Kernel level anti-cheat needs to go

[@borplex]

Giving a company more access to my pc then I do as a base level user is absurd.

[@JuanGamer0202]

Welcome to reality

[@flaming_cheetah838]

@@JuanGamer0202 well it's not because nobody is dumb enough to go kernel level. lmao

[@lilililiililili6363]

@@flaming_cheetah838 mind telling me the most popular video games on earth right now?

[@SammyGoated]

Cheats have already bypassed it too lmao

[@pro_gemer]

@@lilililiililili6363 tetris

[@akeem2983]

I always was saying that having kernel-level components is just way too much responsibility for a videogame

[@ElNeroDiablo]

StarForce was one of the DRM schemes of the late-90's/early-00's that basically Rootkitted your system at the kernel-level to "prevent piracy". It failed at that job and only became a thorn in the side of legitimate purchasers and then the devs and publishers when they went to convert games from physical-media to digital-distribution (one game sold through Steam was found to have been a repackaged version of a pirated release of that game because the studio couldn't remove the DRM and instead used the pirated version without changing any of the Scene Info from it). Game Publishers have *not* learnt from their mistakes with such DRM and instead use what are truthfully rootkits as "anti-cheat".

[@corpingtons]

Seriously they don’t deserve it

[@MegasVN69420]

Valve already say no to Kernal Anti-cheat in 2017

[@SuadoCowboy]

hey bro your pfp is missing!!

[@fourlion_everywhere]

​@@SuadoCowboy to me it seems perfectly fine. you probably forgot to install Counter-Strike: Source

[@lerebox]

@@SuadoCowboy did u forget to mount cs:s?

[@M2rsh]

@@SuadoCowboy install css

[@SuadoCowboy]

@@MegasVN69420 ohhh sorry guys I always forget

[@Magestig]

I've never understood why EA decided to put kernel level anti-cheat into EA WRC, _several months after_ the release. A game, that is mostly a _single player_ game. It's genuinely really baffling.

[@drjamaymay405]

mostly, if it has any online pvp it needs some anti-cheat. and since EA already has an anti-cheat ready to implement into all of their games. why not use the kernel-level one. But yeah, that does suck for the single player games who don't care about the competitive side

[@TheVideogaming101]

Data scrapping, a kernel level AC can constantly send data to EA even when you arnt playing their game.

[@Seatux]

@@TheVideogaming101 even the Esports excuse is stupid. They could just have a version just for tournament use.

[@shiranuithewolf8559]

I found an easy way to get around this actually, I just don’t play any EA games, garbage ass company

[@josephhutchins8]

Thanks for making this comment I had no clue that they added kernel level anti cheat into the game until now, I'm gonna try and refund it because that's pretty bullshit that they did that without mentioning it before the games release.

[@ducky1681]

Valve seems to be trying a different approach, different to traditional AC. It looks a lot more server-side which I support wholeheartedly. I believe they're also using some kinda machine learning paired with human review.

[@CDM14y]

flicker the mouse after killing someone and get insta banned

[@GC-jm9bt]

The majority of the games you play are most likely already server side authoritative. And most anti-cheats (even those with kernel level anti-cheats) most likely have some kind heuristically analysis in the backend to flag suspicious players.

[@TRDiscordian]

What's funny to me is when I started in comp sci 20 years ago it was "NEVER TRUST THE CLIENT", we've come full circle lol.

[@Capiosus]

@@CDM14yok but if you pretend to cheat and then get banned for cheating then I don’t know what you were expecting.

[@zzyxxyzz5442]

@@Capiosus then the anti-cheat isn't really working as intended? an anti-cheat is meant to detect cheating players, not players that almost act like cheaters

[@cybernd6426]

Another problem with Kernel level anti-cheat is that it can be problematic if you plan on playing on something like linux

[@minneelyyyy]

some anticheats like Easy Anticheat support Linux, its just up to developers to enable support

[@budgetarms]

How can it be problematic?

[@cybernd6426]

@@minneelyyyy I know. But Kernel level Anti-cheat first has to be activated, while something like server side anti cheat probably won't care

[@cybernd6426]

@@budgetarms it can cause you to get banned if the game devs don't integrated Linux support in the anti cheat. And Kernel level anti-cheat was known for a long time to get you banned, if you use Linux

[@lorenzobuero7115]

​@@budgetarmslinux is very different to windows in the background, the files are organized in a very different way for example. Because kernel lvl anti-cheat is so deep in the system it depends on many windows APIs and other thinks that don't work on linux. Companies could make theese anti cheats work on linux, but due to the low market share, they don't want to.

[@xylvnking]

Riot's vanguard is the only thing that was able to get me to stop playing league lol

[@gamersworld4176]

suckes for you ig.

[@aeolianthecomposer]

Congrats on not playing this garbage

[@evankim2406]

@@aeolianthecomposer More like Garbaj.

[@OneOfTheLostOnes]

+1

[@Yous0147]

I stopped playing tft for the same reason. I was planning to play a bit of league again, but got saved on the line

[@forthegod]

biggest problem with kernel mode anticheats is not kernel level permissions.... its the fact that they often hate each other and sometimes cant work properly without adding each other into whitelists and some cheaters use vulnerabilities of "weak" whitelisted anticheats to bypass some levels of protection of anticheats that have no known vulnerabilities.... anticheat devs perfectly know that and probably in near future they will force all players to unload all anticheats from other games + restart pc each time you want to play a protected game from different company

[@rogercruz1547]

I assumed you already had to do that

[@fleepity]

@@rogercruz1547 with the restarting if vanguard was closed or didnt start up properly then u do have to restart ur pc to play val / league

[@punishedkid]

Gaming is dead and mass marketing killed it.

[@Luney_0296]

If you don't know about it, already, there's a video about an old DRM called StarForce. It installed stuff on the kernel level without telling the user, and it ruined computers for a lot of people, even when they did nothing wrong. That one is wild. Reminded me of that. Edit: The video is by Modern Vintage Gamer.

[@john_john_john]

It's not only crashes. I can live with my PC crashing, if it's my personal computer I use for gaming and shitposting I can just go outside instead. The problem is that these anticheats can be yet another vector for attacks.

