Hacker News new | past | comments | ask | show | jobs | submit
After the crowdstrike disaster 3rd party kernel drivers need to be shunned for non critical applications.

Games publishers have been bad actors in this space for a long time now. The genshin impact anticheat was used in a malware campaign. Rockstar was very misleading trying to imply their kernel driver not being compatible with the steam deck was valves fault.

Lets call them what they really are, rootkits.
That's exactly what I tell my friends.

I can't play certain games, because they don't run on Linux and even if they did, I am not gonna install a rootkit to run them.

Getting a Steam Deck has done wonders for my piece of mind. I don't need to worry if whatever games I'm installing are malicious, because the machine is airgapped from anything critical.
Same, but I am only using it for couch gaming
piece of mind? or peace of mind?

/nitpick ;-)

OP shares with others
Ultimately, this is why we have consoles. We can have rootkits, or we can have cheating. Nobody has solved cheat prevention without rootkits. If you can, you’d make millions, if not billions. It’s not like the game creators want to have software on your system that has the potential to brick your system.
The real solution is games designed for playing with friends and treat all non-friend players as potentially malicious.

Early first-person shooter games had this figured out (small servers with 20-30 regular players, the server admin could choose to ban you), RTS games have this figured out, many MMOs have this figured out (interact with non-friends sometimes, but they have to 'join your party', etc.)

Playing with random strangers on the internet who may want to grief/destroy your game, be incredibly toxic, or cheat against you in general.. that's the cost of playing with random people in a completely public forum.

But people largely want matchmaking. They don't want to deal with having to find a server of like-minded players, they want to hop in a lobby with maybe a few friends, pick a map pool, and go.
> Ultimately, this is why we have consoles.

Nah. Consoles were a decade late to the online gaming party, and online gaming on consoles (counting Xbox Live as the first concerted attempt) has only been around half as long as consoles as a product segment have existed.

Running games in a VM appliance or an immutable container type of environment could be neat. Or some kind of hardware device. Like a console on an expansion card that could enable a secure environment while still letting you use your hardware.
This is a false dichotomy. Genshin is single player. Some people play multiplayer only with friends. The only legit use for anti-cheat is competitive multiplayer with strangers.
By this logic wouldn't chess and go need to be played after cavity searches? Cheating is enabled by tech but based on what people decide to do.
Not sure if you're referencing it but there was a recent scandal where it was suspected someone playing against Magnus might have had a wireless butt plug to enable some cheating...

The sibling comment makes a point about anonymity, I find these discussions interesting in comparison with the only online competitive game I play these days. It's Tekken, and neither the current rendition nor the previous one had any real form of anti-cheat. For the current Tekken 8, supposedly some players have been banned after manual review from the company of replay data, which of course doesn't scale. But at the same time it doesn't really matter. Cheaters don't seem to be that prevalent, their ability to spoil the experience of a match is limited by the fact that matches are short, and people can spoil the experience in non-cheating ways like plugging, lag switching, using a weak computer, and for some sensitive players they'll get unreasonably upset by ki charging/teabagging/taunting/continuing an attack after KO. The status of the highest rank is also not that much -- the most status comes from performing well at the big in-person tournaments, where it's going to be harder to cheat and players are somewhat de-anonymized. If the positive incentives to cheat are minimized in the first place, you don't need so many negative incentives like rootkits.

(It always amazes me how custom controllers and even keyboards are allowed in fighting game tournaments, officially certain macros are banned and at least for Street Fighter certain modes of leverless controllers got banned, but it'd be hard to perfectly enforce. And it's been hilarious to see the increasing use of fake buttons or controller-hiding covers/jackets because it was assumed some players were able to see inputs out of their peripheral vision before they were registered in-game and adjust.)

Chess and go aren't anonymous at levels people care about, and they don't have game publishers and creators expecting a return on investment.
Hmm, here’s a thought I’ve never had (but might be obvious to others).

Could I run windows as a VM guest under Linux and play Fortnite in that (with good GPU performance)? I don’t mind their rootkit running on some dedicated VM - I’ll just consider it my Fortnite unikernel.

(I’m also ok with the host OS being Windows or MacOS).

