5 ms·

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti

Anti-cheat drivers have indeed turned out to be major security risks on Windows. But I think the blame should not be on game developers because kernel-mode anti-cheat is still one of the only methods that’s reasonably effective — and realistically, you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If Microsoft wants Windows to be more stable and secure, they should provide built-in anti-cheat support in the OS. That would reduce the need for third-party kernel drivers in the first place.

hsbauauvhabzb 7mo ago
If a surgeon does not have the expertise to perform a surgery, they probably shouldn’t cut into you. If the company lacks the competency to write secure driers, they should outsource the work or have it validated externally. These things could be solved by spending money. Stop excusing dangerous actions performed in the name of greed.
- supersing 7mo ago
  It is not realistic to expect every game developer to invest a lot of money into security. It's like asking every apartment building to run its own fire department. The responsibility of securing a platform should not fall on application developers anyway.
  - ronsor 7mo ago
    The problem is that general purpose computing platforms are not supposed to be secured against the user. That's a WONTFIX.
    - direwolf20 7mo ago
      User ownership of their devices has been fixed on every platform except PCs.
      - hsbauauvhabzb 7mo ago
        And most other device types have a specific purpose, with the exception of mobile phones which were built from the ground up with device control in mind, mobile devices only really support one operating system barring edge case exceptions.
        direwolf20 7mo ago
        Because only one was written, but there's more than one because there's LineageOS — if you can bypass Secure Boot.
        hsbauauvhabzb 7mo ago
        That an edge case. Linage works on a subset of devices. Find me an amd64 computer that doesn’t support Linux. I think you’d agree that it would be far easier to technically and socially lock mobile devices to signed deployments only, with jailbreaks becoming rarer and more valuable over time, than to do the same with desktop and laptop computers, due to their requirement to support many different functional requirements (PcIe, thunderbolt peripherals, distributed compute, etc). I’m not saying I like this, but I think phones will become a single viable OS and locked down ecosystem in the next 5 years. Desktops will follow, but not at the same rate.
  - hsbauauvhabzb 7mo ago
    It’s not the nurses job to perform surgery either, that’s why they don’t.
  - pjmlp 7mo ago
    Yes it is, and liability across the industry is already late. By the way, in some countries apartment buildings need several licenses, including one from fire department, before been allowed to have people living on them.
  - RobotToaster 7mo ago
    Microsoft could easily secure windows by blocking all rootkits/"kernel anti cheat". At this point that's probably the best option. Games should never have kernel level access.
    - hsbauauvhabzb 7mo ago
      Games are a multi billion dollar industry that Microsoft has a stake in. A better option would be a ‘games mode’ and a ‘secure mode’.
- charcircuit 7mo ago
  Exactly, which is why Microsoft should be writing the one writing the kernel code needed for ensuring integrity of games. Microsoft needs to develop ways to allow games to run in an isolated VM that is hardware protected from the main operating system and ensures strong hardware security so cheaters can not simply attach malicious devices to the PCI bus to DMA sensitive data.
  - 15155 7mo ago
    > attach malicious devices to the PCI bus to DMA sensitive data How do you do this in modern system with TPMs and IOMMU enabled?
    - charcircuit 7mo ago
      Sadly not all Windows machines are able to use kernel DMA protection, so for those machines nothing will stop you.
      - 15155 7mo ago
        The obvious next step is to disallow those elderly machines once a critical mass of users have modern-enough equipment. We're almost there.
    - direwolf20 7mo ago
      You pretend to be a device with a driver not compatible with IOMMU
      - 15155 7mo ago
        This is a good move, but why isn't the anti-cheat software just refusing to operate on systems with these devices attached?
        direwolf20 7mo ago
        Because banning players from playing your game leads to refunds and bad publicity
bri3d 7mo ago
