Hacking into Kernel Anti-Cheats: How cheaters bypass Faceit, ESEA and Vanguard anti-cheats
Hacking into Kernel Anti-Cheats: How cheaters bypass Faceit, ESEA and Vanguard anti-cheats
You're viewing a single thread.
Much like using a condom, the point isn't a protection scheme that's impossible to fail.
Valorant is the first FPS I've played where, after two years, I've never encountered a cheater. They're there, you can find some clips... Until they're banned. They're rare. Counter Strike, Call of Duty, Titanfall, you name it, I would encounter cheaters with a much higher frequency.
So while Vanguard can be bypassed... I don't worry about cheaters on Valorant, they're rare and the cheats are expensive and annoying to use. Vanguard did its job.
You don't mind giving up your privacy and system security to a company for a single game?
How is it giving up your privacy and security?
It's a rootkit. When it runs it basically has complete access to your system. You're at the mercy of the guys at Riot and pray that no one breaches their system.
IIRC Genshin Impact uses a similar system and a breach has already happened.
It's a driver.
Here the attacker installed the driver after gaining remote access.
So it's not actually anything to do with having the game installed.
But it's still a massive problem.
You're missing the point of what he is saying. The anti-cheat itself runs in a level with extreme access to anything on your computer. The anti-cheat is like almost all software almost certainly exploitable. You are trusting that no one will ever crack Vanguard in a way that exposes your user data, and that Riot will never change it to collect more than you think they are.
Not even about user data, this is just the side dish. You have complete control over the system and spy on, and probably even can do, whatever
You're 100% right. Not only can they steal data, but they could use kernel level access to make your hardware misbehave, perhaps even to the point of damage. They could probably trash a hard disk or GPU for instance. It also gives them a locally controlled device on whatever network you're on. From there they can weaponise their new access to attack other devices on the network, or cause the network itself to fail.
It just goes to show how dangerous this is, that even a programmer and security enthusiast like myself forgets to mention a huge chunk of the possible damages.
It's kernel-level control of your system, basically rootkit malware that you choose to infect your computer with. Keep in mind, it's always running, whether you're playing a game or not! By definition, it literally has more control of your system than you do signed in with your own private password. Ask yourself this: if the anti-cheat was compromised, sold, re-prioritized, bypassed by hackers or foreign interests, etc... How would you even know?
I understand that all this sounds paranoid, but remember that you chose to give it system-wide access! I likely hate online cheaters at least as much as you, but the potential security/privacy implications are far too great, not to mention the performance hit every single game with kernel-level anti-cheat suffers...
Keep in mind, it's always running, whether you're playing a game or not!
Not necessarily. You can close the software. You'll need to restart your computer before launching Valorant, but it absolutely does not need to be running while you aren't playing.
Otherwise known as a driver hehe
But they're all valid points.
This isn't really different from most software on your system. I can exfiltrate plenty of your data on Windows without root. And are you reviewing the source code of every application you run?
It's a problem when Riot does it, but not Nvidia?
privacy and system security
The burden of proof is on the accuser. Show Vanguard doing something shady and I might care. Keep complaining because "it could if it wanted to" and I won't entertain conspiracy theories.
I'm not making an accusation, it's kernel-level access. If I know where you live, have keys to your house, know your security code, can change anything in your home without you knowing, that's a problem.
Why are you so dead-set on defending a company's bad practices just because you like their game?
I'm dead set on playing online games without cheaters. If Vanguard worked on Linux, half of this community wouldn't care and wouldn't rely on a fallacy of assuming it will be turned into malware.
As for kernel level access to the machine... Oh no, just like the third party driver I had to install on Linux to use my Xbox adapter? Crazy! That must be malware!
Yup, so you don't care. Lmao you literally gave away the key to your house for an uninteresting video game. Pitiful.
Ah yes, Riot is desperate for your nudes. They'll pretend to be a gaming company with international tournaments for years, but in the end you'll be correct and I'll be wrong and they'll use Vanguard to... Steal my cat memes, turn on my webcam and hack into my local library and warn them I'm late to return some books. The tragedy.
Some of us wouldn't proudly admit to doing nothing with their time, but here we are.
I've got important stuff on my personal machine, and it's the principal of the thing, besides. Good luck to you, I suppose.
Fuck you
If Vanguard keeps somebody only capable of replying with "Fuck you" out of the game, that's actually fantastic - it's an anticheat and antiweirdo software. I hope they expand it to more games.
I hope they use your PC as a botnet and steal your bank account some day when China has enough of us.
@kadu @RubberElectrons It seems you don't understand how independent opinions in a democracy are made. It's about privacy and the right for it. No company has the right to snuff in my life and collect private data. Everyone has secrets.
@kadu @RubberElectrons It doesn't have to be the company itself.
Imagine the unimaginable scenario where a group of hackers gains access to the company's network and servers and plants a malicious patch to be sent in the next update.