The anti-cheat will be very unhappy when it performs a bunch of arcane heuristics and determines it’s running in a VM.
Why would that matter? Pretty sure running in a VM doesn't facilitate cheating.
Running a VM gives the parent the ability to read/write arbitrary memory without [even rootkit] anticheat being able to detect, which can facilitate cheating, and therefore can earn you bans. The whole point of the rootkit is that the game can confirm that you don’t have any way to read/write arbitrary memory.
Isn't Windows running under a hyper-v hypervisor these days anyway?

In practice, I'd settle for a peer Windows OS, like the WSL2 kernel, with the rootkit seperate from my main work one. Can I run two copies of Windows simultaneously as peers?

{"deleted":true,"id":42002843,"parent":42002772,"time":1730341665,"type":"comment"}
Yes. https://wiki.archlinux.org/title/PCI_passthrough_via_OVMF

You basically let your guest OS use your GPU instead of the host.

And yet you install driver on Linux without knowing it, I mean Linux has 0 security for drivers.
When was the last time you had to install a Linux driver from out of tree?
Most people do install Nvidia’s out‐of‐tree graphics driver. It is definitely a risk.
If you've already put a piece of hardware into your computer made by nvidia, installing a kernel driver also made by nvidia does not increase your risk at all.

Installing some random anti-cheat kernel driver is not the same thing, at all.

But you are not installing a random anti-cheat kernel driver, you're installing anti-cheat kernel driver provided by a game you've already put on your computer. It's very much the same thing.
User space is not the same as kernel space.

User space applications can't access hardware or physical memory. They can't bypass permissions enforced by the OS. None of that applies to hardware or kernel drivers.

I've always appreciated the forthrightness League of Legends deployed here (talking about introducing a kernel driver for anti-cheat: https://www.leagueoflegends.com/en-au/news/dev/dev-null-anti...):

> This isn’t giving us any surveillance capability we didn’t already have. If we cared about grandma’s secret recipe for the perfect Christmas casserole, we’d find no issue in obtaining it strictly from user-mode and then selling it to The Food Network. The purpose of this upgrade is to monitor system state for integrity (so we can trust our data) and to make it harder for cheaters to tamper with our games (so you can’t blame aimbots for personal failure).

Where did I say they are the same? We have a kernel-space thing (anti-cheat or gpu driver) and a user-space thing ((a game actually talks to both) that talks to a kernel-space thing.
I understood that you were making an analogy between installing a piece of hardware and its associated kernel driver with installing a game and its associated kernel anticheat.

When you install a hardware device you are trusting the manufacturer with full access to your machine, so installing a driver does not give them any more powers. You have already "unlocked the door".

When you install a game that runs on user space you are not trusting the vendor nearly as much as you are trusting a hardware manufacturer. Installing a kernel anti cheat is granting them a level of trust and access to your machine that they didn't have before.

loading story #42008824
> Most people do install Nvidia’s out‐of‐tree graphics driver

Most people that use Nvidia. I specifically don't buy Nvidia graphics cards or laptops that use them in my Linux computers because they're not in-tree.

I am not using Nvidia since 2011. Last nvidia device was bought in 2007.

Back then I migrated to Archlinux and in all these years I only had problems with nvidia. Since then they are dead to me :)

A few things to consider here:

- This is an abnormal case. Most hardware will work with in-tree drivers. Indeed, few vendors provide out-of-tree drivers for Linux.

- Nvidia is an established and reputable source. We aren't talking about some small hardware developer who doesn't have the resources to create secure drivers.

- Most Nvidia cards have in-tree drivers. There is a loss in performance, but the option usually exists.

Those who do, choose to do so and generally take responsibility for their actions. It's not the same as tainting a kernel and just winging it.
It's a risk, but a very minor additional one - if you trust their hardware with direct access to your PCIe bus, you have already given them the metaphorical keys to the vault.
Approximately no one with a Steam Deck installs Nvidia's out of tree graphics driver (because the Steam Deck is built on AMD).
You gotta think about surface area and risk when comparing apples to oranges here.
This, so much this. Also often spyware.
And in the case of Vanguard, a bootkit.
Can't wait to find out what China hid in Riot's Vanguard rootkit for all their games. It's 100% a conspiracy theory, but nobody can convince me it's perfectly clean, or if it is, that there isn't an easy way to add some power to it quietly.
China's national security assistance law came up in the TikTok hearings. There's no reason to believe that the CCP doesn't have the legal authority to compel Riot to push an update with a backdoor to a few select high value targets.
loading story #42000408
If it is written in C you can always introduce a buffer overflow or something similar by just adding a little bit of line noise here or there and nobody can prove it was deliberate.
loading story #42000568
The vanguard drivers are signed by Microsoft, the procedure for which includes a safety audit by Microsoft.

