Greetings, glorious adventurers! If you're joining in our Alpha One spot testing, please follow the steps here to see all the latest test info on our forums and Discord!
Options
Kernel-Level Anti-Cheat Solutions
Dulcibel
Member
As a cybersecurity professional and a passionate gamer, I feel it’s my responsibility to address the growing trend of kernel-level anti-cheat solutions in the video game industry. While the intention behind these measures may be to ensure fair play, their implementation raises serious concerns regarding privacy, security, and user rights.
First and foremost, the idea of a kernel-level anti-cheat system sends shivers down my spine. Granting a piece of software such extensive access to your system is akin to handing over the keys to your digital kingdom. It's invasive and opens up Pandora's box of potential vulnerabilities.
From a cybersecurity standpoint, this approach is a disaster waiting to happen. Kernel-level access means these anti-cheat solutions have unfettered access to sensitive parts of your operating system, making them prime targets for malicious actors. One small slip-up in code or a security flaw could expose players to a myriad of risks, ranging from data breaches to full-blown system compromises. This isn’t just a distant fear. This has happened before (see, e.g., August 2022 report that ransomware actors abused a Genshin Impact anti-cheat driver to uninstall antivirus software on end-user machines). This isn’t about trusting the game development studio, the publisher, or even the owners of the anti-cheat itself…all it takes is one malicious actor or disgruntled employee to cause irreversible damage, harm end users directly through their hardware, or indirectly through the fraudulent use of their personal information.
Moreover, the deployment of kernel-level anti-cheat solutions demonstrates a blatant disregard for the privacy of players. By its very nature, such software can monitor and collect vast amounts of data from your system, including personal information that has nothing to do with cheating. While I recognize that, in some cases, the organizations implementing the software may explicitly state that they have no intention of invading your privacy, if you grant them this access, you can do nothing to stop them. This disturbing disregard for privacy sets a dangerous precedent for the erosion of digital rights.
As gamers, we should not have to sacrifice our security and privacy for the sake of fair play. Plenty of alternative approaches to combating cheating do not require such drastic measures. Not to mention, kernel-level anti-cheat isn’t a be-all-end-all solution to the problem. There will still be cheaters. Game developers should prioritize solutions that uphold both the integrity of the game and the rights of the players.
Accordingly, I urge game developers to reconsider their approach and prioritize solutions that strike a balance between security, privacy, and fair play. Our digital rights depend on it.
First and foremost, the idea of a kernel-level anti-cheat system sends shivers down my spine. Granting a piece of software such extensive access to your system is akin to handing over the keys to your digital kingdom. It's invasive and opens up Pandora's box of potential vulnerabilities.
From a cybersecurity standpoint, this approach is a disaster waiting to happen. Kernel-level access means these anti-cheat solutions have unfettered access to sensitive parts of your operating system, making them prime targets for malicious actors. One small slip-up in code or a security flaw could expose players to a myriad of risks, ranging from data breaches to full-blown system compromises. This isn’t just a distant fear. This has happened before (see, e.g., August 2022 report that ransomware actors abused a Genshin Impact anti-cheat driver to uninstall antivirus software on end-user machines). This isn’t about trusting the game development studio, the publisher, or even the owners of the anti-cheat itself…all it takes is one malicious actor or disgruntled employee to cause irreversible damage, harm end users directly through their hardware, or indirectly through the fraudulent use of their personal information.
Moreover, the deployment of kernel-level anti-cheat solutions demonstrates a blatant disregard for the privacy of players. By its very nature, such software can monitor and collect vast amounts of data from your system, including personal information that has nothing to do with cheating. While I recognize that, in some cases, the organizations implementing the software may explicitly state that they have no intention of invading your privacy, if you grant them this access, you can do nothing to stop them. This disturbing disregard for privacy sets a dangerous precedent for the erosion of digital rights.
As gamers, we should not have to sacrifice our security and privacy for the sake of fair play. Plenty of alternative approaches to combating cheating do not require such drastic measures. Not to mention, kernel-level anti-cheat isn’t a be-all-end-all solution to the problem. There will still be cheaters. Game developers should prioritize solutions that uphold both the integrity of the game and the rights of the players.