I wouldn't be afraid of the company exploiting this. I would be afraid that a bug or hacker can do whatever with my computer because I gave this software root access, and it gets remotely updated, has network access and can become an amazing tool in the wrong hands.Imagine the unimaginable scenario where a group of hackers gains access to the company’s network and servers and plants a malicious patch to be sent in the next update.
Then don't use computers, there have been multiple full root access zero days on Linux, Windows, Mac, Android and iOS in 2023 alone.
@kadu Duh, but leaving my front door open is really unnecessary.
I mean you do you. Thankfully I don't care :D
Permanently Deleted
You're definitely not getting through to paranoid lemmy users lol
I'm dead set on playing online games without cheaters.
Then you should've stopped playing when you encountered the first cheater. The one that you knew was a cheater, at least.
Things like this create false sense of safety where you assume the game has less cheaters but in reality you can hardly tell.
Xbox should be plug an play. Everythig is open and viewable so you can see the malware if there is any.
Otherwise show me the driver to prove me wrong.
Not only can it be bypassed, but anti cheat with kernel level access can be used to distribute malware or spyware if it is compromised. Whether your personal anecdotes reflect the actual statistics or not, these anti cheats are dangerous and are not impenetrable.
Do you have any sources on this happening? Or is it a personal anecdote hehe
There was a security vulnerabilitiy in the genshin impact anti cheat awhile ago.
That's exactly the sort of source I was asking for
Edit: the driver file was used after gaining access to the pc. So quite an involved attack but still really bad.
Edit 2: so actually it's nothing to do with having it installed. As the attacker installed it.
Yes it requires access to the pc but it's still a huge vulnerability. Many things can gain access to your pc but lack the permissions to do any damage. In this case simply having genshin impact installed put you at significantly more risk.
To your 2nd edit yes it is to do with it being installed. The user or the attack installing the anticheat is still the anticheat being used to exploit.
Permanently Deleted
It was already done through genshin impact anti cheat. It will be done in Vangard.
With that the attacker installed that driver after gaining access. So having the driver installed wasn't the issue.
What do you think 'gaining access' entailed?
Nothing to do with the game.
As mentioned, cheaters can already bypass it, so what's the point? As for security, by definition it infects your whole system and has access to everything. That's what kernel-level is.
By definition a driver is not an infection.
Actually, a driver can be an infection, just like any other program can be malicious. But I do agree that from a system access standpoint, running the Vanguard kernel driver is not much different than using kernel-level EAC/BattleEye. Except the annoying starting at boot part.
A program without elevated privileges already has access to almost all important things on your computer anyway. Luckily flatpak supports sandboxing which protects from exploits in online games.
"my aunt used a seat belt and died in a crash anyway! So what's the point?"
Seems like a bad faith argument, seat belts are so that your skull (hopefully) doesn't detach and fly through the window if you get into an accident - a life and death safety measure. It's way more dramatic to make a fuss about that. However, in both cases you can choose to just not drive (or play the game) which people are choosing to do.
Then again, none of your comments here seem like they're in good faith, so I guess I shouldn't be surprised.
Cars are actually a great analogy here but probably not in the way that user intended. The way we use them and the scale at which we use them are inherently unsafe, but seat belts and air bags are an illusion sold to make us believe that we solved the problem as best we can, even though we didn't.
seat belts and air bags are an illusion sold to make us believe that we solved the problem as best we can, even though we didn’t
As someone who has been in a few accidents (both as driver and as passenger), seatbelts saves lives. I wouldn't be here typing this if they didn't.
Having seat belts is objectively better than not having seat belts. It doesn't mean that the way transportation is structured around cars in the US, for instance, is safe enough. Having kernel level anti-cheat may result in fewer cheaters or less obvious cheaters, but it doesn't mean it's worth giving that company such deep access to your computer, as the video shows.
Yes, agreed
More like my aunt pointed a loaded gun at the back of her seatrest and it went off when she hit the brakes too hard
Cool beans. I'll play ranked matches without cheaters, thanks.
Isn't the whole point of this article to point out that no, in fact, you won't ?
Less volume perhaps, certainly less obvious, but not "without".
Honestly a few cheaters in a game is way less of a problem than letting a company, especially one owned by tencent, have root access to my pc. Anyway in my experience with league the cheaters are either mostly nonexistent or subtle enough that it doesn't impact the games. Also nobody in here's going to have a rank that's actually important and I don't see why they can't have the fun anticheat in tournaments and ranked but leave it out of the other things.
Man if the only way to break the condom was with the expensive DMA cheat and shit like that I could agree with your logic but a $10 arduino and 2min google search is enough.
My sweet summer child, I will see you in 5 years when Valorant cheating is as bad as CS:GO cheating at its peak.
Kernel AC circumventation will only improve, as there's many cheaters putting money in this technology. In 5 years this stuff will be commonplace and mean that these solutions will be ineffective.
Been hearing that since day 1 on Valorant, years in and that's not the case. But sure bud, in five years if I'm wrong feel free to come to this post and reply.