The driver is just what the developers say it is (as with all other anti-cheat). It provides an untempered interface for the userland anti-cheat to use to get info from the kernel. Because modern cheats tend to alter the output of kernel syscalls by running in the kernel themselves.

I really don't see why anyone needs to think it's anything more than that.

If Tencent needed to spy on you so badly there's no reason kernel anti-cheats need anything to do with it...

loading story #42002171
loading story #42007817
loading story #42003631
loading story #42002849
loading story #42007935
loading story #42003277
{"deleted":true,"id":42000400,"parent":42000036,"time":1730322878,"type":"comment"}
If I wanted to deploy a trojan horse then the last place I would try to hide it is in an anti-cheat driver that will without any doubt be exhaustively analysed by people attempting to bypass it.
loading story #42000177
loading story #42000091
I mean, they're not rootkits. Rootkits are either to gain root access (thus the name) or to hide something from a user. Anticheats don't do either of these.

They expose a kernel API to allow games to verify the state of the system, and they're knowingly installed by the user.

> They expose a kernel API to allow games to verify the state of the system

And that API has root access... thus it's a rootkit.

loading story #42000909
The thing is the Kernel does not have that API.

The real solution, and not the hack Riot uses, is for Kernel to provide an API for anticheats, like it does for everything useland.

loading story #42002909
> They expose a kernel API to allow games to verify the state of the system, and they're knowingly installed by the user.

Can you give examples of games where you do that?

loading story #42000544
> The genshin impact anticheat was used in a malware campaign. Rockstar was very misleading trying to imply their kernel driver not being compatible with the steam deck was valves fault.

I mean, nothing of this is new. ESEA, one of the most influential esports leagues, was caught using its anticheat to mine Bitcoin in 2013. [1] This is long out of control, probably since the days BattlEye switched to ring0 in 2012 due to chronic cheating in the DayZ mod, or maybe earlier. Modern anticheats are full-fledged rootkits with extremely complex and targeted payloads siphoning customer data and hijacking all sorts of stuff, and that's not a theory, they actively abuse players' trust and indifference.

If you care about your data and the control of your devices, you should probably avoid them entirely, or at least use them on dedicated gaming PCs on a clean identity, and keep them separate from your LAN and your non-gaming digital life.

[1] https://play.esea.net/forums/492102

loading story #42001521
Crowdstrike isn't even the worst case. The SolarWinds disaster is the worst case scenario.

You have a closed source rootkit designed for finding data in raw memory (like passwords from an unlocked password manager), loaded into many gamer's machines, which many software engineers are. Some anti cheat explicitly support's arbitrary remote code execution by design. Many people mix their personal password vaults with their company's, which means that if you successfully hack an anticheat company and you can read the raw memory of an opened password manager with a program that is already designed to scan all processes memory, you now potentially have extremely valuable credentials. A small portion will even do things like add their 2fac keys into their vaults.

Here is Gabe Newell's thoughts on AntiCheat that are very relevant to this thread: https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...

Of course the other problem is the 23andMe problem and enshitification. Even if the data uploaded by anti-cheat isn't used right now, the storage of data alone creates incentive for abuse.

loading story #42002265
I just want to spam skill shot with ranged-heros on Aram 1-2 times a week. No way I am running vanguard for that!!!!
{"deleted":true,"id":42003098,"parent":41999692,"time":1730344106,"type":"comment"}
Cheats and bots are ruining online games though.
Back when communities hosted servers instead of companies, it seemed less common, even though it was easier to do.
loading story #42001804
loading story #42001689
loading story #42000733
loading story #42003036
loading story #42000966
And Kernel level anti-cheat isn't stopping them.
Perhaps, but it's far better to have cheaters and bots than to have games require a rootkit to play them.
I think that's a matter of opinion.

