League of Legends INFECTING Windows Users with Rootkit

[@BinaryZeroTV]

I uninstalled it, and I hope more people choose to uninstall it too. This way, they'll see the player base shrinking more and more, which may eventually prompt them to implement a better anti-cheat system or remove it altogether.

[@felderup]

does uninstalling also remove the rootkit? since it runs when the game doesn't... maybe it isn't uninstallable with their game uninstaller.

[@felderup]

@s052e is what i thought, so, binaryzero's no safer.

[@davo4074]

people already did that (myself included) then riot came out and said, " we've seen a drop in *bot accounts* and *scripters* ". anyone who criticized the decision of implementing vanguard got banned and called "down vote bots" in an official riot dev post.

[@dasgeek]

One thing I want to add. Even if LoL was trustworthy which by all accounts they're not, putting a backdoor on someone's computer opens up for all types of vulnerabilities that can be exploited leveraging their kernel level backdoor. This is not only unnecessary it's dangerous and shows how little they care about their player base.

[@Gramini]

That scenario may sound very theoretical, but it already did happen like 2 years ago with the anti-cheat of Genshin Impact.

[@jimmym8741]

“If Riot hasn’t earned your trust, don’t run our software” 😂😂

[@Grant_S_M]

Boycott gaming companies who are actively hostile to Linux users.

[@W.A.-Linux]

100%

[@Mr0utsider]

Seeing as how i'm on linux, boycotting is not optional for me right now. I just can't play the game. XD

[@Grant_S_M]

@MichaelDustter Great point!

[@MathiasShaw637]

as a windows user I shall join your boycott

[@carloshenrique-fj3eb]

I sign the boycott, we are a total of 10 gamers who use Linux

[@cubiss1273]

"It's the same set of developers who work on the game". I've played the game for over 10 years. And the above is exactly the reason I don't trust them to write a robust software. I'm actually a bit surprised nobody has yet discovered that Vanguard is being used by hackers.

[@michael_tunnell]

Maybe we haven’t heard it being used yet is because the hackers don’t want to reveal their golden goose

[@polyjackets8659]

You: have a pc Riot: is for me? 👉👈🥺

[@HumbleBountyHunter]

No matter what it takes, anti-cheat is going to have to move server-side. Sever-side would mean it would be (1) in complete control of the game dev, (2) platform agnostic, (3) safe and privacy-friendly. There needs to be an arms race among all the big gaming companies, as well as third-party and open-source, to develop good server-side solutions that actually work.

[@reallogic4991]

Shit take, AC will continue to be more intrusive on the client side because that's what it needs to monitor, it being moved to the server side makes no sense.

[@HumbleBountyHunter]

@@reallogic4991 Some cheats don't even need to run on the same PC as the game. It can't be monitored. Server-side would monitor behaviors (not PC processes) like a referee.

[@reallogic4991]

@@HumbleBountyHunter Client side cheats need to be run on the client, if you're talking about hardware on monitors that detect pixels, moving to the server side wouldn't prevent this nor would it cover the plethora of other existing cheats. There is an upper limit on what the server side can discern as cheating. That's why there are client side AC tools.

[@HumbleBountyHunter]

@@reallogic4991 I was not talking about display monitors, but client-side also would not detect this making it unnecessary. Not all client-side cheats need to run on the same PC as the game. Some can run on a second PC, or run the game inside a VM and run cheats outside the VM. There is an upper limit on client-side detection as well. Considering the rampant cheating in some games and the obfuscation of the cheats improving, I think it is a losing battle. Newer CoD games use RICOCHET AC which is mixed (client & server). The devs actively monitor games (server-side) and nerf cheaters so they can't win. It uses a KERNEL-LEVEL driver that isn't good enough on it's own and needs server-side to help. When the most invasive client-side AC doesn't even work well, we need a new approach. Remove it from player control and put it on the server.