[@vilmfilm]

Fellow mighty making excuses that he goes outside on a regular basis 😂🎉❤❤❤❤ flowers for my bro flowers for my bro

[@john_john_john]

@@vilmfilm my PC doesn't crash because I don't install malware on it willingly, so I just live inside 24/7.

[@2.5k_ping56]

​@@vilmfilm not all who plays video games are kids and discord mods, some people have jobs you can't take dumb risks

[@RiskCapCapGG]

Kernel level anti-cheats have actually been causing problems already. Leaving aside the more minor ones where, say, Riot's Vanguard would accidentally stop someone from installing a program they needed, there's been a report roughly 2 years ago about an attacker abusing Genshin Impact's kernel level anti-cheat to do malicious things like disable antivirus software and install ransomware on someone else's computer. Look it up, you'll find it right away.

[@drjamaymay405]

it's worthwhile for competitive games. I don't play genshin, but that probably doesn't need any anti-cheat. its a pve game who cares. but for comp games, it's a must even with the potential problems.

[@akeem2983]

​@@drjamaymay405 Genshin is a gacha pve game, so anticheat probably exists in order to prevent players from getting items for free

[@drjamaymay405]

@@akeem2983 makes sense from a monetary perspective. but way less defensible in comparison to competitive integrity. But I don't care much about gacha games.

[@RiskCapCapGG]

​@@drjamaymay405 I was about to say what @akeem2983 said but they beat me to it xd Regarding it being a must for competitive games, I actually think it isn't, because it's not very effective either. Look at all these games that have a kernel-level anti-cheat and are still full of hackers (Call of Duty, pretty much any EAC or Battleeye game, even in Valorant I've seen a decent amount of cheaters). There are ways that are simple and cheap to bypass even those, you can look up the Arduino Aimbot method as an example. I'm starting to think developers are adding kernel-level anti-cheats more as an excuse or a marketing scheme, so that they don't invest in a proper solution while still giving the average gamer a false sense of safety, since most people hear that and assume that it must be good. If there's a game that manages to deal with cheaters quite well, even if it has kernel-level AC, I would bet my ass off it's not necessarily the kernel-level compoment doing the heavy lifting, but the devs having actually implemented a proper solution all around (i.e. probably also having some server-side checks and client-side in the game itself checks).

[@Dr__Gamer1212]

@@drjamaymay405 its not good for competitive pvp games though. it doesn't offer any more protection than a normal anti-cheat

[@owencmyk]

This shit is exactly what I've been saying. I can't believe this is normalized in any way. The fact that a bad update (or even a hack) to a game I play could brick my PC is ludicrous. osu! has the most effective anti-cheat I've ever seen in gaming and it's not kernel-level, bless peppy (the lead developer of osu!)

[@gamersworld4176]

disagree. a rhythm game and a fps or shooter game is a totally different field for anti cheats. in shooters its hard to detect cheats compared to osu. so we need harder protection.

[@owencmyk]

@@gamersworld4176 No, cheating is much harder to detect in osu. Because in osu there's only a couple of inputs that can be properly measured, AND all players are striving for the exact movements. You can only really analyze aim and rhythm. Whereas in shooter games, you can analyze movement, aim, reaction time, and on the fly decision making, which gives you way more clues. You absolutely don't need kernel access to make an effect FPS anti-cheat

[@lvn5609]

What's up with osu anti cheat? Didn't hear anything about it

[@tigiexe]

​@@owencmyk i dont think this is true, its so much easier to detect cheaters in osu than in fps games, the fact that there is more inputs in fps games should in theory make it easier but of all the ones you mentioned only aim and reaction time can be completely sure evidence of cheating, ofc it depends on the kind of cheating, for example replay editing and replay stealing in osu is probably undetectable but it is easy to just call someone a cheater and have them make a liveplay or seeing how someone is improving way too fast since there really is no other place to improve fast other than private servers or offline i could elaborate on this even more but i think you get the point

[@yasharnamdar473]

osu! has the most effective anti-cheat? my guy, someone (cloutiful, rank 3 in the world) just got banned for cheating and almost got away with it. osu's anti cheat is it's community, there's an entire subreddit dedicated to it. it's bans are very basic (like how accolibed got banned instantly for setting a highscore then get unbanned). osu's anti cheat is almost non-existent.

[@stormdesertstrike]

Kernel level anti cheat systems are basically a backdoor for hackers and malicious actors, like opening a portal straight to hell where the worst of the worst can crawl through and wreak havoc on your system. It's like inviting the devil himself into your PC just to stop cheaters.

[@frezzingaces]

I used to feel stupid buying a PC that I only use for gaming and nothing else. Now I feel good knowing it's for my privacy thanks.

[@colin_actually]

It's insane that millions of gamers are ok with having this sort of attack vector installed. It's ludicrous that it's been pushed this far.

[@NickAc]

i have always been of the opinion that server-side anti-cheat detection is leagues better than client-side detection. And sure, you will miss the visual cheats like ESP and whatnot, but that also has to do with what information the client receives.

[@gamersworld4176]

what about the bot problem in league then? how are you gonna detect the bots server side?

[@drjamaymay405]

Yes server side anti-cheat catches cheaters, but you will still need to access the users computers. If anything both should be implemented together.

[@magicalchicken5667]

Server-side can't reliably detect any serious form of aimbot, which is a pretty big downside. It'd have to make extremely risky guesses based on the limited (and sometimes inconsistent) information it's getting.

[@insu_na]

@@gamersworld4176 Bots are the easiest thing to detect serverside.

[@insu_na]

@@drjamaymay405 it *can* help, especially against novice attackers, but professional cheat developers and people who buy those cheats are unlikely to be detected with clientside software, because they can always get around that. Doing proper serverside evaluation is the only way

[@muckdriver]

The funny thing about valve and blizzards anti-cheat not being kernel level is that games with kernel level get just as much hackers as the formers games all while being more intrusive. Typed as you finished the crowdstrike part and said this lol.

[@gunmadonuts]

Thats just wrong though. Fortnite has far fewer cheaters than cs or tf2 because of their kernel level anticheat. Almost no cheaters.

