Kernel Anti-Cheat Is an Overreach

submitted by

https://nooneshappy.com/article/kernel-anti-cheat-is-an-overreach/

8
53
1

Log in to comment

Hot Top New Old

Yawn, yet another one of these articles by someone who has no idea what they are talking about. Thankfully they at least admit it in the very first sentence of their post.

Furthermore, it hasn’t stopped cheating. They largely moved to external hardware that bypasses kernel anti-cheat.

Daft argument. If the only way to cheat is to buy specialized hardware that costs several hundred, if not several thousand, dollars, then the anticheat is a resounding success – it has dramatically increased the barrier of entry to cheating. DMA cheats are not impossible to detect either, anticheats like Riot’s Vanguard sniff them out all the time.

Anyone who claims anticheats are useless or ineffective clearly has never played a competitive multiplayer game with an actually ineffective anticheat. Anticheats are unfortunately absolutely necessary for most competitive multiplayer games to be viable at all. If you don’t like them, then don’t play the kinds of games that need them.

 reply
-8

Yeah, while I don’t love kernel level AC, the argument that because it doesn’t stop cheating entirely it’s useless has always been so fucking shit. Barrier of entry is what matters, I don’t give a fuck if one in 100 games has a cheater, I do if it’s one in 5 (or worse which can easily happen when AC is complete garbage)

 reply
2

Also, the basic argument of this blogpost is idiotic. If you’re installing a ring 0 anticheat that means you’re running Windows, and guess what, that means your entire operating system is code you can’t audit. You’ll also be running possibly dozens of third party drivers with (essentially) ring 0 access that you also can’t audit, and most of those drivers are written far more shoddily than anticheats (which, by their very nature, have to pay extreme attention to security and safety, because otherwise cheaters will easily reverse engineer them making them useless).

 reply
1

Microkernels seem to be having a new wave of popularity recently (new microkernel based OSes being made, apple slowly turning XNU into a microkernel)

Windows uses a hybrid kernel, but that still means drivers have access to the entirety of kernel space

Microkernels are so much more secure (when done properly with IOMMU and everything)

However, kernel based anticheats won’t work with microkernels (since most microkernels aren’t modular)

 reply
2

Deleted by author

 reply
1

Comments in Privacy@programming.dev

[deleted]
edited

One thing we all agree with PirateSoftware about were his statements on this.

It isn’t necessary, it limits the games playerbase, and it doesn’t even prevent cheating very well. There are no case studies where kernal level anticheat prevented hackers and cheaters over other methods.

 reply
8

The Riot tech blogs had some pretty graphs on this. Though they recently said that Windows security features have gotten good enough that their anti-cheat won’t need to run on boot anymore.

It’d be nice if it would run on Linux though.

 reply
3

TBF, several of these are not kernel-level, like EAC, BattlEye, and Denuvo AC. They still suck and are security issues.

 reply
1
Insert image