Riot: Source code for League of Legends and TFT were exfiltrated by attackers

Re:Riot: Source code for League of Legends and TFT were exfi... by josephg on Wednesday January 25, 2023 @04:08AM (#34516133)

If Microsoft succeeds with their full plan for "trusted computing" (project Palladium), they'll be able to do anti-cheat at the operating system level.

The basic idea is the BIOS verifies the kernel (secure boot), and the kernel verifies all running software. The hardware TPM chip signs a message from the kernel attesting that this has all happened using the on-device crypto signature embedded by the hardware vendor (eg ATI). So the signature is tamper-proof, even by the computer user. And all that can validated over the internet via remote attestation.

The message would presumably include the hash of the game's binary files, and the signature & hash of all loaded kernel modules. So yeah, hardware level, "unhackable" anti-cheat on commodity hardware.

I can't tell whether to be terrified or impressed with the audacity of the plan.

https://en.wikipedia.org/wiki/Next-Generation_Secure_Computi...

[ Parent | on HN ]

Re:Riot: Source code for League of Legends and TFT were exfi... by bzzzt on Wednesday January 25, 2023 @05:22AM (#34516633)

While the whole signature verification thing sounds water-tight in theory there are lots of holes still being patched so I don't buy it this will 'change everything'. Making everything tamper-proof could even prevent some holes from being closed.

[ Parent | on HN ]

Re:Riot: Source code for League of Legends and TFT were exfi... by josephg on Wednesday January 25, 2023 @04:11PM (#34524237)

The only tamper proof part is the hardware TPM. Everything else uses a chain-of-trust model based on signatures. Most of the complex work will be in windows; and that code can be updated just fine so long as updated versions of the kernel are digitally signed.

I’m sure there will be security holes early on. But the people pushing this stuff seem to be playing a long, patient game. I think they’re going to get what they want.

[ Parent | on HN ]

Re:Riot: Source code for League of Legends and TFT were exfi... by smolder on Wednesday January 25, 2023 @09:29AM (#34518630)

> I can't tell whether to be terrified or impressed

I recommend the former, since this is another nail (maybe the final one?) in the coffin of "personal computers", hastening their replacement by hypertelescreens or whatever. (A computer you don't own, but merely access.)

[ Parent | on HN ]