6 ms·
Genshin Impact is a recent game that has included a kernel mode anti-cheat. I would be very surprised if the majority of players know that it exists, or underst
by fuyu 5y ago
Genshin Impact is a recent game that has included a kernel mode anti-cheat. I would be very surprised if the majority of players know that it exists, or understand what it means to have it run in kernel mode.
The Genshin website previously allowed anyone to view the phone number you have linked to your account via the password reset mechanism. Due to common reports of accounts getting stolen (and unable to be recovered), two factor auth has been highly requested, but doesn't seem to be a priority. I'm skeptical that they strongly care about the security of their users.
Even if Genshins anti-cheat is completely secure, as kernel anti-cheat becomes more common it's inevitable that we will get an instance that is full of security holes. Unfortunately as long as the user can't play their favorite game without it, they will happily install it.
- invokestatic 5y agoI’m an anti cheat dev and I think client-side anti cheats make no sense on a typical MMO. Pretty much all cheats for those types of games can be detected server-side. RuneScape is a great example of this.
- oxylibrium 5y agoGenshin Impact's anti-cheat is not completely secure: you can use it to read/write umode memory / read kmode memory with kernel privileges: https://github.com/ScHaTTeNLiLiE/libmhyprot https://github.com/ScHaTTeNLiLiE/libmhyprot Mirror repo after the original author took the repo down, but still exploitable AFAIK.
- matheusmoreira 5y agoExplanation of the exploit here: https://github.com/Luohuayu/evil-mhyprot-cli https://github.com/Luohuayu/evil-mhyprot-cli Not as bad as capcom.sys: https://mobile.twitter.com/TheWack0lian/status/779397840762245124 https://mobile.twitter.com/TheWack0lian/status/7793978407622... The effect is the same though: ring 0 code execution.
- charcircuit 5y agoEven if the security is bad does it even matter? User mode is enough for malware. "Sure an attacker could mine crypto, DoS people, use me as a proxy, keylog me, use my webcam, steal my saved usernames and passwords, but at least they can't upgrade my graphics drivers", said no one ever.
- oxylibrium 5y agoOh, there's a lot more "fun" stuff you can do in kernel mode. One comedic example is setting the CPU Vcore offset to +2.2V for fun/revenge. I don't know if it will destroy CPUs permanently, but it would be an interesting experiment. More importantly though, once you're in the kernel, its much easier to hide your presence to all manner of Windows sysadmin tools.