Not to mention them saying "if you use AAA games, you may already have such a thing running already so one more won't kill you." whereas, in real life, it increases the odds that a system will get hacked due to it since the attack surface increases (The number of bugs in "EA+Riot" could not be less than "EA", but could be higher, and the other way around)

> whereas, in real life, it increases the odds that a system will get hacked due to it since the attack surface increases

Bullshit. In real life nobody will hack you with a videogame anticheat kernel driver exploit.

They will hack you with a browser exploit, a ms office exploit, or just because you downloaded a malicious executable and decided to run it.

I agree that getting hacked through a browser is a far higher risk. However, the said browser is hopefully running with admin privileges, and if it is needed by the malware, it will need something else to exploit. If it was some small editor, it would serve no purpose for this. But we're talking about Riot Games, whose software is installed on hundreds of millions of machines and thus have a non-neglictible odd of being on the target's computer.

Admin privileges don’t matter, all the stuff you care about lives in your homedir.

Have you ever seen a real world example of super common and super insecure AV drivers being exploited for LPE? Probably not, it’s not worth the trouble.

I don't know if it has been exploited on the wild, but the subject seemingly interested some enough to find escalations bugs in https://en.m.wikipedia.org/wiki/SafeDisc.

Yes, there are tons of these bugs and tons of PoCs. However, in real life, nobody bothers to exploit them because there’s very little to gain by doing so.

> In real life nobody will hack you with a videogame anticheat kernel driver exploit.

That's just not true - for example, the infamous capcom.sys

The implication is that Riot only stands to gain a small amount of money if they decide to actually start a botnet using their customers' machines, with a lot of risk of lawsuit/bad PR if they do so; and that cheap cheat makers, due to their already-shady business and anonymity, are more likely to start selling botnet access on the side to make extra cash.

The risk isn't that Riot uses the module maliciously. The risk is that the module contains a security vulnerability, and that someone else then uses it maliciously.

Good cheats are expensive (like, often more than $100 per month) Cheat makers have way higher per-user revenues than Riot.

> So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware

Which is utter nonsense. Nothing will touch this kernel mode stuff unless they’ve already owned your machine. All the data you care about is accessible from usermode anyway.

The risks of kernel mode anticheat have been wildly overstated, Riot is engaging in the same to spread silly FUD regarding cheats.

> The risks of kernel mode anticheat have been wildly overstated

How many things like https://github.com/Luohuayu/evil-mhyprot-cli and https://mobile.twitter.com/TheWack0lian/status/7793978407622... have to happen before you'll believe that there really is a significant amount of risk here?

In both of those cases someone has already hacked your machine and can run arbitrary binaries. They’ve already stolen all of your credentials from browser databases, all of your secret files from your homedir and so on.

Besides, Windows LPEs are a dime a dozen anyway.

And if I do banking from one user account and gaming from a different (limited) user account?

Literally nobody does that. That riots anticheat driver might interfere with your incredibly niche use case is fundamentally not a very compelling argument.

Besides, Windows LPEs are a dime a dozen anyway.

Accounts are not a good separation of context already, let alone privilege escalation exploits.

If you’re concerned about one use affecting the other you’re much better off dual-booting two Windows installations, both using BitLocker. They’d use separate keys and AES-XTS means there’s tamper protection as well. One partition could, at worst, destroy the other.

At least on Linux, a bug on the kernel module could lead to injection of other kernel modules, packages being installed, core binaries being tampered with, which are not impossible to do in userland but require deceiving the user in entering its credentials.

I think on Windows, such actions lead to an overlay that ask for authorization and can't be auto-clicked ? If so, I think having such a prompt when not expected will rise attention from the tech-savy users which may report the culprit binary. A bug in the driver being exploited would lead to the absence of the symptom, potentially increasing the time before a first user notices it.

> At least on Linux, a bug on the kernel module could lead to injection of other kernel modules, packages being installed, core binaries being tampered with, which are not impossible to do in userland but require deceiving the user in entering its credentials

None of this matters, because all the files you care about live in your homedir anyway. In a desktop environment, the malware can tamper with your .profile to replace e.g. the sudo binary and gain root access without any exploits.

> your machine gets owned by malware

That's the whole point, is it not? Anticheat is malicious software burning up CPU cycles and reducing security whether you're cheating or not...

No they acknowledge that cheat Trojans exist.