Valorant's anti-cheat software loads kernel-based driver on system boot

Cal Jeffrey

Posts: 2,389   +553
Staff member

Riot Games' new team shooter Valorant has an anti-cheat system called "Vanguard" that has raised some security concerns. When the game launches, the Vanguard client loads with it into the userspace. However, there is a kernel-mode driver for the system that loads when you boot into Windows.

Riot claims that it needs this since some cheating software uses kernel-mode drivers to evade detection. Regular applications cannot detect kernel-mode drivers because of the higher privileges required.

Back in February, Riot explained the new anti-cheat software, initially designed for use in League of Legends, and why it was needed.

"In the last few years, cheat developers have started to leverage vulnerabilities or corrupt Windows' signing verification to run their applications (or portions of them) at the kernel level. The problem here arises from the fact that code executing in kernel-mode can hook the very system calls we would rely on to retrieve our data, modifying the results to appear legitimate in a way we might have difficulty detecting. We've even seen specialized hardware utilizing DMA1 to read and process system memory—a vector that, done perfectly, could be undetectable2 from user-mode."

Running a driver in kernel-mode raises concerns that Riot is only improving its cheat detection at the cost of increasing the attack surface of Windows, and at the root level no less. If you recall the 2005 Sony DRM rootkit fiasco, this level of risk might make you nervous.

Kernel-based drivers can also create system-wide stability issues that bring with them the dreaded BSOD (blue screen of death).

"Whenever you have a driver like that, you're at risk of introducing security and reliability issues to the computer," independent security researcher Saleem Rashid told Ars Technica. "You don't get as many exploit mitigations in device drivers as you do in normal applications, and a bug will crash the entire OS, not just the game."

Riot contends that it contracted three external security firms to audit the software before putting it into use. One of them even performed "black box" attacks against the system with no success. It also said that its Application Security team could detect and respond to any problems with Vanguard within hours.

Before freaking out too much about Riot's decision to use a kernel-based driver for cheat detection, bear in mind it is not the only developer to use this technique. Battleye, a popular third-party anti-cheat solution, describes itself as a "kernel-based protection system." Most notably, games like PUBG and Ark: Survival Evolved employ Battleye. Fortnite uses Easy Anti-Cheat, which also works in a similar way. So far, there have been no major security issues with these systems.

Users that feel such a system is a deal-breaker might want to take a pass on Valorant. Vanguard will soon be employed in League of Legends as well. Those who already play games like Fortnite and PUBG, which use similar, but separate mitigation methods, might be tempted to say, "What's one more?" But if you think of kernel-based drivers as analogous to the doors on your house, then you can see precisely what that implies.

Permalink to story.

 

m4a4

Posts: 1,805   +1,537
TechSpot Elite
Unless there's a good reason to avoid the software, I don't think I'll care (if I ever bother playing the game). People who are more paranoid will be keeping a close eye on the software lol

I'm pretty sure people hate cheaters enough to want the best protections against it anyways...
 

H3llion

Posts: 1,849   +540
Eh, you want to play the game you go by their rules.

I remember back in the day when Blizzard's Warden was introduced, it was controversial for it's local file scanning hashes and comparing them to common cheats. They still use it, and it's damn effective.
I've the opposite, apparently these days it's extremely out of date and not effective at all. But it's all hearsay.
 

ShagnWagn

Posts: 1,297   +1,081
"One of them even performed "black box" attacks against the system with no success"

They do this even before this came out. Security patches come out daily for stuff they have missed. How do they know 100% it is secure?

What keeps this company from reaching into your OS at any time with this? We can trust them, right? Kinda like how we can trust Nest?

I've never even heard of this game, but thanks for the heads up for another game to wave as my wallet drives by.
 

JohnSmithESP

Posts: 21   +7
Just for the meme:
Tencent intensifies

Apart from that, things like csgo's trust factor but done better will be the future (I hope), and it works quite well enough maybe so-so but when it does, it does
 

Evernessince

Posts: 5,081   +5,315
Eh, you want to play the game you go by their rules.

I remember back in the day when Blizzard's Warden was introduced, it was controversial for it's local file scanning hashes and comparing them to common cheats. They still use it, and it's damn effective.
Online you have no choice but for offline games, I see no reason why customers have to play by their rules for products they own. I can only hope that sometime soon customers will get basic rights to the digital items they own.
 

quadibloc

Posts: 165   +97
Apparently precautions are being taken to ensure this anti-cheat software doesn't pose a security risk. And other companies use similar software that may not have taken such careful precautions. So I'm not going to beat up on them.
However, I'm surprised that with virtualization you can't just put the anti-cheat software someplace where cheat software can still out-rank it. Obviously virtualization platform makers aren't doing their job!
 

Hexic

Posts: 708   +655
TechSpot Elite
Online you have no choice but for offline games, I see no reason why customers have to play by their rules for products they own. I can only hope that sometime soon customers will get basic rights to the digital items they own.
While I would agree, unfortunately the current landscape of paying for the honor of using the license to play the game holds true. Plus they can use the pretense of DRM and piracy to "prevent unlawful copying" as the inlet for any sort of advanced control.

