this post was submitted on 14 Sep 2024

323 points (97.4% liked)

Linux Gaming

15797 readers

26 users here now

Gaming on the GNU/Linux operating system.

Recommended news sources:

Related chat:

Related Communities:

Please be nice to other members. Anyone not being nice will be banned. Keep it fun, respectful and just be awesome to each other.

founded 4 years ago

MODERATORS

[email protected]

323

Not trying to clickbait but is this the end for kernel-level anti-cheat? (www.notebookcheck.net)

submitted 1 month ago* (last edited 1 month ago) by [email protected] to c/[email protected]

58 comments fedilink hide all child comments

From the article

Microsoft has officially announced its intent to move security measures out of the kernel, following the Crowdstrike disaster a few short months ago. The removal of kernel access for security solutions would likely revolutionise running Windows games on the Steam Deck and other Linux systems.

top 50 comments

sorted by: hot top controversial new old

[–] [email protected] 1 points 3 weeks ago

Am I misremembering to think Genshin Impact was a cause of one of these major security disasters?

It wasn’t even people who installed Genshin that were victims - it was like, Microsoft signed a driver made by Mihoyo to scan for cheat apps. But mihoyo, being a game company with a rapid release cycle and imperfect security, had a vulnerability in the driver. So, malware authors could include that driver in their packages to elevate access on Windows installs even when no one had any idea what a Genshin is.

Not quite the same thing as Crowdstrike I guess though.

[–] [email protected] 14 points 1 month ago* (last edited 1 month ago) (1 children)

There was news that battlefield one would stop working because they were implementing fairfight(?) but it's still working and someone in game chat told me it wasn't kernel level in battlefield one version of the anti cheat. Any facts to this?

[–] [email protected] 4 points 1 month ago (1 children)

I think FairFight is the old anti-cheat, which at least used to be server side only.

[–] [email protected] 3 points 1 month ago (1 children)

So the best kind of anti cheat? (Does it prevent hackers good?)

[–] [email protected] 3 points 1 month ago (1 children)

It did alright, don't think I saw that many obvious cheaters in BF1. BF5 would occasionally have obvious cheaters, but I would hope they get banned eventually just because it's over the top (shooting people through walls, infinite ammo, perfect aim). Difficult to say with more subtle cheats, but I suppose if they're indistinguishable from players who are just good at the game then I think most people won't ever notice.

On the flip side I got permabanned from multiplayer in BF5 after EA falsely accused me of cheating, though I suppose that could've happened with any kind of anti-cheat, and could've been fixed by having half-competent support.

[–] [email protected] 3 points 1 month ago

The problem with EA is that they never bothered to moderate their games. In the end you get spinbotters and shit whilst legit players have to deal with rootkits because they're too stingy to pay for someone to review reports and develop moderation tools.

the Overwatch system in Counterstrike (and a bunch of other tools and policies in tandem with VAC) have been way more effective; I was always more certain that a blatant or suspected cheated would be dealt with in CS than in battlefield.

[–] [email protected] 123 points 1 month ago (3 children)

game developers and publishers are hesitant to enable Linux compatibility,

And I am hesitant to spend money on their games.

[–] [email protected] 15 points 1 month ago

I would reply with something like "Arrrr matey" but new games aren't even worth pirating anymore.

[–] [email protected] 19 points 1 month ago (1 children)

Also more than half of games with AC do in fact run on linux right now, and the world hasn't ended.

[–] [email protected] 5 points 1 month ago (1 children)

Hasn't ended yet, as soon as we reach 75% the simulation will end.

[–] [email protected] 2 points 1 month ago

The second someone finds a way to hack the simulator it becomes uninteresting. Like when I cheat in GTA SP and then suddenly never play it again.

[–] [email protected] 63 points 1 month ago (1 children)

running linux is a great way to automatically filter out most of the shit games, if it won't even run in proton then you generally have to be doing some bullshit with the code and thus aren't worth my time and certainly not my money.

[–] [email protected] 7 points 1 month ago (2 children)

But us in the VR community is still Windoze.

[–] [email protected] 30 points 1 month ago* (last edited 1 month ago) (1 children)

VR games work just fine in proton, as long as you're on Vive or Index.

It's the the headsets that don't support linux, unfortunately.

[–] [email protected] 3 points 1 month ago (1 children)

I've never got my Vive to work well in Linux, even though I'm using X which supposedly still is better for gaming that Wayland.

[–] [email protected] 11 points 1 month ago (1 children)

There are a lot of kinks around VR on linux. Wayland has been better in my experience, but I still can't believe SteamVR on linux just doesn't have power management for the base stations implemented. Like, it works, there's a fucking python script that can do it! But not via SteamVR.

I use an app on my phone to turn my base stations on and off.

Here's hoping the Deck and whatever Deckard turns out to be means Valve is in the process of improving the situation.