[@gamersworld4176]

lol. blizzard's defense matrix is a kernal level anticheat. and kernal level anticheat's success rate depends how efficiently it can work and how much dedicated the devs are at protecting their competitive integrity. valve and blizzard dont care about their competitive side. thats why their anti cheat is pupu.

[@sysofficial]

That's unfortunately incorrect. You didn't look any of this up did you? You just figured you could write whatever and people would agree? Valve and blizzards anti-cheats are terrible compared to something like vanguard. The amount of players per the ratio of bans on Valorant over CS:GO or Overwatch, with system-oriented bans is SIGNIFICANTLY higher, with Riot Games confirming a large number of them being reoccurring bans, proving the fact that their anti-cheat is consistent and reliable. I have never met a cheater in Valorant - Rarely is there a day that goes by where I don't find a cheater in a lobby on games relying on the latter. Seriously, why lie??

[@468erpeashooter9]

@@gunmadonuts Wouldn't most people say that hackers are actually uncommon because a lot more is done server-side than in other games? Also it seems like cheats are more prevalent nowadays, but that's because a lot of them are peripherals instead of just software that reads ram or scans the screen to do things like give you aimbot

[@johnsonfromml8662]

Source: trust me bro pretty much all games with kernel have fewer cheaters, you delulu rip bozo

[@qwertiasdef]

companies pushing bad code isnt the only issue- what happens if a malicious actor gains access to the software and pushes an update to the anti cheat i.e. solarwinds? millions of computers could be compromised at a kernel level.

[@tommolldev]

That would literally be the case for any other massively deployed software

[@delofon]

​@@tommolldev"Any other massively deployed software" is kernel level too?

[@Razer5542]

@@delofon I mean, if you were to take windows itself for example which is kernel... If that were to push out malicious/infected code, it would pretty much cause issues for the entire planet considering how many people out there using windows.

[@Raspredval1337]

plus, kernel lvl anti-cheat are gate keeping games on Windows

[@hkanything]

The anti-cheat in Apex Legend allow hacker to remotely install cheat during a tournament. That is the best show of how terrible kernel anti-cheat can go wrong

[@quadrantthree]

I think it's more so security flaws in the Source engine (Apex runs on a modified build of it), but yes, the cheaters on Apex are absolutely absurd. People should know it's bad when things like this are still allowed to happen.

[@lilililiililili6363]

@@quadrantthree Thanks for pointing that out, like all valve games apex legends uses the source engine which is a modified quake engine (notorious for being full of RCE exploits.)

[@gamersworld4176]

thats not the anti cheats fault, thats the game engine( source engine) fault. even EA acknowledged that

[@sleepyspeller7805]

I'd disagree with saying kernel level anti cheats dont help. They do, and a lot

[@MaakaSakuranbo]

Reading the comments here, we clearly need better anticheat. In addition to kernel-level anticheat I propose requiring a working webcam that records your face as well as your mouse and keyboard to monitor if your inputs line up. Further, there will have to be a clock in the background and the daily newspaper of your local region (the one registered to your account, which the kernel level anticheat will check is the right location too). Then another camera on your PC insides and outside so we know you aren't hardware cheating. An AI will evaluate all that to make sure it's accurate without needing huge human oversight. I really wish we didn't need all this, but it's needed to make sure there aren't any cheaters, so what can you do.

[@gamersworld4176]

way too dark.

[@TRDiscordian]

​@@gamersworld4176it's honestly the same argument supporters make though

[@aeolianthecomposer]

All online games should also require passport id, pc specs, blood samples, your home address, your router ip, your car license, your diploma, your credit card, your cat's name and information about your favorite type of coffee, to make sure that noone can cheat again.

[@sysofficial]

​@@TRDiscordian That's just not true? How can you get that from the "arguments" pro-kernel supporters make? This is so far-fetched, that I can't see you writing this comment for any other reason than to just disagree with one party. Webcam on your face and keyboard is extremely stupid, and violates so many privacy laws. You cannot compare a program to a literal collection of video recordings being taken at any time whilst playing a game. Are you missing your frontal lobe?

[@TRDiscordian]

@@sysofficial your side literally advocates for access to the entirety of my system in exchange for safety, it's the same argument you're just slow.

[@xperhkx]

We are starting to see this not only in the gaming category but in real life scenarios as well. Companies are slowly turning towards the right of repair which in short evaluates if you can tweak that product you purchased or not, and doing so they can stop services or remove any warranties you had. This isn't exactly the same thing but overall companies are just trying to have a hold on everything even the products they sell to you. It's only a matter of time before we don't actually even own the things we buy and we won't be able to do anything about it.

[@nanopi]

Microsoft agrees, they're going ahead with making the micro-kernel they wanted a long time ago.

[@David-gz7ds]

I agree that giving kernel level access is not ideal but your point at 2:20 myself, and many other included have seen serious benefit to it in terms of prevent cheats. As a FACEIT player I have ran into far less cheaters in cs compared to playing their premier mode, so while I don't like the idea of FACEIT having kernel level access I also accept that there is benefit to it.

[@Aigis31]

There's a big difference between third party kernel level anticheats and first party ones imo. You had to opt in to the third party one and are made fully aware of how intrusive it will be, deciding that it's worth it for high level play. Unfortunately, not everyone is as aware when it comes to first party anticheats, especially with regards to how invasive they can be. Millions download them every year, and when the average player is unaware of how it works and what they're really giving up to play them, it becomes a huge problem. Suddenly a hacker could hack one of those anticheats and send malicious code to millions of unsuspecting users.

[@indi353]

love the random legendary transition at 1:35

[@sockpuppetcow]

The amount of times my PC blue screened because of Easy Anti Cheat is why I don't play Apex anymore

[@nobbyfirefly57]

Agreed, if cloudstrike, kernel level, crashing causes the world to go under, god knows what would happen if the anticheat crashes. Update: I posted this before watching. You actually mentioned cloudstrike.

[@JoyBoy-ei7bg]

It's not even cloudstrike, it's crowdstrike. An anticheat rarely bsods and bsods is not even that bad. Just restart your pc???

[@nobbyfirefly57]

@@JoyBoy-ei7bg did you even watch the video? They had to fix it manually. The average user doesn’t know how to fix it.