> you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If someone wants to sell something that comes with a driver, the driver needs a modicum of care applied to it. This is of course also on Microsoft for signing these things, although that ship sailed ages ago. Yes, I wouldn't expect every studio to need their own team - game studios can buy anti-cheat middleware, and the middleware can compete on not being total junk (which is how the industry already works, with a side helping of these more obscure awful drivers and a few big studios with their own). > If Microsoft wants Windows to be more stable and secure, they should provide built-in anti-cheat support in the OS. I guess they could have users approve a set of signed applications that would get some "authenticated" way to read address space and have an attestation stapled to it? It's actually kind of an interesting idea. The hardest part here would be that each anti-cheat tries to differentiate with some Weird Trick or another, so homogenizing the process probably isn't appealing to game developers really. Anti-cheat could go the opposite direction, with basically a "fast reboot" into an attested single process VM sandbox, but this has issues with streaming/overlays and task switching which are a bit thorny. I've always thought that this might be the way to go, though - instead of trying to use all kinds of goofy heuristics and scanning to determine whether the game's address space has been tampered with or there's a certain PCIe driver indicating a malicious DMA device or whatever, just run the game in a separate hypervisor partition with a stripped down kernel+OS, IOMMU-protected memory, and no ability to load any other user code, like a game console lite.
- whs 7mo ago
  I think we ended up in this situation because of this outsourcing. Competitive games and MMO need comprehensive security solution, as cheating has a global lasting impact in matchmaking. Attackers may also have financial motivation to attack the anti cheat in these games. Coop games might don't need as much security as competitive games, as some games do not have global state, or the global state is simply cosmetics. Since nowadays all the anticheat you can buy (except VAC) are kernel mode you'll have to accept the security risk just to have fun with your friends.
b1temy 7mo ago
> they should provide built-in anti-cheat support in the OS. As much as I dislike anti-cheat in general (why incorporate it instead of just having proper moderation and/or private servers? Do you need a sketchy third-party kernel level driver to police you to make sure you're "browsing the internet properly in a way that is compliant with company XYZ's policies", or even when running other software like a photo editor, word processor, or anything else? It's _your_ software that you bought.) something similar is already happening with, e.g, Widevine bundled in browsers for DRM-ed video streaming. I agree that having some first-party or reputable anti-cheat driver or system, is probably preferable than having different studios roll out their own anticheat drivers. (I am aware there are studio-level or common third party common anti-cheat solutions already, such as Denuvo or Vanguard. But I would prefer something better)
- ronsor 7mo ago
  > I agree that having some first-party or reputable anti-cheat driver or system, is probably preferable than having different studios roll out their own anticheat drivers. (I am aware there are studio-level or common third party common anti-cheat solutions already, such as Denuvo or Vanguard. But I would prefer something better) Only Apple really has enough platform lockdown to achieve that. Whatever Microsoft ships would have more holes than swiss cheese (not that I'm opposed to that or anything).
  - 15155 7mo ago
    > Whatever Microsoft ships would have more holes than swiss cheese The current execution environment with IOMMU and TPM requirements is changing this rapidly. Try disabling Windows Defender - good luck.
    - direwolf20 7mo ago
      This is done for the benefit of Hollywood.
- stackghost 7mo ago
  >why incorporate it instead of just having proper moderation and/or private servers? Because game studios these days are all about global matchmaking. Private servers aren't really a thing any more except in more niche games. Instead you (optionally with a party) queue for matchmaking. Every game has to have a ranked ladder these days, it seems. I miss the days of Tribes 2 or CS1.6 when games had server browsers
pjmlp 7mo ago
They do, on XBox OS, which while based on Windows, it isn't exactly the same. As for plain Windows, lets see how Crowdstrike changes will reflect on anti-cheats. https://www.theverge.com/news/692637/microsoft-windows-kernel-antivirus-changes https://www.theverge.com/news/692637/microsoft-windows-kerne... People could also behave, and then no anti-cheats would be needed anywhere, but that is utopia.
realusername 7mo ago
This is a lost battle, you have cheaters on console which are more locked down than PC ever will be. You can't remove cheating with software. Sorry game companies, the answer is paid moderation, I know it cost money and I know you don't like to pay but there's no way around it.
- direwolf20 7mo ago
  Or small–group servers. You cheat on the internet because you're a nobody. You don't cheat with your friends because your friends will disown you.
direwolf20 7mo ago
What does built–in anticheat support looks like to you? A whitelist of apps you can run? Debuggers not being allowed?

