/dev/null: Anti-Cheat Kernel Driver (2020)

Re:/dev/null: Anti-Cheat Kernel Driver (2020) by prvit on Sunday July 24, 2022 @04:38PM (#32217463)

> So they acknowledge that running third-party stuff in kernel mode increases the likelihood your machine gets owned by malware

Which is utter nonsense. Nothing will touch this kernel mode stuff unless they’ve already owned your machine. All the data you care about is accessible from usermode anyway.

The risks of kernel mode anticheat have been wildly overstated, Riot is engaging in the same to spread silly FUD regarding cheats.

[ Parent | on HN ]

Re:/dev/null: Anti-Cheat Kernel Driver (2020) by josephcsible on Sunday July 24, 2022 @04:50PM (#32217573)

> The risks of kernel mode anticheat have been wildly overstated

How many things like https://github.com/Luohuayu/evil-mhyprot-cli and https://mobile.twitter.com/TheWack0lian/status/7793978407622... have to happen before you'll believe that there really is a significant amount of risk here?

[ Parent | on HN ]

Re:/dev/null: Anti-Cheat Kernel Driver (2020) by prvit on Sunday July 24, 2022 @04:53PM (#32217598)

In both of those cases someone has already hacked your machine and can run arbitrary binaries. They’ve already stolen all of your credentials from browser databases, all of your secret files from your homedir and so on.

Besides, Windows LPEs are a dime a dozen anyway.

[ Parent | on HN ]

Re:/dev/null: Anti-Cheat Kernel Driver (2020) by josephcsible on Sunday July 24, 2022 @05:00PM (#32217656)

And if I do banking from one user account and gaming from a different (limited) user account?

[ Parent | on HN ]

Re:/dev/null: Anti-Cheat Kernel Driver (2020) by prvit on Sunday July 24, 2022 @05:00PM (#32217662)

Literally nobody does that. That riots anticheat driver might interfere with your incredibly niche use case is fundamentally not a very compelling argument.

Besides, Windows LPEs are a dime a dozen anyway.

[ Parent | on HN ]

Re:/dev/null: Anti-Cheat Kernel Driver (2020) by smileybarry on Sunday July 24, 2022 @05:34PM (#32217977)

Accounts are not a good separation of context already, let alone privilege escalation exploits.

If you’re concerned about one use affecting the other you’re much better off dual-booting two Windows installations, both using BitLocker. They’d use separate keys and AES-XTS means there’s tamper protection as well. One partition could, at worst, destroy the other.

[ Parent | on HN ]

Re:/dev/null: Anti-Cheat Kernel Driver (2020) by ivegotnoaccount on Sunday July 24, 2022 @04:49PM (#32217566)

At least on Linux, a bug on the kernel module could lead to injection of other kernel modules, packages being installed, core binaries being tampered with, which are not impossible to do in userland but require deceiving the user in entering its credentials.

I think on Windows, such actions lead to an overlay that ask for authorization and can't be auto-clicked ? If so, I think having such a prompt when not expected will rise attention from the tech-savy users which may report the culprit binary. A bug in the driver being exploited would lead to the absence of the symptom, potentially increasing the time before a first user notices it.

[ Parent | on HN ]

Re:/dev/null: Anti-Cheat Kernel Driver (2020) by prvit on Sunday July 24, 2022 @04:55PM (#32217613)

> At least on Linux, a bug on the kernel module could lead to injection of other kernel modules, packages being installed, core binaries being tampered with, which are not impossible to do in userland but require deceiving the user in entering its credentials

None of this matters, because all the files you care about live in your homedir anyway. In a desktop environment, the malware can tamper with your .profile to replace e.g. the sudo binary and gain root access without any exploits.

[ Parent | on HN ]