[@JoyBoy-ei7bg]

@@nobbyfirefly57 Crowdstrike and anticheats are radically different…

[@forestcat512]

Another important argument you did not mention is that kernel level anticheats can have vulnerabilities, which allow malware to easily obtain system privileges and deactivate your antivirus etc.

[@psygreg]

The funniest part is that Overwatch's (Blizzard) anticheat, internally called warden, by playerbase discussions seems to be the game with the least amount of cheater issues. So it's not like kernel-level anticheats offer any benefit to a simple server-side solution.

[@kruppelfield]

It will not cause the same effect as Crowdstrike. These kernel level anti cheats usually start when trying to play the game, only the ones like Vanguard that runs consistently in the background since the system start could cause similar damage. That majority when it would crash your computer would be resolved after simple reboot.

[@theyellowarchitect4504]

kernel level anti-cheat is proof your netcoding is not good. Clients have data they shouldn't have of other clients, and the bugfix is simply a rootkit... Doubling down on incompetence.

[@0xGRIDRUNR]

this has always been the core issue with kernel level anticheats lol. I can understand people outside the security community potentially not being aware, but an anticheat needing kernel access has always been a red flag for people within the cyber security space

[@ScarySkele]

The thing is, I don’t like consumers being treated as a product for stock holders….. I want the consumers to be respected and treated with dignity, seeing Crowdstrike & Microsoft & xbox Live all f up tells me Valve can do the smart thing by actually taking a stand with the consumer and not third party bs. Valve NEEDS to get rid of Anti Cheat NOW!

[@drjamaymay405]

I don't like kernel level anti-cheat, but it is the best anti-cheat method available. its like coal, horrible for the environment but very good at producing energy. I want a coal alternative, but nothing is ready yet(nuclear please) valve should lead the charge and create the next generation of anti-cheat

[@Marcior2405]

@garbaj I would not agree that VAC is as good as kernel based antycheats. While you could not play on official servers, as in each 2-3 matches you had somebody freely spinbotting without any bans, you could play as usual on Faceit platform, which have their own antycheat. We can discuss if they were not banning people as they wanted to feed their AI based solutions or it was just garbage protection, for me any kernel lv antycheat > vac

[@rami-succar7356]

i'm glad you're back to making videos, they're all really insightful even if it's something i already know about

[@minneelyyyy]

That's not to mention the possibility of a bug in the driver like a double free or some memory/logic bug that could theoretically allow an attacker to hack the system. We've already seen it happen at the level of individual videogames where RCE is possible, now imagine that but the attacker now also has kernel level access.

[@n00dl3]

I don't think they even need to push "bad" code and trigger a collosal outage for anti-cheat to be hazardous. It being there is simply a risk in the first instance. It's another piece of software running on your PC that runs the risk of being exploited, but with access it doesn't really need.

[@everyone01]

The probability of that happening to crowdstrike was also low, yet, it happened Kernel level anticheats just open more ways one malicious attackers can ruin a device, not one, but millions

[@delofon]

yet another average garbaj w (why did youtube stop recommending your videos to me i love your stuff 😭)

[@leiterfurkundenzufriedenhe1884]

I am against kernel lvl anti cheats BUT in what universe is valves Anti-Cheat "just as good" as others??? That's the real hot take of this video

[@gamersworld4176]

same here. VAC is dogpupu compared to like vanguard or easy or battleeye.

[@hairen68]

he clearly doesn't play cs, his gameplay is enough to show that. he doesn't have to deal with the hackers.

[@TRDiscordian]

​​@@gamersworld4176BattleEye is the only AC I've tried to circumvent myself (write my own cheats) and it took me an afternoon. I assume others are better.

[@minneelyyyy]

well like a month ago valve has gotten rid of the bots in TF2 and since then I've literally seen one, so it clearly can work, just requires maintenance. Which, that's not even to say that the kernel level anti cheats don't, they most definitely do.

[@hairen68]

@@minneelyyyy bots and hackers are 2 completely different thing. they should've been able to get rid of the bots years ago. cs2 is still unplayable from hackers unless you play faceit

[@flashpoint5292]

This kind of anticheat is really only a barrier of entry sort of thing. It's not meant to work against actual cheaters, just script kiddies. It's a balancing act that anticheat will always lose

[@notplancha131]

I disagree with your reasoning but generally agree that kernel level anti cheat is not great.

[@tomekk.1889]

"Thing bad. Make thing good instead" God what brilliamt commentary. What would we even do without your insight. If you don't have anything to say just don't say anything. It hurts when nontechnical people try to "solve" technical issues

[@inqow1886]

thats not even taking into account how maliciously all of these anti cheats could be used

[@4547466]

The main issue being that games are competitive and need a way to prevent kernel level cheats. In a perfect world where no one was cheating, yeah I agree. Unfortunately such a perfect world doesn't exist, and these anticheats at the very least block the easy stuff. Of course someone can make bypasses, but it requires a lot more knowledge and the barrier to entry is much higher.

[@MaakaSakuranbo]

What about hardware-level cheats? Will we require extra anti-cheat hardware in our system? :D

[@gamersworld4176]

@@MaakaSakuranbo maybe something like tpm 2.0 module will be introduced in future which can detect each of the hardware connected to the cpu and that module can be used by anti cheats. untill then we have to rely on manual detection.

[@deadhouse3889]

Hey, Garbaj, everyone here.

[@taeliantalittia612]

Counter Strike: *turns into Crowdstrike Players: *surprised Pikachu face

[@TrixterTheFemboy]

That you very much for this alert. I just went through and fully uninstalled Easy AntiCheat, including its program from the command line (and the one game I had that needs it, 7 Days To Die, a primarily PvE game that is player-hosted server only and really doesn't need a client-side anticheat in the first place), and I'm about to see about going through and removing nProtect from Helldivers 2 if at all possible as well.