[@ThePyramidBox]

@@reallogic4991 That's not true, you don't need to use document suits on PC anymore and protect them from piracy using anti piracy kernel level software - you can use them online now - without giving up on functionality - so why - one of the most responsible parts of handling documents - which potentially can lead to more looses - CAN be on Web side of things - while a GAME which works SOLELY if you are connected to web servers - to actually install anti cheat software? If a player is cheating - you WILL notice it on server side - because - client MUST report the executed operations to server back - so it can then pass it to other players - okay, I might agree that office suits are a little bit off topic - but lets consider situation where's someone is using Wall hacks - you can LITERALLY prevent that by using two tweaks - first - is to NOT render model of character until it will be visible - second - is to NOT send any data of positioning of enemy's - you can't steal something which is non-existent - this solution will actually BOOST network stack optimization - and, potentially - the in-game performance - all of other type of cheats - are detected or by simple checksum utility inside of launcher to verify integrity of files on the boot (which will actually not only be more safer and less intrusive - but will actually force devs to store game files in more optimized way - which in-fact - should help with performance on Hard Drives), so there's no need to implement the rootkit backdoor into your system - you can just make one decision which will A) - free-up some clutter (last time when I've installed Vanguard - it was 7 Gigabytes, that's not big number but summing up with all other improvements which it will gain - it will be more than worth it) and B) Improve user experience - because the actual thing which you need is - in fact, only game - and not a game and just some anti cheat which will force you to use it always - otherwise - reboot after the reboot to actually play just 2 games, so people will just or never actually play Valorant / LoL in the sake of convenience - or, just do not turn it off

[@lostboy2637]

Personally this was the push I needed to stop playing League. Thanks Riot!

[@KertaDrake]

Really wish antiviruses would flag stuff like this...

[@SimoAtlas]

Why windows allowing third party software to run at kernel level

[@michael_tunnell]

exactly! why would they even let this be a thing?

[@tomaszgasior772]

Each OS allows to run third party software at kernel level. Linux too. macOS too. For example, drivers are software running at kernel level. Some software requires extra logic running at kernel live, like virtual machine software for example.

[@filipepinho3319]

@@tomaszgasior772 Except Linux drivers don't work the same way as windows drivers, in fact the Linux kernel already have all it needs to work with all devices out of the box... The only exception is Nvidia, for that you need to enable a kernel module from Nvidia to use a proprietary driver.... So in reality Linux don't allow other kernel applications... Thought Riot could create a kernel module to enable allow Vanguard driver to run... But I seriously don't think either Linux community would accept that merge or even riot to create such module

[@rosastarr]

Because Microsoft hopes to harvest data on an immense scale and share it with government entities (for billions of dollars), and they know that internet gaming would be a huge part of the future of that. And Microsoft very likely already made a deal with the Chinese government/Tencent, who literally own Riot Games now, to allow them to harvest data via the client, the new rootkit and vanguard.

Almost any OS does. Third or first-parties can both abuse their power.

[@OldKingMaple]

It's a very low-integrity company. They are never honest with their player base. They also had a scandal involving the treatment of one of their players, who was apparently malnourished and forced to play. They to this day have no publicly acknowledged.

[@PotatoTroll]

I doubt it was riot who forced the player to play...

[@Naruto5471]

My computer got bricked after installing vanguard. Literally couldn't even use the browser...

[@dfntlynotjorn]

I've played league from 2012 to 2023. I've never encountered any cheater in-game though.

[@lildms3691]

fun story i saw a vid of a kid complaining about hackers in game who only proof that venguared broke everyone system for nothing.

[@hohohodrigues]

I haven't played it for that long, only 2 years (thanks to vanguard I'm off that drug) but I've seen some nunus and sions doing laps around the jungle and a xerath that had night sight or something, he went 21/0 that game.

[@Bixmy]

The thing is it would be justifiable if its doesnt need to always be on. But it does need kernel level permissions from startup. Which makes it way more suspicious.

[@Mochi-gx1qu]

wanna know the funny part? there are still cheaters on the game

[@NewT4-ku8tn]

Tencent has put rootkit on their platform (TGP and WeGame) for over 10 years. I won't be surprised if Riot got the rootkit from Tencent.

[@boo_1096]

Just a quick note - a lot of the NT kernel interfaces (required for kernel extensions such as these rootkits) are actually not implemented in Wine. BattlEye/EasyAntiCheat actually ship native Linux binaries of the anti-cheats with the Windows versions of the game which get loaded if it detects wine. These run entirely at the user level and can even run in a sandbox (like with Flatpak Steam). Otherwise, the explanations here are correct.

