Microsoft is moving antivirus providers out of the Windows kernel. Hopefully anti-cheat will be next
-
Microsoft has long wanted to get vendors out of the kernel. It's a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.
Most of those issues also apply to kernel anti-cheat as well, and it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.
Oh, so that's why Epic's Easy anticheat keeps having trouble. Microsoft might be using it as a trial run.
-
Microsoft has long wanted to get vendors out of the kernel. It's a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.
Most of those issues also apply to kernel anti-cheat as well, and it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.
You realize this'll occur at the expense of Microsoft treating the user as an untrustworthy enemy.
This means modding (even for offline play) will not be allowed. Heck, even modify ini files might be viewed as "hacking".
I agree removing the need for anti-cheat in principal sounds nice, but this means archiving games or porting them to "unsupported platforms" will be relics of the past.
-
You realize this'll occur at the expense of Microsoft treating the user as an untrustworthy enemy.
This means modding (even for offline play) will not be allowed. Heck, even modify ini files might be viewed as "hacking".
I agree removing the need for anti-cheat in principal sounds nice, but this means archiving games or porting them to "unsupported platforms" will be relics of the past.
I believe that's just fear-mongering. This has been a thing that Microsoft has wanted to do for a while, largely because having 3rd party code with direct kernel access is a huge problem in terms of stability and security unless you can be sure you know what all that code is doing.
They tried to do this in the past, arguing that anything that wanted kernel-level access had to Windows API calls instead, however Windows Defender which was bundled with the OS was exempt from this restriction. The EU argued that it gave Microsoft a competitive advantage in the AV space and mandated that if they wanted to do this, they had to follow their own rules which MS was not willing to do.
Instead, Microsoft dictated that any code that was going to run in the kernel had to be submitted to Microsoft for review, who would then approve or deny the code for use. The problem with this method is that it's slow, so any AV that wanted to update their engine had to go through a code review process every time. Crowdstrike (and likely every other AV provider) got around this by having a component of their software with kernel-access that could read in data dynamically. This is what caused that worldwide BSOD problem a couple years back. The Crowdstrike component with kernel access loaded in a bad update that was not properly reviewed and it broke every system with the AV installed.
Overall, this change is a good thing and will force software vendors to actually operate securely rather than just asking for ring 0 access when they don't need it. As always, if you're worried about the changes MS is making, Linux is available and getting better day by day.
-
You realize this'll occur at the expense of Microsoft treating the user as an untrustworthy enemy.
This means modding (even for offline play) will not be allowed. Heck, even modify ini files might be viewed as "hacking".
I agree removing the need for anti-cheat in principal sounds nice, but this means archiving games or porting them to "unsupported platforms" will be relics of the past.
I don't think it would go that far, I don't think they can go that far? Stopping people from editing text files basically is what you are saying?
-
Microsoft has long wanted to get vendors out of the kernel. It's a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.
Most of those issues also apply to kernel anti-cheat as well, and it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.
I never understood kernel level anti-cheat. People STILL cheat. lol
-
Microsoft has long wanted to get vendors out of the kernel. It's a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.
Most of those issues also apply to kernel anti-cheat as well, and it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.
wrote on last edited by [email protected]This is what, the fourth time a Linux community gets excited about this? But that's actually not good for us at all. Much like Android's safety net, or the nightmare that is the Mac equivalent, the entire point will be creating an untouchable chain from the firmware to the final OS being booted, and only allowing some apps to use a specific API to attest this isn't compromised.
This is horrendous for people trying to modify the OS or, in a more relevant tone, run programs meant for that OS on an entirely different environment. Microsoft has slowly been moving towards making this work on PCs, mostly due to pressure from DRM providers like Netflix or banking apps, but unlike Apple they can't simply lock everything down at once and say "deal with it" because Windows lives by backwards compatibility. Either way, this is just another step towards this upcoming future.
If your favorite games now start asking Windows if the chain of trust is not tampered with... say goodbye to compatibility with Proton.
-
Microsoft has long wanted to get vendors out of the kernel. It's a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.