[@TrixterTheFemboy]

Welp. There's no way to bypass it I could fine other than crazy shady shit, but at least I can uninstall and reinstall it after and before playing

[@captainjimo]

@@TrixterTheFemboy you can run 7 Days without Easy anti-cheat. It is literraly in the launch option after you press Play in steam. Or if you have previously chosen not to ask, then it will be in right click>properties>launch options. final version. If you have it from somewhere else, there shouls be 7DaysToDie.exe (this one has NO AC) and 7DaysToDie_EAC.exe(this one HAS AC) in the game folder

[@RoboGameOfficial]

kernel level anti-cheats are Garbaj

[@aeolianthecomposer]

The problem is that non-Kernel level anticheats are Garbaj too

[@OmeletteGirl]

Love the video, also love that you watch low level learning!! I trust riot about as much as crowdstrike because they're super pedantic about their products and likely have an army of security researchers looking through the code very carefully before they push it. Even then something can still happen. Now, with that in mind, how much do you trust smaller teams like the group behind Helldivers 2? Their game is great but it has plenty of silly bugs, it would be a shame if 1 of those silly bugs crashed your pc. And as kernel level anticheat gets more popular, companies with bad quality control have a higher chance of using it. Yikes.

[@OmeletteGirl]

Ooh another thing, kernel level anticheat just makes it so cheaters have to use kernel level cheats. No anticheat will stop every cheater, so do you really want to encourage scrubs to brick their pc by downloading an unmoderated cheat engine? I think regular anticheat keeps the number of hackers down enough to where you can use moderation teams to clean up the rest and it will always be that way. No one wants to use kernel level code if they dont have to...

[@sillypuppygurl]

@@OmeletteGirl tis is wrong they would use kernel level anticheat anyways, while usermode anticheat can be effective there is certain stuff that you just cannot check from usermode making it easy to evade completely from kernel level

[@tauon_]

having issues with my sound rn and i got scared even though i saw your warning 😭 (not mad dw)

[@QuestionableMorality]

Saying Valve's anticheat is as effective as other anticheats is ridiculous. Look at the state of tf2 and csgo. I have encountered countless cheaters and bots in those games. I've played Valorant for hundreds of hours and have not encountered a single cheater. But then again, maybe that's just because the Valorant team devotes so much time and money to stopping cheaters.

[@inceneration]

Nope... The reason why VAC doesnt work is because it doesnt have the abilities to detect cheating software unless it is altering the DLLs and gamefiles directly. Vanguard check the code constantly during gameplay and with kernel level access has the ability to modify the files back to before and check if they get changed again. "bit untechnical talk" but it pretty much in that jitz. Kernel level is bad for sure, But it is seriously the only way to combat the rampant cheaters arising every day.

[@x_9910]

@@inceneration Except, VAC does do integrity checks on the memory of the application and the loaded libraries? Where are you getting your information?

[@c.E_VO]

couldn't agree more! i dont really have anything insightful to add, just a "the only one i trust to inject into MY kernal is Garbaj" joke

[@lorenzobuero7115]

This clownstrike-like situation wouldn't be that big of a deal if those anti-cheat wouldn't auto start when the computer is booted clowdstrike's app had to bc it is an anti virus, anti cheats have not need to do this, but most still choose to.

[@drjamaymay405]

they do it because cheats are much hide if the anti-cheat started first.

[@lorenzobuero7115]

@@drjamaymay405 that makes sense, it is similar to why an anti virus would do it. The difference is that anti virus are much more important than games.

[@theblackcat4941]

I am surprised how much behind Valve's anti-cheat compared to the simple Easy Anti Cheat. I know it's not perfect, but I can assure you that I never had the feeling of "This guy must be a cheater" in, for example, Fortnite. I agree with your point Garbaj! Kernel anti-cheat is not the way to go. It doesn't even look like there are any improvements to it. When Riot implemented it what was the time until a running cheat was brought to the light? A week? A day? 2 hours.. and that's the one we know of! Overall this gaming wide cheating problem seems to be in part caused by the ease of cheating, the general public that looks at a small point of a bigger picture, and, most importantly, the maturity of gamers. It seems that nowadays the average age of a "Gamer" goes lower and lower, and with it goes down respect and maturity that gamers DO IN FACT NEED. Great video @Garbaj and I'm happy for your comeback!

[@drjamaymay405]

if you tried really hard you can cheat in any game. the point of anti-cheat it to make cheating so annoying that most would be cheaters give up. gaming is online and anonymous, until real world punishments are implemented nobody will take gaming seriously. anti-cheat is the only way.

[@theblackcat4941]

@@drjamaymay405 Ofcourse, but being anonymous does not mean rules should not apply. My point was that people cheat more now because there aren't as many mature players that can play by the rules, supported by the ease of cheating and lack of a more roubust anticheat makes online gaming less enjoyable than 10 years ago. Your point is great but there's more to it.

[@diaxovy]

As much as I hate kernel-level anticheat, it does workand games like fornite or valorant have almost no cheaters

[@SFreakHD]

i think they do, but they cannot cheat as blatantly since it would trigger a hardware ban that they cant get around so easily

[@NookQ]

@@SFreakHD Spoofing hardware isnt hard. But your correct most cheaters in these more popular games dont go full blatant as they can last a long time.

[@MURINEg]

i dont mind kernel level anticheat , but that dont mean i dont hate it

[@sys_key3287]

it kinda means you dont hate it, if you're willing to use something you dont hate it

[@MURINEg]

@@sys_key3287 its just like a love\hate relationship

[@bitcoinweasel9274]

@@sys_key3287 I dunno, I use Amazon.

[@crimesleigh131]

@@sys_key3287 use of basic logic??? thats blasphemy

[@liubodimaka7272]

@@sys_key3287 I hate paying taxes, but I still do it

[@rogercruz1547]

Let's not forget that cheat developers can circumvent kernel level anti-cheat, which means, the cheat developer now has access to ring zero because it can inject code into the anti-cheat and it has way too much priviledge.

[@JoyBoy-ei7bg]

Uhm... hello? Do you know what you're talking about? Cheat developers always had access to ring 0 or cpl 0 and they do not inject code into the anticheat??? I think you're clueless about what you're talking about

[@eedut]

As a cs player I have to disagree. (I play faceit and it has kernel level ac) In valve servers there are way too many cheaters to take the game seriously. I don't care if faceit ac would brick my pc. I would't need a pc if I couldn't play on servers protected by good ac.