Personally I find both unacceptable: I won't play a game that requires me to install a rootkit, and I won't play a game where cheaters and bots run rampant, ruining the fun for everyone.

So hopefully there's a solution to this that doesn't require a rootkit.

You definitely don't play games, this is one of the reasons why people stop playing games.
I do play games, a lot. I even play multiplayer games. So, you're wrong.
Well no, because they ruin the online experience making people not play the game.

(in theory, GTA online has had / still has huge problems with bots and cheats but still earns the publisher hundreds of millions a year)

They have problems because they're cheap and don't want to pay to host servers. They don't want to let people host their own authoritative server either because of the $billions in fake money.
I understand that cheaters suck. I'm saying that in this case, the cure (kernel access) is worse than the disease.
This is why I preferred console gaming. You never encountered cheaters until very late in the console's generation. Crossplay ruined that.
Yeah life sucks when everything and everyone has to be untrusted (applies not just video games).

The solution is to build trusted spaces again IMO.

For video games assume that each user is trusted by default. As soon as they violate that trust by cheating, they are banned permanently for that copy of the game. If they want to be trusted again they have to buy another copy of the game to get another license. Make it hard to become a member of a trusted community and easy to be kicked out of a trusted community for violating trust. This would eliminate the vast majority of cheating and bots because most gamers are kids and having to buy a fresh copy will hit hard. If they abuse it enough, make them jump through more hoops like ip bans and computer fingerprint bans.

loading story #42000625
loading story #42000512
loading story #42001019
What decides critical or non-critical.

One could argue that a game isn't critical but one could say it's critical to stop hackers.

If you were to take the stance that gaming isn't critical than with that logic you're then claiming multiplayer hacking is a feature of the game.

Doesn't do well for the community or the company. But nor do the rootkits do good for the consumer.

If they worked to any acceptable level of efficacy then they could be tolerated. They're only tolerated by people who think they work as well as they claim to work (security theater) but anyone who knows about the performance impacts and/or are tech-savvy enough to understand it is a rootkit and potential exploit (that would fully pwn your device) hates them.

Some cheats are getting rather sophisticated now. There's an ever-increasing number of Pi-devices where the cheating is done externally.

https://www.youtube.com/watch?v=QpvwjC1_Luo

https://www.youtube.com/watch?v=revk5r5vqxA

That's child's play. The vogue is PCIe devices that sniff draw calls, memory transfers and network activity on the bus.
They're also chosen by users when the game is filled with cheater. Counterstrike 2 is an example of this with players moving to FaceIT and ESEA (with kernel anti cheat) as the higher ranks of official competitive matchmaking are filled with cheaters.
loading story #42001079
Performance impact is overblown, it was proven that the lost of perf is marginal when implemented properly.
loading story #42002180
What is the name of the tool that he is using on the 2nd link you shared? You know for science.
It hasn't stopped hackers though.
To be fair it stopped hackers for a while. Many people said Valorant did not have cheaters.

But nowdays the Valorant community complains about hackers almost as the CS community.

loading story #42002190
at least they need to search more than the first cheat option on google.
Critical as in "my gpu is a paperweight without a driver".
GPU driver can technically be userland too.

Look at what Apple has done in recent years. kexts (kernel-level drivers) are basically all but unsupported today, and both DriverKit and IOKit are fully userland.

loading story #42000043
> one could say it's critical to stop hackers.

It's never critical to stop hackers in a videogame IMO. We need to stop being so damn serious about gaming.

I think you're framing this the wrong way.

Is it fun to be a non-cheater, and join a multi-player game where there are other players using software cheats that let them easily beat you every single time?

I'm pretty sure I would quickly stop playing that game, and demand the publisher refund my money. That's just not fun.

And that's just as a casual gamer. For people who compete and win prizes, endorsements, etc., the stakes are a bit higher.

I'm not saying kernel-level rootkits installed on everyone's machine is the answer, but letting people cheat isn't going to work either.

loading story #42002309
Rampant cheating will wreck competitive multiplayer games fast, so there are perspectives from which this critical.

(I’d still lean towards expecting game houses to find another way, kernel drivers are still client side trust mechanisms).

loading story #42000880
loading story #42001613
loading story #42001137
loading story #42000646