[–] [email protected] 3 points 1 month ago

For the Index and 2.0 Basestation it's supposed to work for a while now https://github.com/ValveSoftware/SteamVR-for-Linux/issues/320#issuecomment-1835581128

[–] [email protected] 8 points 1 month ago (1 children)

The VR community is a fairly small niche market

[–] [email protected] 2 points 1 month ago

We are small but still exists...

Once there is a way to properly play VR games without too much configuration, I will jump back to Linux. But for now, Windows 11 IOT edition is not too bad. Specifically the IOT edition without all the telemarketing and CoPilot crap.

[–] [email protected] 81 points 1 month ago (1 children)

Could very well be possible. Apple did the same thing with macOS Catalina in 2019. Since then, there are no kernel extensions, meaning no third-party code running at kernel level. This greatly improves the security of macOS, and other desktop operating systems should do the same.

[–] [email protected] 6 points 1 month ago

They have a hardcore micro kernel though, windows and Linux are a long way off from that Valhalla, gnu Mach notwithstanding.

[–] [email protected] 3 points 1 month ago (3 children)

I think I need more info. It seems like userspace is very hackable, so thus kernel level anti-cheat was born to control stuff like synthetic inputs and manipulation of memory / frame analysis. This anti-cheat would be held together by the fact that the kernel/drivers are proprietary and not very easy to edit. Obviously still possible because it's on your own computer, but challenging and invasive. Do I have that right?

In which case I don't see how going back to userspace would help. What is the solution? There probably isn't one outside of hardware (buying a hacking chip and soldering it in is annoying for most)

When I was doing game dev we focussed on AI-style analytics of user behavior. Of course a good enough bot could always look human. A real cat and mouse game wasting lots of time

[–] [email protected] 7 points 1 month ago (1 children)

What is the solution?

My guess is that Microsoft wants provide some kind of kernel level anti-cheat, possibly directly integrated with directx, and it will use cryptography which will make it impossible to emulate with Wine/Proton.

[–] [email protected] 1 points 1 month ago

The same kernel software cryptography could certainly be marketed for single player games and proprietary applications as a solution to piracy.

Don't like kernel anti cheat in your multiplayer games? here's kernel anticheat for your single player games!

[–] [email protected] 6 points 1 month ago

Removing 3rd party kernel access will probably also make cheating harder. Kernel anticheat is necessary largely in part due to cheat software using exploits in the 3rd party extension system to get kernel privileges itself and evade user mode anticheat.

[–] [email protected] 15 points 1 month ago* (last edited 1 month ago) (1 children)

Does there need to be a solution?
Do E-Sports competitions on identical certified hardware and otherwise ban people caught cheating.
Root kits aren't necessary for having fun in a game.

[–] [email protected] 12 points 1 month ago* (last edited 1 month ago)

lol, anti-cheat isn’t just about esports, or high level play. It’s not even just about cheating.

It’s broadly about harassment and griefing and just shitty behavior mediated by hacking in online games.

[–] [email protected] 57 points 1 month ago* (last edited 1 month ago) (3 children)

It's probably going to move to hardware attestation similar to what Android and iOS are doing. This may or may not be a good thing.

[–] [email protected] 6 points 1 month ago

Can anyone give an ELI5 on how hardware attestation works or is implemented on current OSes?

[–] [email protected] 3 points 1 month ago (1 children)

If it works on Linux, I'm fine with it, since I'm not cheating. Just like hardware attestation works on GrapheneOS, because it doesn't decrease the security of Android, in fact, it greatly improves it.

[–] [email protected] 11 points 1 month ago (1 children)

It's about control. And monopolies love control (governments, too). If we let them, they'll take it and then we're screwed.

[–] [email protected] 0 points 1 month ago

Could you elaborate? I don't really see how a hardware attestation feature would take away any of your control? Android phones have had it for a long time, and even Google still allows you to install alternative operating systems on their Pixel phones. GrapheneOS even uses the hardware attestation feature to your benefit, by including the Auditor app, which you can use to verify the integrity of your device.

[–] [email protected] 32 points 1 month ago (1 children)

Yeah, idk why everyone seems to legitimately think devs are going to just quietly revert back to usermode anticheat. I could see Riot patching an actual root kit before that happens.

But yeah, more likely MSFT will lobby for hw that is more annoying than secure boot or TPM to get working with linux, every windows app after that point will rely on it "because turnkey security!", and if you ever manage to disable it none of those apps will work on your machine in any OS (if they even worked through proton at all).

[–] [email protected] 2 points 1 month ago (1 children)

They're integrate a low level security framework in c#. Net that needs it and it will be on by default.

[–] [email protected] 2 points 1 month ago

Not Windows centric enough. Visual Basic and Excel macros.

load more comments