to what they've said about the same thing that they run in their game Valorant.

"Multiple audits" from Gus over in QA to Bob in accounting. Despite all of their assurances I can't help but to feel that it is only a matter of time until this is exploited.

I did a security audit last week, which was mostly the managers writing a runbook for weaseling out way out of trouble if a data breach happened. Actually looking at overall system architecture, the specific encryption services, etc was not a popular topic.

So yeah audit does not fill me with confidence.

So are you accusing them of lying when they say they've had external security audits done, or are you commenting without any knowledge of the topic at hand?

Without external confirmation from the firms that did the audit and the details of them, you can trust riot's statements about audits no further than you can trust any of their other statements.

I'm taking their claims with a large dose of salt.

I believe its only there because of the kernel panic pun.

No, I'm pretty sure it's there because installing something that runs at ring 0 can do anything on your system. Look at all your internet traffic, files, make you go bald, etc.

Any sane security-minded person should slightly panic IMHO.

Or just run games on a computer dedicated to the task.

Of course you understand that that is not a reasonable solution.

There are gaming consoles, or you can just not run their games, it's not like there aren't literally thousands to choose from. They're also just games, cheating is not a life or death thing, or it shouldn't be.

Alternatively, you could stream a game from a remote server like on Stadia. These anti-cheat systems are only for online games anyway, and you can let Google deal with their kernel driver.

I didn't write a comment suggesting a thing because I considered it unreasonable and on reflection, no, I don't think it's unreasonable.

Can't you just run two oses alongside each other?

"annoying" when dealing with graphics cards / passthrough if you're talking about virtualization and probably would not be allowed since the hypervisor would be a ring above the kernel module, effectively neutering it.

If you mean dual-boot, sure, that's a very reasonable solution as well. I just don't like to reboot often and would personally have a 2nd computer as it probably takes me an hour or more to go from "booted" to "productive"

Reply on news.ycombinator.com