[@lln6123]

Thanks for the video, it fucks me up so hard to hear the majority of friends/fellow students tell me that kernel anti-cheat would be a valid solution.

[@poom323]

Valve unofficial slogan "we care you more than your government"

[@nelly-lu3dq]

fuck mate i just wanna play without cheaters

[@patrlim]

Kernel level is NOT required for that, it just makes it easier.

[@specialk9762]

@@patrlim thats assuming the cheat doesnt work in ring 0. If anything we need an anti cheat like faceit that only runs when its being used and can be reopened without a restart

[@hakube34]

@@patrlim but all non-Kernel level anti-cheats are bad

[@pronub2384]

​@@patrlim Yeah, like WAY easier!

[@Creepus_Explodus]

@@hakube34 Kernel level anti cheats can then be circumvented by hardware. A dedicated enough cheater will always find a way, but I would rather not have spyware installed as a kernel driver. If any of these companies get hacked, that anti-cheat becomes one of the most powerful remote access trojans a hacker could ask for, all willingly installed without a second thought. Put something like Windows Recall on top of that, and now you have a remote access trojan that can automatically find a convenient database of everything you've ever done on your PC. Are you still sure you want kernel level anti cheat?

[@MonkingFlame]

depends on the way the kernel level gets accesed. when it is on boot like vanguard than it poses the same problem as crowdstrike. but when it is smth that can be launched after boot, like faceit, than there is less of a risk for a crowdstrike situation. the PC would bsod but it after a reboot it would be fine. just don't launch faceit again until that is fixed. The best anticheat system I could come up with is either a serverside ac that detects strange behavior. like someone wallbanging across multiple walls consintently or smth like that. The other option would be smth like stadia or luna, where the game is streamed from a server to your client. with only inputs and no way of code manipulation that seems hard to hack. no esp or aimlock should be possible. only slight things like having image recognition to than alter mousemovements for targets on your screen would be possible.

[@shellawa]

fyi faceit ac has a kernel mode driver that is loaded at boot, so a crowdstrike situation can happen with it

[@GragCM]

Saying vac is equal to any other anti cheat is crazy. Vanguard has so little cheaters and most cheaters are unnoticeable by a player if they are unnoticed by vanguard, but bro step foot into a cs comp game and pray to the lords to at you don’t get 3600 flicked by a spinbot awper off spawn through the entire map.

[@evankim2406]

He didn't say that in the video.

[@GragCM]

@@evankim2406 I edited for you sir

[@evankim2406]

@@GragCM That's much better.

[@redbandanacat6206]

Yeah. Saying VAC is just as good as other kernel level anti cheats is straight up delulu

[@diamster]

Played recently with friend, got to play on prime against a hacker with blatant wh/no aim recoil/perfect accuracy(all can be seen from replay), reported ingame, reported his profile and sent a ticket to the support, results? he is still playing just fine.

[@michealwhitney8966]

As someone who is the highest rank in both valorant and counter strike, I have decent insight into the amount of cheaters each of these games have. In my 2~ years of playing valorant ranked, I have come across two cheater in my ranked games. Two instances. Just last week, I played 3 games of competitive with my friend who is new to the game (prime matchmaking) Every one of these games had a guy blatantly cheating (spinbotting bunnyhopping etc). It was essentially a waste of 1-2 hours. I’m not saying I agree with Kernel level anti cheat and its methods, but from my experiences it works. In VALORANT, cheaters never made it far enough to make it to the highest rank, they got banned before then. In counter strike 2, half of the top players leaderboard are cheaters. Just my 2 cents, as someone who has thousands of hours in each of these games.

[@JoyBoy-ei7bg]

You also got closet cheaters... like me.... in radiant :D

[@GC-jm9bt]

Kernel anti-cheats are kind of necessary now to ensure the integrity a system. The only real solution would probably be at the OS level. Basically having a separate gaming OS/special Windows mode where only hardware drivers are loaded(like graphics card and soundcard drivers, but not antivirus, anti-cheat and other kernel drivers). Like an advanced version of Secure Boot. Severely restricting to what code can run in kernel mode. Another approach would probably to make it cheap/easy for game developers to sue cheaters. Right now game developers only go after the cheat developers. In some countries they made it easy for the movie/music industry to send fines when you illegally download music/movies. Cheaters might think twice if they can get in legal trouble for cheating.

[@x_9910]

Except, normally, by default, you can only load signed drivers on Windows? You don't even need secure boot for that...

[@kurdstan5449]

you are absolutely right!! and that is not to mention the false bans i have been banned twice in valorant due to only having cheat engine installed like ????? like your anti-cheat must be the worst there is for it to ban people simply because a popular program like cheat engine is installed on your device and i wasn't even running it while playing in fact i didn't even play i installed the game and it just banned me before i could even play

[@JoyBoy-ei7bg]

Just having cheat engine installed doesn't ban you... you probably tried to attach it to valorant or something. Or maybe you loaded a driver cheat engine uses....

[@WhatIsSanity]

I think the CrowdStrike debacle has little relevance to the current issues with anti-cheat software. The kernel access is from my limited understanding merely advertising fluff that software companies started pushing when they ran out of pure software solutions to cheating, and for various reasons studios decided to take it seriously. At the end of the day effective anti-cheat measures require active oversight by dedicated moderators, but that requires effort and money which publishers refuse to invest and smaller devs can't afford. Anyone remember the days when 100% of anti-cheat was community moderators and admins? It's still the most effective measure to this day, to the point that people sick of cheaters and griefers/bullies in their favourite online games make private servers because the anti-cheat software isn't doing anything to help. Passive ac is just smoke and mirrors to shield studios from liability.

[@Duckleeng]

It's important to note that a 2nd CrowdStrike situation would only happen if the anti-cheat runs on the system all the time (like Vanguard). Anti-cheats like EAC only run on kernel-level once you open a game, in which case you would only BSOD upon running a game, which isn't nearly as bad.