Most of those issues also apply to kernel anti-cheat as well, and it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.
it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space
[Citation needed]
-
I never understood kernel level anti-cheat. People STILL cheat. lol
To be fair, it certainly still makes cheating harder. If it didn't exist, you'd just see even more people cheating, but it's a pretty overkill way of system monitoring for such a relatively small benefit by comparison.
Massive privacy risk, only slightly better performance than other non-kernel monitoring.
-
it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space
[Citation needed]
It seems like the point is that Microsoft would be developing some sort of alternative to the kernel with similar functionality for antivirus providers, that doesn't need to have kernel level access. Anticheat uses a lot of the same techniques as kernel level antivirus to detect malware, thus it would probably have to adapt to this new system.
I think the article is more commenting on how Microsoft is directly partnering with antivirus companies for this new system right now, while they're not directly partnering with anticheat companies, even though they'd probably have to migrate to this new system regardless.
-
This is what, the fourth time a Linux community gets excited about this? But that's actually not good for us at all. Much like Android's safety net, or the nightmare that is the Mac equivalent, the entire point will be creating an untouchable chain from the firmware to the final OS being booted, and only allowing some apps to use a specific API to attest this isn't compromised.
This is horrendous for people trying to modify the OS or, in a more relevant tone, run programs meant for that OS on an entirely different environment. Microsoft has slowly been moving towards making this work on PCs, mostly due to pressure from DRM providers like Netflix or banking apps, but unlike Apple they can't simply lock everything down at once and say "deal with it" because Windows lives by backwards compatibility. Either way, this is just another step towards this upcoming future.
If your favorite games now start asking Windows if the chain of trust is not tampered with... say goodbye to compatibility with Proton.
I'm not sure this will be an issue.
When a piece of software is checking for chain of trust, it's done primarily for security or DRM reasons. The benefits of verifying this chain of trust would make it a little harder for cheaters to inject code and it would be an extra hurdle for pirates to overcome, but the cost is that everyone that bought your game with the intent of playing it on Linux now has absolutely no way to make that happen. I'm not sure the loss in ~4% of your sales would be worth the benefit.
-
To be fair, it certainly still makes cheating harder. If it didn't exist, you'd just see even more people cheating, but it's a pretty overkill way of system monitoring for such a relatively small benefit by comparison.
Massive privacy risk, only slightly better performance than other non-kernel monitoring.
Some games just need people back in the equation instead of relying on algorithms. Bring back the Game Master's to MMOs etc, these people are willing to work for peanuts and be happy, yet they still decided to cut costs by replacing them...
-
Microsoft has long wanted to get vendors out of the kernel. It's a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.
Most of those issues also apply to kernel anti-cheat as well, and it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.
I'm curious to see how CompTIA responds to this. They already don't allow you to take their exams in a VM or any kind of Linux. Presumably for the same "concerns" that the anti-cheat industry has.
-
You realize this'll occur at the expense of Microsoft treating the user as an untrustworthy enemy.
This means modding (even for offline play) will not be allowed. Heck, even modify ini files might be viewed as "hacking".
I agree removing the need for anti-cheat in principal sounds nice, but this means archiving games or porting them to "unsupported platforms" will be relics of the past.
You realize this’ll occur at the expense of Microsoft treating the user as an untrustworthy enemy.
What do you mean? Take away your ability to create drivers? Because it's already extremely limited and you need to get signed. I guess this "change" would just mean not signing any new antivirus drivers.
This means modding (even for offline play) will not be allowed. Heck, even modify ini files might be viewed as “hacking”.
That's a completely wrong take. Whether or not an anticheat runs in the kernel or not does not mean people can just go and edit their files. Even with a kernel level anticheat people can already do that if the driver is not running. The correct way is to do purity checks during connection to an online server, and only allow serverside code to update the gamestate. Any texture file hacks and local purity bypasses for those would need to be caught by the userland anticheat, like it has been done for ages. Not the best solution, but far more privacy friendly.
I agree removing the need for anti-cheat in principal sounds nice, but this means archiving games or porting them to “unsupported platforms” will be relics of the past.