hsbauauvhabzb 7mo ago

If a surgeon does not have the expertise to perform a surgery, they probably shouldn’t cut into you. If the company lacks the competency to write secure driers, they should outsource the work or have it validated externally. These things could be solved by spending money. Stop excusing dangerous actions performed in the name of greed.

supersing 7mo ago
It is not realistic to expect every game developer to invest a lot of money into security. It's like asking every apartment building to run its own fire department. The responsibility of securing a platform should not fall on application developers anyway.
- ronsor 7mo ago
  The problem is that general purpose computing platforms are not supposed to be secured against the user. That's a WONTFIX.
  - direwolf20 7mo ago
    User ownership of their devices has been fixed on every platform except PCs.
    - hsbauauvhabzb 7mo ago
      And most other device types have a specific purpose, with the exception of mobile phones which were built from the ground up with device control in mind, mobile devices only really support one operating system barring edge case exceptions.
      - direwolf20 7mo ago
        Because only one was written, but there's more than one because there's LineageOS — if you can bypass Secure Boot.
        hsbauauvhabzb 7mo ago
        That an edge case. Linage works on a subset of devices. Find me an amd64 computer that doesn’t support Linux. I think you’d agree that it would be far easier to technically and socially lock mobile devices to signed deployments only, with jailbreaks becoming rarer and more valuable over time, than to do the same with desktop and laptop computers, due to their requirement to support many different functional requirements (PcIe, thunderbolt peripherals, distributed compute, etc). I’m not saying I like this, but I think phones will become a single viable OS and locked down ecosystem in the next 5 years. Desktops will follow, but not at the same rate.
- hsbauauvhabzb 7mo ago
  It’s not the nurses job to perform surgery either, that’s why they don’t.
- pjmlp 7mo ago
  Yes it is, and liability across the industry is already late. By the way, in some countries apartment buildings need several licenses, including one from fire department, before been allowed to have people living on them.
- RobotToaster 7mo ago
  Microsoft could easily secure windows by blocking all rootkits/"kernel anti cheat". At this point that's probably the best option. Games should never have kernel level access.
  - hsbauauvhabzb 7mo ago
    Games are a multi billion dollar industry that Microsoft has a stake in. A better option would be a ‘games mode’ and a ‘secure mode’.
charcircuit 7mo ago
Exactly, which is why Microsoft should be writing the one writing the kernel code needed for ensuring integrity of games. Microsoft needs to develop ways to allow games to run in an isolated VM that is hardware protected from the main operating system and ensures strong hardware security so cheaters can not simply attach malicious devices to the PCI bus to DMA sensitive data.
- 15155 7mo ago
  > attach malicious devices to the PCI bus to DMA sensitive data How do you do this in modern system with TPMs and IOMMU enabled?
  - charcircuit 7mo ago
    Sadly not all Windows machines are able to use kernel DMA protection, so for those machines nothing will stop you.
    - 15155 7mo ago
      The obvious next step is to disallow those elderly machines once a critical mass of users have modern-enough equipment. We're almost there.
  - direwolf20 7mo ago
    You pretend to be a device with a driver not compatible with IOMMU
    - 15155 7mo ago
      This is a good move, but why isn't the anti-cheat software just refusing to operate on systems with these devices attached?
      - direwolf20 7mo ago
        Because banning players from playing your game leads to refunds and bad publicity