Accordingly, I urge game developers to reconsider their approach and prioritize solutions that strike a balance between security, privacy, and fair play. Our digital rights depend on it.
15
Comments
Anyway...
While I haven't been active on the forums, I have actively followed this project since its onset (see attached screenshot of the date I purchased the founder's pack). Thank you for your concern and not adding value to the conversation at hand.
As for the other commenter, I guess it's unreasonable to assume I shared my post amongst people who share concern regarding this topic.
I'm not asking that you go to war with me, but I do ask that you acknowledge the issue at hand, at the very least.
Cool. Now let's see the other acc.
Oh, it's that kind of party.
Now, do you have any other (un)constructive points of critisticm to add to Dulcibel's (evidently) thoughtful discussion?
2 accounts for the same person or not (op, don't do that), he is right.
Agree to the terms or dont. The internet is not safe. Leave the studio to make the game.
Go chase some other bigger companies that have fallen to data breaches. You are still using their services like it or not.
Discuss the game dev, not the company structures decisions.
This is a general discussion forum. This is where we, as players, can share our opinion about the game's development. I don't need to be a shareholder to speak here. The studio will make their game, but this forum exists for them to hear their community's voice.
I am making this post because I want to agree to their terms and play their game but I cannot, in good conscious, do this if they implement kernel-level anti-cheat.
You mentioned the internet is not safe...that is the core of my argument. It is not safe, and therefore I don't feel like we should offer a paved road to the deepest levels of our computers for the sake of playing an online game.
Additionally, could you please explain how deciding what kind of anti-cheat to be utilized in a game isn't part of game development? I'm not trying to pick a fight, I'm genuinely trying to understand your position on this.
They probably won't need a kernel-level anti-cheat.
Thank you for the input!
I've hesitated to bring this up anywhere for a long time, because I didn't know exactly what kind of anti-cheat Intrepid intended on using, however I recently spoke with one of their Customer Support representatives about this and they confirmed that they plan to use Easy Anti-Cheat, which runs at the kernel-level.
They also mentioned:
"Unless something changes between now and Launch, that is likely the solution we will use."
There are no UEFI level anti cheat solutions yet?
Give some plenty of examples.
List them all.
If you are unaware of non-kernal cheat protection methods, why are you even in this thread?
Easy. Just buy a dedicated pc only for ashes of creation.
Obviously I'm joking but having it pretty much confirmed now, what's the course of action?
Put pressure on Steven to change that? I doubt it will be effective.
Yeah, all this means is that they're not going to do it "soon". All it takes is for a change to the T&Cs once you're a few years in, and you then have the choice of: lose your last few years and the investment made in it, or protect yourself.
Presumably this would make Intrepid legally responsible, and liable for a multitude of compensation cases?
Nope.
This is probably part of the reason why it is hard for them to stop botting.
Ashes is trying to go hard on bots and addons and stuff, so likely why they are aiming at kernel-level. Still, I agree with the OP, we shouldn't have to put this stuff on our computer.
Can they not have more server side methods to detect these things rather than create massive vulnerabilities in their user base? Its like we just met them but they will only have sex with us without a condom... Kind of rude.
I'd like to respond to several of you in this one comment.
@Potato Basket
"Just buy a dedicated pc only for ashes of creation...Obviously I'm joking but having it pretty much confirmed now, what's the course of action? Put pressure on Steven to change that?"
For those who don't wish to buy a second pc and keep it on a dedicated network that's both physically and logically separated from your main one (I know you were joking, but that's really the only way to even remotely justify installing rootkits), I think coming together as a community to ask Steven to change it is exactly what we should do. The stance I'm taking is: If they use it, I will not play their game.
@daveywavey
"Yeah, all this means is that they're not going to do it "soon". All it takes is for a change to the T&Cs once you're a few years in, and you then have the choice of: lose your last few years and the investment made in it, or protect yourself."