Another weird take. Are you talking about the anticheat not being installable anymore? Because even if a game comes with a kernel level anticheat it would need a valid certificate, so any dead game would eventually have this problem regardless of it being allowed to install the driver. Porting games would in almost all cases get rid of the anticheat or somehow null it, disable any custom servers from forcing a valid anticheat, stuff like that. And archiving would be much easier without any anticheat at all, again regardless of kernel anticheat or userland anticheat.
MUCH better solutions against hacker are to use all this amazing machine learning stuff on the server side, put more power back into the hands of admins and their selfhosted servers, and handle reports about hackers better and faster.
-
Microsoft has long wanted to get vendors out of the kernel. It's a huge privacy/security/stability risk, and causes major issues like the Crowdstrike outage.
Most of those issues also apply to kernel anti-cheat as well, and it's likely that Microsoft will also attempt to move anti-cheat vendors out of kernel space. The biggest gaming issues with steamOS/Linux are kernel anti-cheat not working, so this could be huge for having full compatibility of multiplayer games on Linux.
wrote on last edited by [email protected]I'd probably be okay with kernel level anti-cheats if they actually stopped cheaters. But they don't. Hell, the best anti-cheat I've ever seen that actually works isn't even made by the developers of the game; it's a mod! Blue Sentinel for Dark Souls 3. All it does is check if the files a player you're connecting to has deviate at all from your own, then prevents the connection if they are not 1:1 identical.
-
I never understood kernel level anti-cheat. People STILL cheat. lol
wrote on last edited by [email protected]Yes,
but game companies also want to spy on you and potentially sell your data. Even if they aren't selling it, the ability to do so increases the value to investors. This is the way tech companies talk about invasive software in general, FWIW.
-
Some games just need people back in the equation instead of relying on algorithms. Bring back the Game Master's to MMOs etc, these people are willing to work for peanuts and be happy, yet they still decided to cut costs by replacing them...
...wait, games don't have even a single person checking for cheaters, even casually? Like, they wholly rely on anticheat?
(PS, has been a decently long time since I played a game that needed anti cheat)
-
This is what, the fourth time a Linux community gets excited about this? But that's actually not good for us at all. Much like Android's safety net, or the nightmare that is the Mac equivalent, the entire point will be creating an untouchable chain from the firmware to the final OS being booted, and only allowing some apps to use a specific API to attest this isn't compromised.
This is horrendous for people trying to modify the OS or, in a more relevant tone, run programs meant for that OS on an entirely different environment. Microsoft has slowly been moving towards making this work on PCs, mostly due to pressure from DRM providers like Netflix or banking apps, but unlike Apple they can't simply lock everything down at once and say "deal with it" because Windows lives by backwards compatibility. Either way, this is just another step towards this upcoming future.
If your favorite games now start asking Windows if the chain of trust is not tampered with... say goodbye to compatibility with Proton.
I don't think chain of trust and security through kernel-level access are fighting the same problem.
Usually chain of trust is to prevent app tampering, and kernel-level access is to prevent memory tampering.
I assume Windows is creating a new API for applications to monitor certain regions of memory for tampering without needing kernel access.
-
I'm curious to see how CompTIA responds to this. They already don't allow you to take their exams in a VM or any kind of Linux. Presumably for the same "concerns" that the anti-cheat industry has.
A useless certificate for a useless job.
-
A useless certificate for a useless job.
wrote on last edited by [email protected]As a holder of multiple CompTIA certificates I wholeheartedly agree that they're useless. Unfortunately they're by far the most common means of contractors (the actual people, not the companies) checking off the boxes to qualify for U.S. government IT contracts; which means they're still relevant.
-
I'd probably be okay with kernel level anti-cheats if they actually stopped cheaters. But they don't. Hell, the best anti-cheat I've ever seen that actually works isn't even made by the developers of the game; it's a mod! Blue Sentinel for Dark Souls 3. All it does is check if the files a player you're connecting to has deviate at all from your own, then prevents the connection if they are not 1:1 identical.
Basic anti-cheat already does this, but also with memory, because most cheats are reading/modifying what is in memory. I think the only ethical solution for anti-cheat is on the server side, with machine learning perhaps, kind of like VACnet.