bri3d 7mo ago

> you can’t expect every game studio to have the expertise to write secure, reliable kernel drivers. If someone wants to sell something that comes with a driver, the driver needs a modicum of care applied to it. This is of course also on Microsoft for signing these things, although that ship sailed ages ago. Yes, I wouldn't expect every studio to need their own team - game studios can buy anti-cheat middleware, and the middleware can compete on not being total junk (which is how the industry already works, with a side helping of these more obscure awful drivers and a few big studios with their own). > If Microsoft wants Windows to be more stable and secure, they should provide built-in anti-cheat support in the OS. I guess they could have users approve a set of signed applications that would get some "authenticated" way to read address space and have an attestation stapled to it? It's actually kind of an interesting idea. The hardest part here would be that each anti-cheat tries to differentiate with some Weird Trick or another, so homogenizing the process probably isn't appealing to game developers really. Anti-cheat could go the opposite direction, with basically a "fast reboot" into an attested single process VM sandbox, but this has issues with streaming/overlays and task switching which are a bit thorny. I've always thought that this might be the way to go, though - instead of trying to use all kinds of goofy heuristics and scanning to determine whether the game's address space has been tampered with or there's a certain PCIe driver indicating a malicious DMA device or whatever, just run the game in a separate hypervisor partition with a stripped down kernel+OS, IOMMU-protected memory, and no ability to load any other user code, like a game console lite.

whs 7mo ago
I think we ended up in this situation because of this outsourcing. Competitive games and MMO need comprehensive security solution, as cheating has a global lasting impact in matchmaking. Attackers may also have financial motivation to attack the anti cheat in these games. Coop games might don't need as much security as competitive games, as some games do not have global state, or the global state is simply cosmetics. Since nowadays all the anticheat you can buy (except VAC) are kernel mode you'll have to accept the security risk just to have fun with your friends.

b1temy 7mo ago

> they should provide built-in anti-cheat support in the OS. As much as I dislike anti-cheat in general (why incorporate it instead of just having proper moderation and/or private servers? Do you need a sketchy third-party kernel level driver to police you to make sure you're "browsing the internet properly in a way that is compliant with company XYZ's policies", or even when running other software like a photo editor, word processor, or anything else? It's _your_ software that you bought.) something similar is already happening with, e.g, Widevine bundled in browsers for DRM-ed video streaming. I agree that having some first-party or reputable anti-cheat driver or system, is probably preferable than having different studios roll out their own anticheat drivers. (I am aware there are studio-level or common third party common anti-cheat solutions already, such as Denuvo or Vanguard. But I would prefer something better)

ronsor 7mo ago
> I agree that having some first-party or reputable anti-cheat driver or system, is probably preferable than having different studios roll out their own anticheat drivers. (I am aware there are studio-level or common third party common anti-cheat solutions already, such as Denuvo or Vanguard. But I would prefer something better) Only Apple really has enough platform lockdown to achieve that. Whatever Microsoft ships would have more holes than swiss cheese (not that I'm opposed to that or anything).
- 15155 7mo ago
  > Whatever Microsoft ships would have more holes than swiss cheese The current execution environment with IOMMU and TPM requirements is changing this rapidly. Try disabling Windows Defender - good luck.
  - direwolf20 7mo ago
    This is done for the benefit of Hollywood.
stackghost 7mo ago
>why incorporate it instead of just having proper moderation and/or private servers? Because game studios these days are all about global matchmaking. Private servers aren't really a thing any more except in more niche games. Instead you (optionally with a party) queue for matchmaking. Every game has to have a ranked ladder these days, it seems. I miss the days of Tribes 2 or CS1.6 when games had server browsers

pjmlp 7mo ago

They do, on XBox OS, which while based on Windows, it isn't exactly the same. As for plain Windows, lets see how Crowdstrike changes will reflect on anti-cheats. https://www.theverge.com/news/692637/microsoft-windows-kernel-antivirus-changes https://www.theverge.com/news/692637/microsoft-windows-kerne... People could also behave, and then no anti-cheats would be needed anywhere, but that is utopia.

realusername 7mo ago

This is a lost battle, you have cheaters on console which are more locked down than PC ever will be. You can't remove cheating with software. Sorry game companies, the answer is paid moderation, I know it cost money and I know you don't like to pay but there's no way around it.

direwolf20 7mo ago
Or small–group servers. You cheat on the internet because you're a nobody. You don't cheat with your friends because your friends will disown you.

direwolf20 7mo ago

What does built–in anticheat support looks like to you? A whitelist of apps you can run? Debuggers not being allowed?