[@XmemoreX]

and nothing of value was lost

[@sj3614]

Riot is not a transparent enough company for you to trust them to install a rootkit on your PC.

[@michael_tunnell]

I don’t think company is worthy of being trusted enough for that 😆

[@dasgeek]

Brilliantly presented

[@diuran1919]

Microsoft should block instalation of this game on their system.

[@Gramini]

They didn't even prevent the installation of the vulnerable Genshin Impact Anti-Cheat which was actively exploited.

[@chaosmachines934]

when riot manged to one up blizzards f up with just one forced anti cheat and their long list of gaslight their critics .

[@BoneWalker]

They've even got sock puppet accounts to shout down people in youtube comments.

[@chaosmachines934]

@@BoneWalker oh wow so, they can do that, but they can't give us a map option menu to play on a different map on their moba game who started it all. i hate big tech i really do. on the map option menu i mean pick a different map who has a different play style i hate to say it but heroes of the storm got at least this one right. when it comes to riot i always need to wait for an event to get some 1 Muath change in gameplay. i missed the arena thanks to vanguard b.s and i think it ruin my Huian pan tablet too xd i am legit in a beef mode against riot .

[@kittivi01]

I am sad, I was confronted with it today. I've been playing it for years and I didn't think they would do this. Well I'm not going to replace my Linux, I'm going to say goodbye to LoL.

[@user-ce5yk9gu6x]

Dropped LOL when it was CLEAR and OBVIOUS they were stopping people from climbing (Except you are a robot and grind 24/7).. now a rootkit? yeah , right....

[@justnormalchlieanshit8747]

The best thing about Vanguard is that it make me uninstall lol

[@jorge86rodriguez]

Thank you for bringing this in such a detailed video, I have been saying it all the time. Even if kernel anti cheats are a controversial topic vanguard is the worst, it does unnecessary things that other anti cheats don´t. There is not a single valid reason for that shit to stay on all the time.

[@pupip55]

I watched a video where they ran 2 VMs to be able to play riot games on Linux, So the root kit doesn't like going beyond hyperx (think its called), so play a windows VM running on a Windows VM with hyperx running, riot anti cheat won't check any higher.

[@CrossHusky]

It's hyper-v, as far as I know this method has been patched for quite some time

[@pupip55]

@@CrossHusky oh damn

[@BrixTalk]

Hmm... Cant you Put MacOS in a VM on Linux and Cheat away using the backdoor they implemented? What was the acronym of that Game again?

[@Thurgenev]

What a high quality video. Thank you!

[@conceptrat]

This could be the gamers equivalent of Crowdstrike!

[@rosastarr]

I played LOL for 10 years, played TFT from beta, I played the game daily for years just to improve my hand eye coordination. And I had to uninstall last week, because their fucking OS altering shit essentially created a backdoor for SOMETHING to get into my HOTSPOT and upload some kind of viral firmware into it that infected ALL my devices and infected all my browsers with some kind of search engine hijacking to hide search results, making webpages inaccessible, and doing something with javascript that altered webpages. I had to pull out an old phone and log into someone elses wifi to access information on my DENTISTS website. The hotspot has to be replaced, and I dont know if Ill ever be able to fix what happened to my phone.

[@cavummusictheory]

you could also try smite/smite 2. it's a way different experience and the devs actively try to incorporate every os into their support system.

[@Fender178]

I hear/read the same thing with some users calling Denuvo Malware which in fact it isn't because it only loads when the game that has it that you choose to play loads. It doesn't effect your entire PC afterwards when you quit the game that you were playing that has it unlike Malware that actually effects your entire PC. I understand having anti-cheat but I do NOT understand why do they need an anti-cheat that is always running. There was a time where Microsoft tried to make Windows more secure back during Windows Vista's development by limiting what software could be used at the Kernel level but it broke Anti-Virus software and too many people complained including the EU and the US Government so they had to back off. Now since Apple is being able to limit who has access to MacOS's kernel then Microsoft will have no problems limiting Windows at the kernel Level.