Exactly. League of Legends is a good example of this...while it's not a 1:1 comparison (it's the best one I could think of off the top of my head), they've decided after so many years to start using kernel-level anti-cheat, effectively telling their players "accept our rootkit or uninstall." This has put the community in a difficult position due to the insane amount of time and effort people have poured into their accounts.
"Presumably this would make Intrepid legally responsible, and liable for a multitude of compensation cases?"
Just as @Noaani said, surprisingly not...often times no one is held accountable for something like this. I hate to use the same reference twice, but see the Genshin Impact attack that happened in 2022. Sure, an entity might take responsibility for it happening, but it's no different than when Sony has a data breach and all they do is send an email like "hey, we messed up. oops!"
@Xeeg
"Can they not have more server side methods to detect these things rather than create massive vulnerabilities in their user base?"
With their recent job posting, (see
I'd like to thank you all again for joining the conversation and keeping it honest. I appreciate your input!
Thanks for staying on top of this issue and bringing it to our attention!
If you don't trust a piece of code, you should not install it.
That is true not only protection software but for operating system, for drivers, games and their mods. Even open source software can be compromised by automated pulling of dependencies when you compile.
And some people try to abuse it.
https://research.swtch.com/xz-timeline
So you want to create an uproar and let cheaters in.
That kind of "balance" you want.
I thought you want to change some AoC features which make cheating unnecessary/not possible.
Another good "antibot" thing they already have in the game is the open world PVP. Although that has to be balanced with the corruption system as the point of that is to prevent griefing, and likely the only way to stop a bot is to grief it. Unless Intrepid can find them. But with 10,000 players on a server, it could be very difficult to manually confirm each botter before banning the account, and we wouldn't want legitimate players banned accidentally.
The whole addon debate is an entirely other story though. If they really want to be against "addons" then it is difficult, if not impossible, to enforce. My argument from the very beginning is that they shouldn't give the player's computer any information that they don't want them to turn into an addon. Otherwise you are really only giving an advantage to people who cheat and use addons rather than "prevent" addons. Even the anti-cheats can't stop everything.
Rules that can't be enforced or upheld only serve to put rule followers at a disadvantage.
A normal program that is not 'kernel-level' knows about itself and maybe one or two other things that your computer explicitly allows it to know.
Kernel-level programs have ways to know basically everything happening on your computer. This does not necessarily mean they can influence it (but it's a computer, there's always a way), but that they at least have the capacity to know it.
So a game knows what you type in the game, a kernel-level program might have a way to know what you typed in Discord, on this forum, etc.
Or entering your passwords into bank accounts, or scanning your computer for keywords and looking for personal information, or use your computer as a botnet to run mass DDoS attacks...
Or any other nasty thing a criminal enterprise or government organization may want to use your computer for when given the backdoor access. Do you really trust EasyAntiCheat as a company to stop these types of organizations from gaining access to their network of convenient bots that everyone has downloaded on their computers?
A great example of non-intrusive software combined with innovation is https://anybrain.gg/.
It is run client-side and tracks movement on a pixel level. one of the features is that it builds a 'behavioral profile'. When you activate a bot, it will detect that the movement is different then that off your profile.
It will detect common bots based off the profiles off the bots. It can do a lot more.
Definitely worth to check it out!
That's exactly what a dirty cheater would say! I am on to you and your schemes to prevent anti-cheats.
I am also not a fan of EAC.
I think the best way to prevent cheaters (like you!) is to simply not allow client-side input. Players can email Intrepid, telling them what they want their character to do, and within 3 business days they get an email back with the results. This would also greatly reduce development time, and instead of UE5 devs can use HTML5, which is free!
I'm not a pro in the anti-cheat thread, but Easy Anti-Cheat is terrible. It is present in a large number of games that I have played or I am playing now, and there is always a dominance of cheaters.
The bot accounts generate more revenue than the people that leave the game due to bots. Blizzards stance is (and I don't actually fault them for this), if players don't care enough to leave the game, why should we spend money to reduce our subscription numbers?