[@Akronsus]

I believe we don't go far enough with anti-cheat, therefore I present my idea of colonel-level anti-cheat. Every time a player starts an online game, a colonel will be tasked to observer the playing session in person. That way hardware cheaters won't have chance

[@meyers0781]

the alternative is either: 1. make the online competitive fps crumble especially for the PC or 2. make a Virtual Machine powered game. As you know games like CS2 and Valorant shouldn't be resource heavy. Therefore, make them ran in a virtual machine as soon as the executable is launched. The virtual machine is then verified by the master server to check if it's have been tampered with external coding (apart from I/O) or not. I was inspired by this because this reminded me of playing CODM in Bluestacks and PUBGM in Gameloop.

[@SFreakHD]

Why would running it inside a vm help? hackers could simply modify / fake the verifying process

[@x_9910]

Why are these your only two options and what is a virtual machine to you? You understand the VM is still on the clients computer, mostly, if not all in userspace, correct? which inherently makes your integrity checks flawed by trusting the client and what they send. Also, what do you mean "... tampered with external coding (apart from I/O) or not). ..."? Tampered by? Again, any checks on the client are done in userspace, again, flawed. Not to mention performance hinderance by running an entire subsystem on your system lmao, even with partial virtualization, you still have performance impacts by emulating an entire CPU, mapping/executing instructions, handling syscalls, etc. Maybe you have ideas mixed up, Bluestack is for cloud gaming. Which is a great idea to shift everything from client hardware, except... latency in a competitive game is an awful thing to introduce, even in the slightest amounts.

[@Pappalardium]

There's also the problem that some of them can't be uninstalled so it's like if you installed malware

[@ocsanik502]

Kernel level anticheat also comes with the extra issue that it usually limits what devices you can even play the game on, for example roblox is impossible to play on linux, even if you utilize a virtual machine because it thinks virtual machines are just people who want to bypass a hardware ban.

[@EdenThenen]

100% agree what you said (i'd never thought we'd see you on CS)

[@Tyretes]

the future of anti cheat is having a person stand next to you watching you game.

[@mble]

2:00 It is not even about loosing access to all of that data, but also about getting hacked, where the hacker gets that data. If someone figures out how to hack kernel level anticheat, they have more privileged access to your system, then you do

[@JoyBoy-ei7bg]

Just a side note, Microsoft already has a backdoor on your pc that spies on everything. It's too late.

[@skeleton_craftGaming]

I think we need to get rid of automated anti cheat all together, like you said they aren't effective. But what you left out is that these companies use them as a crutch to not moderate their games. [Looking at you in particular valve]

[@x_9910]

So when you have tens of thousands of games being played a day, what's your solution? Manually review each game when a certain threshold of reports occur? What percentage of reports do you think are honest? Are anti cheats not a tool for moderation?

[@te0204]

kindly, i disagree, i think i have a decent view from both POV's as i used to be a kid who's spent over 6,000 hours of his childhood on csgo, although i've barely touched it in the past 2-3 years, i still very clearly remember how much rather i'd sell my soul to the literal devil than have to play another game with a person blatantly cheating on the enemy team, stuck in a server with them for 30-40 minutes at a time, unable to leave or i will be penalized and unable to play the game again for 30min, 2h, 24h, 7d, and now i'm one of the adults with a job and personal files, documents, and passwords that i'd rather not lose, on my PC, A) even if another crowdstrike-like event were to happen but this time with video game anti-cheats, the damage isn't permanent, and i cant really imagine a scenario where it would be permanent, if we're talking about personal computers it would have been an inconvenience at most, you could fix it yourself in minutes, or if the person in question really is so tech-illiterate that they couldn't follow the tutorials on how to fix the issue that im sure would be up within if even 4h (which, nothing wrong with that, we've all got strengths and weaknesses), they could take it to a repair shop or ask a friend or a relative to do it, there's just no scenario where this is more than an inconvenience, and i feel like to the demographic in question, having to deal with cheaters every day is a much bigger inconvenience than >a possibility of something maybe happening once, for a couple hours, or maybe never at all

[@hungryhedgehog4201]

it doesnt even stop cheating like there isnt a single anti cheat that actually works. The only anti cheat that works is community moderation. Back in the day we didnt have rmt, we didnt have invasive anti cheat, if someone was cheating and it was noticable, people would kick them, either by vote or by a mod or whatever. If you had a server but didn´t moderate it you´d quickly loose players. But games aren't designed like that anymore, they are design as cash shops, with grind attached. So Cheating becomes more lucrative, people wanna skip the grind, make money with rmt or in tournaments. The problem isnt the occasional script kiddie that is ragehacking they are easily caught and banned, the problem is that it's now an entire industry to squeeze money out of games, in one way or another.

[@TRDiscordian]

This comment says it all.

[@ilegitcookie]

That only works in smaller scale environments, where community run servers are king. When it comes to a larger scale, you need some kind of automated process because there will literally never be enough humans to look at x cheater to ban them manually, it's just not feasible. The only real "solution" to cheats is by reducing how accessible they are, because a dedicated cheater WILL be able to get past the system in some way, but how fast the anti-cheat can adjust and flag those new cases is important to keeping the gamestate healthy with a reduced amount of cheaters. Unfortunately, kernel level anticheat is the only real method of keeping cheats inaccessible to most, in which someone needs convoluted setups or even a separate pc to even cheat, and that's honestly the best case scenario. It sucks, but there's really no way around it.

[@TRDiscordian]

@@ilegitcookie you're wrong, uncreative defeatist opinion. Fortnite uses server side AC and heuristics, best method available rn. Edit: Stand corrected on FN using it, still the best method around.

[@ilegitcookie]

@@TRDiscordian no it doesn't? Fortnite used both BattlEye and EAC which are both kernel level anticheats. Server side anticheat wouldn't ever be able to detect something like wallhacks by the way... It'd be a fool's game to try that for an FPS.