[@mayo9637]

vanguard made my laptop get blue screen day one, i immediately uninstalled it and havent went back. I also just built a new pc so rather not risk it.

[@hanzofuma]

I hope that this video reach Riot. I have some points that I want to talk about: 1. The most important feature of Vanguard is the obfuscation of memory. Vanguard utlizes it's own memory space that is hidden from the user space memory. this make it impossible for apps to read the game's memory values. that's why emulators and virtual machines are banned by riot and this understandable. 2. Despite all of the data privacy stuff and rootkit. Riot simply trying to kill a mosquito with an AK47. the issues that they discussed in their blog talks about scripters and bots but vanguard is used to detect various advanced hacks that are made mostly to FPS games and league will not benefit that much. 3. It's sad to see that Mac is favored. Even thought the game doesn't support M series which means the players base is very few yet they choose Mac over Linux.

[@jillix2]

Beautifully done Michael!! 😂

[@googleusersincewhen3982]

Hi, Michael i removed lol and vangard after i watched your video, what if i use another SSD or HDD to play LoL and only? just windows and lol and some browsers just for surfing. i was thinking about plug the cables out from my hdd and ssd and plug in new ssd for lol. Do you think is it safe way to play lol without any risks? is this vangaurd system runs from the cmos setup too? i dont know much about computers but if im using same cpu and mobo, i was like what if this vanguard run from the cmos setup or whenever i start my comp, and regardless of switching ssd or hdd it runs behind the system or something like that? i cant afford to another comp and getting new ssd is my best idea... i need some help please

[@coconut-tea]

Vanguard runs deeply inside your computer. SSD and HDD are just hard drives, it doesn’t change anything. You would need a new computer.

[@theopendoor3716]

Solution: Riot should hire Glorious Eggroll and start supporting Linux.

[@nathaniel_pardue]

I love love LOVE the reddit posts justifying Vanguard. Same old points all debunked here.

[@workthis]

the only way to fix the bricking is if you update your bios.. its a UEFI bios rootkit

[@ShaunakHub]

why is audio so low ? P.S. I am not a gamer, I just came here because I love your shows . Once in a while I play 0ad and get whacked silly within 15 minutes (max). But honestly, don't you think its kinda stupid for folks who are still playing this game ? Lets be honest, so much addiction to play a specific game is ridiculous to say the least!

[@lamaskfish]

I just quit lol, after 10 years, this is too much for me

[@Real-Name..Maqavoy]

Just now..?

[@chaosmachines934]

riot and TenCent are not worth it.

[@nushia7192]

It's not actually a cheating ai for the monitor, its just an indicator, it can't function on things that are outside your pov in league.

[@michael_tunnell]

The monitor can do things for you like analyze stuff faster than a human can to add advantage. You could argue it’s not cheating but it’s not fair gaming either

[@justkibo]

They can make vangurad only for ranked(some kind of faceit like), I only play aram and cant even play more because of vangurad

[@fuseteam]

Huh i was positive EAC and battleeye has both user level and kernel level anti cheat, where only the former is supported on linux

[@coconut-tea]

The issue people have with vanguard is because it runs 24/7, and other anti cheats don’t do that

[@fuseteam]

@@coconut-tea i'm referring to something michael said in the video about EAC and BattleEye, which seemed inaccurate

[@rflooker]

Yeah I uninstalled it already because of this

[@Wkaelx]

Sadly the "Just play X" doesn't work, people play lol and this is a society problem.

[@CocolinoFan]

Ye I played League on Linux for years, all was good. Guess is fine to quit this addictive game.

[@Mempler]

About the spyware in faq, they should've been honest to built trust. Like: "It does have the capabilities to be declared as spyware, but those will only be used if you were caught cheating to ensure that we do not false ban"

[@ZabavnaSpika]

Riot is such a brain rot company . back to my lovely dota at least feels like home when i open the game and not torture every league game is hostage game with 70% players with mental problems . i would pick drunk russians any time in dota sometimes looks like a art when they pull out some combeack .

