Steam store pages received a new Anti-cheat field. Disclosure is mandatory for kernel-level anti-cheat solutions. And recommended for other anti-cheat solutions (like server-side or non-kernel-level client-side).
The field discloses the anti-cheat product, whether it is a kernel-level installation, and whether it uninstalls with the product or requires manual removal to remove.
Taking kernel level actions to stop processes on YOUR machine is absolutely taking control of the system.
Kernel level anti-cheats meet every requirement. Just because you think there’s gymnastics going on doesn’t make it so. It’s actually well established in the security field that they count.
Have kernel-level anti-cheat systems ever stopped processes? Unrelated to the anti-cheat and the game itself?
I would imagine they would kick and ban you, not control other processes.
They have kernel access… They can control anything since they’re in the kernel. And yes, I’ve seen it.
If you remember back in the late 2000’s early 2010’s there were a boatload of apps that would hook into games to do things like display overlays for chats (Teamspeak for example, overwolf as another.) some kernel anti-cheats would stop those processes from starting up.
But don’t take my word for it.
https://www.pcgamer.com/according-to-experts-on-kernel-level-anticheat-two-things-are-abundantly-clear-1-its-not-perfect-and-2-its-not-going-anywhere/
Introduces backdoors to be used by malicious actors.
https://www.pcgamer.com/the-controversy-over-riots-vanguard-anti-cheat-software-explained/
Blocks external softwares that it deems “vulnerable”
https://old.reddit.com/r/gaming/comments/xf1cwr/the_insanity_of_eas_anticheat_system_by_a_kernel/
Kernel devs beg users to not allow this shit.
Just look it up. All sorts of articles and experts have spoken on it.
Source
Source for what in specific?
That stopping processes is a kernel action? Go ahead. Open powershell and ask it to close some other system process… The UAP prompt (if you’re on windows, linux will just fail silently most of the time unless you sudo or are root) that shows up is the kernel validating that you even have permissions to do that. The kernel handles ALL task scheduling/management. When you close something you’re asking the kernel to do it. The kernel also handles ALL file management and driver management (drivers being extensions of the kernel). So the fact that it can read other active DLLs and such hooked into other processes (say your graphics drivers) is literally proof.
That industry agrees that it’s malware? Depends on which part of industry I suppose. But if it’s able to do all these actions at the kernel level, and attached itself it to other software to install, often doesn’t uninstall when you remove the game it was attached to, AND gets flagged by anti-viruses that don’t have it whitelisted yet… It’s definitionally malware. Go search for “Is <insert anticheat> malware”. Very few people will argue that they’re not.
Hell it’s possible for anti-cheats to write to UEFI if they really wanted to. There’s no legitimate reason for that level of access, 0, none.
I’m a programmer I understand what they are. I understand why they suck.
Stopping processes is actually a user space action. You can do it without admin rights btw. Even if it popped the admin screen that’s still not a kernel level action.
Asking the kernel to do something is basically all operations and not the same as kernel level access.
Yeah that it’s considered malware. I did Google it and there’s nothing saying that.
the kernel level part of that specific thing is preventing process startup after it was killed
Absolutely not. Task management is the job of the operating system/kernel. You can request to end a job/task. The kernel will do it on it’s own time. UAP prompts are attempts to elevate permissions so that you can access higher kernel calls.
https://linux-kernel-labs.github.io/refs/heads/master/lectures/syscalls.html#linux-system-calls-implementation
https://unix.stackexchange.com/questions/111625/how-does-linux-kill-a-process
You can make requests the to the kernel. If you have permission/ownership to the process the kernel will work through the sigterm/sigkill to meet your request. It is not a user space action at all to kill a process, you make requests to the kernel to do it. Hell in linux it’s even more obvious as you can instruct the kernel on HOW you would like to kill the task and even then it may not follow your direction. https://www.man7.org/linux/man-pages/man1/kill.1.html with kill being a kernel tool. If you spawned the process, then you have permission/ownership to the process. But my point in the previous post was that anti-cheats can reach into the system, reading dlls and such that are absolutely NOT user space to begin with, require elevation beyond user space to install.
Seriously? You can’t find anything? You sure about that? Cause I can literally pull up thousands of articles and forum threads by literally typing “is vanguard anti-cheat malware?” or “is easy anti-cheat malware?”
https://forums.malwarebytes.com/topic/288793-easy-anti-cheat-launcher-detection/
Heuristics detect these things for what they are. Anti-virus software have to whitelist them because people choose to play the games anyway.
https://www.techguy.org/threads/is-valorant-vanguard-a-malicious-rootkit-or-not.1267682/
https://www.pcgamer.com/the-controversy-over-riots-vanguard-anti-cheat-software-explained/
https://www.sp-cy.com/article/is-valorants-anticheat-spyware/
Let’s attack this question from another perspective. Do you trust a games developer to properly develop kernel code? Most people BARELY trust Microsoft to do it these days. And you can’t review/evaluate it yourself at all. You have no fucking clue what they’re doing and never will. We’ve seen what happens when random companies inject shit into the kernel like crowdstrike did. You think that these anti-cheat softwares are acting in your interest when they’re being implemented and paid by a corporation? How can you look at these anti-cheats that have made backdoors on systems, cause people everywhere unstable kernels/BSODs, send data about your system without permission, interacts with software on your system that isn’t their code, etc… and say they’re not malicious?
Pretty much all code is making requests to the kernel. That isn’t what is happening here.
It’s side stepping the kernel. That’s the whole point. You don’t know what you’re talking about.
Now you backpedal and say
But I don’t know what I’m talking about? Sure. We’ll go with that if it makes you feel good. I only literally taught it at a post-grad level at an R1 institution, but what do I know.
You’re getting it! Kind of at least. The anti-cheat actually modifies the kernel (in an extension kind of way, like drivers do). That’s the point though. Which seems to have repeatedly whooshed over your head. But I can only say it in so many ways and be ignored. Good luck. Hope I don’t run into your code.
Not back peddling you are misunderstanding what kernel access means.
You don’t need kernel level access (the thing we are literally discussing) to kill processes. Which was literally your example.
Obviously the OS handles it. How the fuck else would it work?