[@TRDiscordian]

@@ilegitcookie could do wall hacks if positional data is only given if sight could be established

[@pogsterplays]

One thing I need to point out: It'll only interrupt the kernel IF the program is active in the kernel (running). In CrowdStrike's case, the software would start on boot, which created the infinite BSOD loop. If a kernel anticheat had bad code, it'd just BSOD you when you open attempt to execute that faulty code, which wouldn't happen by default. So for kernel anticheat it would create a bootloop. It would be BSID you once, then you could just find and destroy/update etc the program

[@sventomasek]

I don't really agree with 2:20 Compare CS and Valorant. One has a cheater nearly every match and the other has almost no cheaters, and the cheaters that it has can only do stuff like slight aimbot, wallhacks and triggerbot or they get banned really soon. The problem with a non kernel level anticheat like VAC is that anyone can download a free cheat and you can cheat for at least a week without getting banned, if you're at least trying to hide it. Be a little more careful and go with a $10-$20 cheat and you might not get banned for years. To do that in Valorant you need to spend a lot of money on undetectable hardware. It has a much higher barrier of entry thus lowering the number of cheaters by A LOT. The point of an anticheat is to reduce the number of players cheating. Just because it doesn't remove 100% of the cheaters doesn't mean it's useless. Would I like it if we wouldn't have to use kernel level anticheat? Yes, but until someone makes an alternative that works better or just as well that's just not realistic.

[@gamersworld4176]

well said.

[@shellawa]

I completely agree with the comparison here. I think we should cope with klac until there's a better solution (not very likely)

[@SK-zu8pw]

100% true. The only alternative to kernel anticheat is facing cheaters every game. I switched from premier to face it and it changed everything.

[@thebrr3594]

Totally agree with you

[@WouterB21]

couple months ago i installed warzone again because a friend wanted to play it with me, next day my PC had bluescreened. Now there's no way to confirm it was Ricochet (COD's anticheat), but it's pretty likely that that's what caused it. Had fresh install windows to fix it. Luckily i have most of my stuff on separate drives, but it was still a two day job to get roughly to where i was before with programs that i frequent. Needless to say, I agree with your sentiment.

[@mrogalski]

Weirdest thing is that most of the poeple started to think about this just after totally unrelated case of CrowdStrike but noone ever mentioned that gathering and analyzing proper logs in realtime can be more benefitial than these shit anticheats we currently have...

[@elliejohnson2786]

Yup... So many people think the solution to cheaters is a single anti-cheat, and that "surely" kernel-level would make it better. But, in fact, it's a much more complex and nuanced problem.

[@duqueduk]

i'm loving your voice!! :3

[@CatMeowMeow]

I completely agree with you, kernel level anti-cheat needs to go. However, I'm not so convinced that anti-cheat utilizing kernel level makes no impact on how effective it is. Surely, this raises the barrier to entry of creating cheats, wastes anti-cheat developer time to bypass, and therefore means less cheat developers have good cheats/any cheats developed at all. I'd like to see kernel level anti-cheat not be a part of the base game, but for places like faceit I think it makes sense.

[@hepticftw]

It’s more in my opinion about deterrence, dedicated cheaters will cheat no matter what but you can minimise the amount of people willing to by adding a hard money / technical skill / time gap to be able to effectively cheat

[@xfrankenstein6981]

we surely aint saying VAC is even remotely comparable to riot's vanguard when it comes to detecting and banning cheaters right?!

[@gamersworld4176]

yeah. not even close.

[@dexterity494]

I 100% agree and I don't think kernel level should be a thing... But I also haven't seen a single thing online about valorant getting swarmed with cheaters, so I can't say it doesn't work.

[@jimbobinator]

While I agree the concept of kernel level anti-cheat is bad, its unfortunately nessesary. Every single cheat for modern games run in the kernal too, and the only way to counter this is with a kernal driver.

[@vilian9185]

1:50 the thing is that crowdstrike made a lot more money than games, and even them fucked their code, how long until enshittification affects the anti-cheat

[@universalserialbusman]

Imagine quality studios like Bethesda putting ANY code into your kernel :)

[@captainjimo]

some ant-cheats are way too aggresive. Example is Riot's AC, it detects Citrix (a remote desktop program i use for work) and refuses to run any of riot's games. Like how is a professional remote desktop app considered a cheat? (it probably sees it more like a VM, but still)

[@k0mmand]

If devs push for a kernel level anti-cheat in your multiplayer game, whatever it may be, they have to be extremely paranoid about any and all vulnerabilities within that anti-cheat, and for good reason, because, by Murphy's law, if something goes wrong with it, it will go wrong, and it will be DISASTROUS. Better safe than sorry, they say.

[@mistahstyle]

Agreed, most games with kernel anti cheat have people cheating on social media, posting on yt, tiktok and even twitch... The only thing it does "help" with is if they want to ban someone toxic...

[@p1xldev]

What you're forgetting is that CrowdStrike uses boot-start drivers (iirc), which means they load when the operating system boots up and continue running in the background. This deep integration is necessary for endpoint protection but also means that any issues, like the recent faulty update, can cause continuous system crashes. Kernel anti-cheats, on the other hand, generally run only when the associated game is running. They usually don't persist in the same way CrowdStrike does, which mitigates the risk of causing similar crashes. While there are some exceptions, the typical operation of kernel anti-cheats is more controlled and limited in scope compared to a full-fledged security suite such as CrowdStrike. I'm not saying that a kernel anti-cheat is the best approach, but it sure is better than a user-mode one.

[@YOUnoobGER]

I dont like the arguments. - Loss of data: Can occur at any time, even by software not running in Kernel mode. Afaik, even steam deleted data on Linux with a broken command, without Kernel level. You need backups, always. - Faulty code that breaks your system: Any driver, any software can do this - VAC is totally broken, it is not a good anti cheat system; if you watch documentaries about CS cheats or look at forums, ready to use scripts are available that are able to bypass VAC - VAC is so bad, people use a platform with kernel level anti cheat: Faceit, and even pay to use the platform to circumvent the absolute majority of cheaters that are located in their skill group - Vulnerabilities: The vulnerability of kernel level AC is so overhyped. Any software that you install on your (Windows) machine is able to log your passwords, steal data, get root access etc. Yes, kernel access is "more dangerous", as it has more control over your system, but 99% of the problems occuring on systems is because people fall for fishing attacks or open a random file attachment that is a virus People demand kernel level AC (especially in CS) because there is a cheater Problem for years now.

[@Gr00t]

I'll take the risk, cs is so fucking infested nowadays. Cheating should incur jail time.