[@ZabavnaSpika]

plus i feel like they are super lgbt i cant put my finger on it but something is off about them when i started playing it was a cool game i switched from dota to lol because of all assassins at time zed akali etc now its super gay all new characters. plus company is super big and game feels like a facebook game super clunky

[@maartenc6099]

Perhaps League of Legends is sssssoooooo bad written that they have to trust on rootkits to hide their bad code. And you have to trust them with your system. Don't think I would ever run this on my Linux system.

[@filipepinho3319]

I would like all league players really stop playing while riot does not revert Vanguard... but sadly kids can't live without the game and riot will say "players accept this, so we keep throwing bad decisions to players"..... I'm also a linux gamer since win10 came out, and I play League since season2... while I'm sad to see the game go trough this path I can't support or give my money to them while they do this

[@Darty2590]

Like if Cheaters were the real problems in this game..... Soo many years I have been in elo hell and what was the real problem was.. the AI that plays, the degenerate who lose their mind after 30 sec in the game or worst in the lobby..The AFk, the Matchmaking, how F*** mmr'S system is.. cause in my other account I was plat 3, and the main I sued to paly with silver 4. oh... the mian account would win max 21 lp per win, the plat 3 would win arround 34 and more.. like wtf.. this has to be fixed first.. the ranking system, that allows ppl to pick really bad picks in their lane, and purposly lose becausse they lost it but in normal even weird pick still works and at least ppl try.. This is fu*** on so many levels.. now, since Vanguard, it force my board to install TPM 2.0. but it cannot run it, anyway, this is another topic in itself.. The Customer service is one of the WORST in the world.. Almost no section to speak to a human, and tickets, only Ai would answer. I had no humans trying to reach and help with the problem. or like.this is curesed, corrupted.. Theey try to push the agenda that the game wil lbe fix because of some rare cheaters.. like wtf. This is the bottom of what makes this game cancer..

[@justadude8716]

IF you really need MOBA poison then DotA 2 is amazing

[@tizian_heckmann]

Well, this argument may not have much traction here since a lot of viewers are using Linux, at least I am guessing so. But Windows itself is the (potentially malicious) rootkit, at least it could be argued like that or am I mistaken? Hypothetically, if I trusted the USA as much as I trust China or any other country for that matter and I am an ambitious gamer, then someone could argue that there is not really much point in preventing actions like Riot took in the name of less cheaters. Please tell me if this argument is absurd. Edit: Of course, running this anti-cheat software all the time is not a good look and rightfully deemed suspicious.

[@davey820051]

Question: "Isn't Vanguard spyware?" Smart answer: "No, Vanguard is not spyware". Accurate answer: "With root permissions, Vanguard can do anything we want it to, now or in the future, including but not limited to spying on your computer activity '" Riot Games answer: "You're a total a$$hole for asking."

[@ThePlayerOfGames]

Back to DOTA2 and SMITE then ☺️

[@lildms3691]

i am willing to install a mobile emulator to check out the moba game that riot was trying to sue out of existence Mobile Legends

[@chaosmachines934]

don't worry i plan to play smite or heroes of the storm anyway the lol awarded system it's not worth it. and also, sorry but 1 or 4 bad games are not worth it to get my pc set up broken for a stupid game my pan tablet from Huion got his 7-button broken partly thanks to venguared

[@lamaskfish]

Vi sitter här i Venten och spelar lite Dota

[@シミズルリ]

Rito: "Nobody plays League on Loonix it's not worth it!!!" Also Rito: makes sure that nobody can actually play League on Loonix. What a bunch of clowns, really.

[@breadmoth6443]

state of gaming is just depressing, and to be honest i personally do not see anything worthwhile in playing these days... i'll stick with my classics from the 1990s via emulation , dosbox, scummvm, nes/snes and playstation1 emulation ; so im good.

[@catmando268]

Well said.

[@rflooker]

If you have to cheat to win you have already admitted you suck. Knowing this the pressure is off so just have fun and not worry about winning... I don't know it never made sense to me...

[@lildms3691]

i played lol for fun yeah, i did deal with cheaters but i Gussie riot report system only works for FDK , and racist or offensive language boo hoo. do toxic ppl exist in games yeah, they do so i block theme and move on with my life not worth the stress

[@Real-Name..Maqavoy]

Old news.. *Tencent* owns a lot of companies.

