Hacker News Reader

Comment by matheusmoreira | Hacker News Reader

Banks in Brazil came up with something called a "security module". It's a kernel driver that intercepts all network connections. It makes everything slow and probably leaks highly sensitive private information back to the bank and god knows who else. I had to boot windows in safe mode in order to get rid of this thing.

Apparently, malware is perfectly legitimate if it serves the business interests of the rich and powerful.

View on HN

Back in the day if you played a audio CD from Sony, you got a rootkit for your added enjoyment. To this day I have never bought a Sony product due to that debacle and never will until someone goes to jail for hacking millions of computers. Which pretty much means I will never buy a Sony product again.

Don't forget the part where the subsequent software supposedly provided to fix the problems actually made things worse.

https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk...

I suspect if they'd tried something like that today, it would have been a much bigger deal in the media and the resulting legal actions would have cost them a lot more. At least the fiasco probably increased awareness of the danger and prompted changes in various computer misuse laws around the world.

My personal view is that the operating systems we trust to be the foundation of our modern devices simply shouldn't allow that kind of access to most applications. Installing software that genuinely does need some level of privileged access to do its job -- perhaps device drivers, or diagnostic tools for people who work in hardware development and really do need to test low level I/O -- should require a different process from the user's perspective.

That process for privileged installation should come with prominent warnings telling the user not to do it unless they're sure you know who's asked them to and why, and perhaps require the user to enter some sort of text confirmation in response to avoid accidental/auto-pilot click-throughs. The need for this kind of installation should be rare enough for normal users, particularly if the OS is designed to run most third party drivers in user space anyway, that this wouldn't be a big deal for usability.

Maybe then even banks might think twice about trying to pull that kind of stunt, if they would have to field many calls from concerned customers over the next 48 hours asking whether someone was trying to hack their bank account. Perhaps they'd even make it into the news as a result, and have to explain why their software was triggering security warnings, which could be nicely embarrassing PR too.

Oh god, and I thought anti cheat kernel crap was bad .

Yeah. At least those only accidentally introduce vulnerabilities into your computer, right? God I hate these anti-cheat software companies... They think they can just own people's computers for the sake of some game. The sheer audacity of it is what pisses me off...

I agree with your argument on principle but cheating in multiplayer games is a real problem and for now kernel level anti-cheat is pretty much necessary until better methods are developed like server-side ML detection. For what it's worth anti-cheat software is routinely disassembled by cheat developers so at the very least it doesn't do anything obviously malicious and likely doesn't have glaring security issues (any of which would get immediately exploited by said cheat developers).

If your game company “pretty much requires” you to install “anti cheat kernel modules” on my machine, unless you’re supplying that machine to me as part of my game purchase price exclusively to play your game with, you can just go broke thanks. Flawed business models do not give you the right to break into and exploit my hardware.

So what if it's a problem? Are these game companies entitled to stop cheating by any means necessary? No. It's my computer and game companies have no right to tell me what I can or can't do with it.

If I want to cheat at their game, that's my right. The game is running on my computer and I should be able to modify anything I want whenever I want. Cheating at games is just an exercise in computer freedom. It shouldn't be prohibited to begin with as a matter of principle.

I actually have little interest in cheating though. What happens often enough is these anti-cheat services will scan my processes, detect my development tools or virtual machines and label me a cheater because of them. Some games literally refuse to even start because of this. They also ensure a lack of Linux compatibility due to their proprietary Windows drivers.

> so at the very least it doesn't do anything obviously malicious and likely doesn't have glaring security issues

Remember capcom.sys?

https://mobile.twitter.com/TheWack0lian/status/7793978407622...

If it's an online game you cheating ruins the experience for other people who have their own rights and interests in a purchase they made. I still don't think it justifies a rootkit but it should be made clear that the impact of cheaters is often to the detriment of thousands of other people.

What's broken is the online gaming model. It's wrong to play with random untrusted people and expect to not find cheaters among them. Just like it's wrong to place a computer on the open internet and expect it to not be scanned, probed and possibly exploited by malicious actors.

The horrible truth these companies don't want to face is people should be playing only with trusted friends. This would destroy their "massive online game" model so of course they don't want to do it. They'd rather own your computer instead.

I don't want to play with just my friends, I as someone who's been playing online games for about 20 years, don't think the playing with many other people part is broken and that is very enjoyable. What's broken is often the choice of server architecture and decision to not have the right amount of moderators to handle reports.

Many games use either partly or entirely P2P decision resolution which is easier to game then purely server side. Then also the gaming industry has been downsizing and automating moderation for years now which means typically the companies with the largest online presence (looking at you ActiBlizzard) don't have enough actual moderators to handle reports and they resort to leaning more heavily on these grey area technologies to catch cheaters. It's fundamentally an issue with expense cutting imo.

There are other ways to attack cheating. Besides, trusting a remote system you don't control is a case study in Security Failures 101. It's about as likely to work in the long term as typical DRM schemes: it does create a barrier, and it will deter casual violation by most people for as long as that barrier holds, but if there's enough incentive then sooner or later someone who knows what they're doing will break the barrier, and then they might share that ability with everyone else anyway.

Reply on news.ycombinator.com