Back in the 90s we had so many pirated games floating through the neighborhood because Craig on the couldesac had custom cracking software he wrote. Good times, good times...
 

wizardB

Posts: 173   +65
Apparently precautions are being taken to ensure this anti-cheat software doesn't pose a security risk. And other companies use similar software that may not have taken such careful precautions. So I'm not going to beat up on them.
However, I'm surprised that with virtualization you can't just put the anti-cheat software someplace where cheat software can still out-rank it. Obviously virtualization platform makers aren't doing their job!
Anything that uses a kernel driver is a security risk to your computer far worse than either scepter or meltdown
 

EClyde

Posts: 2,209   +866
There should be a game where if you don't cheat you can't play...well you could but you would lose
 

Theinsanegamer

Posts: 1,869   +2,193
There is already tons of cheaters in this game so its needed sadly.
So they should move to server side verification. Any behavior from a client that shows illogical movements or actions gets a ban. Or give us back the option of private servers that we can MAC ban any cheater we find.

This problem has already been fixed. There is no need for a massive security breach like this, especially as anyone who can develop hacks will also develop a way to disguise their hack from this driver, or abuse the driver to verify their hacks as official code.
 

BSim500

Posts: 673   +1,379
There have been reports of peoples PC slow downs because of this anti cheat. It is also a Chinese owned company.
^ Anyone who voluntarily installs "Chinese Sony Rootkit 2.0" needs their heads checked. Jesus, I remember the response to Sony Rootkit 1.0 (back when PC gamers actually had a backbone). I'd rather play older / single player titles or even one of the new consoles than see "happy rootkits" become normalized on PC and I find it a very sad reflection of the modern "PC Master Race" as to how many have lowered their standards completely into the gutter out of desperation of their next 'FPS fix'...
 

Burty117

Posts: 3,738   +1,601
I did not know Easy Anti-Cheat worked via a Kernel Driver. Explains why it actually works then. Or at least I seem to rarely come across cheaters in games using Easy Anti-Cheat.
 

Digitalzone

Posts: 127   +64
^ Anyone who voluntarily installs "Chinese Sony Rootkit 2.0" needs their heads checked. Jesus, I remember the response to Sony Rootkit 1.0 (back when PC gamers actually had a backbone). I'd rather play older / single player titles or even one of the new consoles than see "happy rootkits" become normalized on PC and I find it a very sad reflection of the modern "PC Master Race" as to how many have lowered their standards completely into the gutter out of desperation of their next 'FPS fix'...
LOL. PC Master Race is just bunch of kids playing games as their only self-realization and making it their ego-investment. Stop pretending they are anything more. It's just another bunch of consumers. Game industry would look differently if gamers stopped playing garbage.
 

Puiu

Posts: 3,903   +2,415
LOL. PC Master Race is just bunch of kids playing games as their only self-realization and making it their ego-investment. Stop pretending they are anything more. It's just another bunch of consumers. Game industry would look differently if gamers stopped playing garbage.
You are just jealous that your console can't do basic things that PCs can (alongside beautiful games with high refresh rates). Console peasants! :D
 

ZedRM

Posts: 339   +180
I kinda approve. I hate so much playing competitive games with cheaters. Literally takes all of the joy out of it.
I fully and completely disapprove. I hate online cheaters too, but this kind of thing goes too far. Not acceptable on any level. Then there is the following...
And yet... cheats already exist for Valorant :D
..Ta Daa!

Game devs are going to have to out think the cheaters. It's really very simple, keep multi-player stats stored, counted and calculated server-side. If the player client doesn't possess the data, it can not manipulate it. Attempts to do so would be EASILY tracked and kicking a player for trying would be trivial. Too many kicks and a server generated player ban request is sent to admins for review. It could also be set up as an auto ban...

There is always a better way to do something if enough creative thought is put into it.
 

Burty117

Posts: 3,738   +1,601
Game devs are going to have to out think the cheaters. It's really very simple, keep multi-player stats stored, counted and calculated server-side. If the player client doesn't possess the data, it can not manipulate it. Attempts to do so would be EASILY tracked and kicking a player for trying would be trivial. Too many kicks and a server generated player ban request is sent to admins for review. It could also be set up as an auto ban...
Oh dear, Have you not played any modern first person shooters or something? Hacks don't just edit the scores, if cheaters did that, I don't think people would be as annoyed by cheating.

The reason these anti-cheat systems need Kernel Access is because the Cheat Software also goes that far to control mouse / controller movement and normally gives the cheater the ability to see through walls and what not.

I completely get why they're doing this, I just wish there was a more standardized way of doing it like a Microsoft API the games can tap into that can report back what control devices are running and report the driver file hashes back. Then the game devs could deny known cheat software and any unknown hashes are reported back to be investigated.
 
  • Like
Reactions: m4a4