[@nushia7192]

the problem with dota2 is the rantful gamers...

[@cameronbosch1213]

Riot actually is owned by Tencent. That's a Chinese company. Who knows what they're ACTUALLY putting on the systems!?

[@hanzofuma]

This is none sense actually. In each region riot and every other company adhere to the laws of the region. People playing in EUW and EUN or people playing in the NA are treated differently. and both EU and NA have strict rules for data privacy especially for chinese or russian companies.

[@cybernit3]

Makes me wonder if the Chinese Secret Intelligence is using this to spy on us or to access more systems to use.

[@dragonknight196]

@@hanzofuma Actually, China has a law on the books that states that at any time, for any reason, any Chinese company will comply with the government for seizure of information of any capacity and with total transparency of any and all information they want. To refuse is to be jailed or worse. So yeah, they can just grab up whatever they want, whenever they want.

[@robertg8826]

I liked the show, never the game, well I do prefer playing offline casual games like one of my new favorites is OpenTTD, something about perfect train track layouts scratches an itch

[@Arzeefy]

Lmao i can't believe Michael promoting dota lmao

[@michael_tunnell]

Why’s that? 🤷‍♂️

[@Arzeefy]

@@michael_tunnell you play regularly/occasionally?

[@michael_tunnell]

I don’t play either dota or league. That’s not my genre

[@ForTheJerusalem]

Launching on boot is a problem, not closing with the game is a problem, HAVING THE ABILITY TO TURN OFF ANYTHING IT WANTS IS BEING A VIRUS. Why must it have the ability to turn off anything? Just don't let people launch the game, don't kill people's PCs just because their driver dares to look weird.

[@makcocyt]

This game is the only reason why my main pc is still on windows, even though im using linux on my laptop for 6+ years. Even when it was working through lutris, it still was a pain to play it this way, lots of problems with cursor, insanely long loading times, etc. As a high elo league player, i must say Dota 2 is not a good alternative for a league player, dead game with obsolete mechanics.

[@chubbyadler3276]

4:45 It isn't spyware, but I would still call it malware.

[@VallThyo]

Vanguard is spyware rootkit, I wouldh't run it on windows, and I wouldn't run it on Linux either. I don't play League anymore, but if I would still playing I would probably stop, since nowadays I care a lot more about those things as compared to 10 years ago when I still played League of Legends. There is no reason for such an invasive tool, aside their own incompetence in the case they can't make anything better, or straight up malicious since they have full access to your windows machine and what it's running ALL THE TIME.

[@petar0402]

Please, PLEASE do audio leveling before releasing a video. Thanx in advance! 😉

[@michael_tunnell]

I did level it, what was off?

[@Grant_S_M]

@@michael_tunnell It's fine for me!

[@romany8125]

​@@michael_tunnellnot loud enough...

[@michael_tunnell]

That’s interesting, it sounded fine in all of my testing. I’ll look into it more

[@petar0402]

@@michael_tunnell It was too quiet comparing to other YT videos and that "stop it, get some help" meme at 19:23 was too loud comparing to the rest of the video. My guess is that small part got leveled up, but the rest of the video did not because of that part.

[@sullynoxionsshow1699]

i love this vid but saying VAC is effective is a bit goofy 😂

[@michael_tunnell]

Thanks and just to be clear, i mean effective in that it helps but i don’t mean perfect or solves the problem of losers being losers lol that’s impossible to solve entirely 🤣

[@sponix2ipfw]

Roblox is doing similar

[@lildms3691]

switch games dude it's not worth it anymore

[@bhargavjitbhuyan9394]

Bro LOL stands for League of legends 😂😂😂😂.

[@jimmym8741]

😂😂😂😂

[@AssafHershko]

They are allowed to say that 800 people a day isn’t worth it for them. This rant is misguided.

[@michael_tunnell]

Your comment is misguided since you missed the part of how complicated it is to play it on Linux and thus the number would be drastically higher if it was just a play button.

[@Avero_]

also obviously the numbers drop when they announcend earlier that the platform will be dead in a few weeks.

[@jxlazd]

You talked and talked and proved nothing... I want to see you reversing the Vanguard driver, etc.