6d ago

Microsoft is moving antivirus providers out of the Windows kernel. Hopefully anti-cheat will be next

www.theverge.com Microsoft is moving antivirus providers out of the Windows kernel

Microsoft wants to avoid another CrowdStrike incident.

Microsoft has long wanted to get vendors out of the kernel. It's a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.

Most of those issues also apply to kernel anti-cheat as well, and it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.

You're viewing a single thread.

59 comments

I'd probably be okay with kernel level anti-cheats if they actually stopped cheaters. But they don't. Hell, the best anti-cheat I've ever seen that actually works isn't even made by the developers of the game; it's a mod! Blue Sentinel for Dark Souls 3. All it does is check if the files a player you're connecting to has deviate at all from your own, then prevents the connection if they are not 1:1 identical.
- Basic anti-cheat already does this, but also with memory, because most cheats are reading/modifying what is in memory. I think the only ethical solution for anti-cheat is on the server side, with machine learning perhaps, kind of like VACnet.
  
  The problem is that, with a good enough cheat, it can be impossible to distinguish from a very good player.
  The best cheats use a secondary device emulating human input and reactions, which is practically undetectable.
  
  A secondary device can't be identified by kernel level anti-cheat either. If you have a standalone device that identifies as a USB keyboard and mouse and then generates inputs that give you a 100% headshot count, there's nothing you could detect through the kernel, since all it detects are keystrokes and clicks.
  
  You will never stop cheaters, ever. It's something we have to live with. It's annoying when it happens, but it's hardly the end of the world either.
  So I'd rather have the AC running on the server and not invading my system.
  
  Yeah and a lot of cheats know the anti cheat is checking memory so they also modify the anti cheat and essentially mess up their memory check to fool it into thinking nothing has been modified. It's just a cat and mouse game where the cheats bypass the anti cheat and the anti cheat adding more detectors.
- If cheaters wanted to get around that, they could
- "I’d probably be okay with kernel level anti-cheats if they actually stopped cheaters. "
  "I'd be okay with espionage devices all around my house if it stopped documents from being forged."
  samepicturememe.jpg
  
  All I use my machine for is gaming, so not having cheaters in games far outweighs the odds of being hacked by imaginary bogeymen.
  
  I am not really talking about being hacked but about anyone but you having more control over your system then you.
  Maybe in your case thats very little information but I am a tech hobbyist and if i do not have full control and knowledge about every aspect of a device i bought, do i really own it?
  If a consumer can’t fully own it, it shouldnt be sold as such. I considered such deeply unethical and damaging to the future potential of technology.

59 comments