Glorious Alpha Two Testers!

Phase I of Alpha Two testing will occur on weekends. Each weekend is scheduled to start on Fridays at 10 AM PT and end on Sundays at 10 PM PT. Find out more here.

Check out Alpha Two Announcements here to see the latest Alpha Two news and update notes.

Our quickest Alpha Two updates are in Discord. Testers with Alpha Two access can chat in Alpha Two channels by connecting your Discord and Intrepid accounts here.

Kernel-Level Anti-Cheat Solutions

DulcibelDulcibel Member, Alpha Two
As a cybersecurity professional and a passionate gamer, I feel it’s my responsibility to address the growing trend of kernel-level anti-cheat solutions in the video game industry. While the intention behind these measures may be to ensure fair play, their implementation raises serious concerns regarding privacy, security, and user rights.

First and foremost, the idea of a kernel-level anti-cheat system sends shivers down my spine. Granting a piece of software such extensive access to your system is akin to handing over the keys to your digital kingdom. It's invasive and opens up Pandora's box of potential vulnerabilities.

From a cybersecurity standpoint, this approach is a disaster waiting to happen. Kernel-level access means these anti-cheat solutions have unfettered access to sensitive parts of your operating system, making them prime targets for malicious actors. One small slip-up in code or a security flaw could expose players to a myriad of risks, ranging from data breaches to full-blown system compromises. This isn’t just a distant fear. This has happened before (see, e.g., August 2022 report that ransomware actors abused a Genshin Impact anti-cheat driver to uninstall antivirus software on end-user machines). This isn’t about trusting the game development studio, the publisher, or even the owners of the anti-cheat itself…all it takes is one malicious actor or disgruntled employee to cause irreversible damage, harm end users directly through their hardware, or indirectly through the fraudulent use of their personal information.

Moreover, the deployment of kernel-level anti-cheat solutions demonstrates a blatant disregard for the privacy of players. By its very nature, such software can monitor and collect vast amounts of data from your system, including personal information that has nothing to do with cheating. While I recognize that, in some cases, the organizations implementing the software may explicitly state that they have no intention of invading your privacy, if you grant them this access, you can do nothing to stop them. This disturbing disregard for privacy sets a dangerous precedent for the erosion of digital rights.

As gamers, we should not have to sacrifice our security and privacy for the sake of fair play. Plenty of alternative approaches to combating cheating do not require such drastic measures. Not to mention, kernel-level anti-cheat isn’t a be-all-end-all solution to the problem. There will still be cheaters. Game developers should prioritize solutions that uphold both the integrity of the game and the rights of the players.

Accordingly, I urge game developers to reconsider their approach and prioritize solutions that strike a balance between security, privacy, and fair play. Our digital rights depend on it.
«13

Comments

  • moonwokmoonwok Member, Alpha Two, Early Alpha Two
    More people need to see this. Well said. I share your concern. I would be severely disappointed if I donated nearly $400 to a game years ago and am suddenly learning that I may be unable to play because of KLAC. If I had known they were planning to implement this, I would never have donated in the first place. KLAC violates everything I thought Ashes stood against: taking from the players.
  • George_BlackGeorge_Black Member, Intrepid Pack, Alpha Two
    2 accounts created for 1 topic and nothing else.
    Anyway...
  • DulcibelDulcibel Member, Alpha Two
    2 accounts created for 1 topic and nothing else.
    Anyway...

    moutyf6gqxmm.png

    While I haven't been active on the forums, I have actively followed this project since its onset (see attached screenshot of the date I purchased the founder's pack). Thank you for your concern and not adding value to the conversation at hand.

    As for the other commenter, I guess it's unreasonable to assume I shared my post amongst people who share concern regarding this topic.

    I'm not asking that you go to war with me, but I do ask that you acknowledge the issue at hand, at the very least.
  • George_BlackGeorge_Black Member, Intrepid Pack, Alpha Two
    Dulcibel wrote: »
    2 accounts created for 1 topic and nothing else.
    Anyway...

    moutyf6gqxmm.png

    While I haven't been active on the forums, I have actively followed this project since its onset (see attached screenshot of the date I purchased the founder's pack). Thank you for your concern and not adding value to the conversation at hand.

    As for the other commenter, I guess it's unreasonable to assume I shared my post amongst people who share concern regarding this topic.

    I'm not asking that you go to war with me, but I do ask that you acknowledge the issue at hand, at the very least.

    Cool. Now let's see the other acc.
  • moonwokmoonwok Member, Alpha Two, Early Alpha Two
    Dulcibel wrote: »
    2 accounts created for 1 topic and nothing else.
    Anyway...

    moutyf6gqxmm.png

    While I haven't been active on the forums, I have actively followed this project since its onset (see attached screenshot of the date I purchased the founder's pack). Thank you for your concern and not adding value to the conversation at hand.

    As for the other commenter, I guess it's unreasonable to assume I shared my post amongst people who share concern regarding this topic.

    I'm not asking that you go to war with me, but I do ask that you acknowledge the issue at hand, at the very least.

    Cool. Now let's see the other acc.

    Oh, it's that kind of party.

    pg3e2ypoqfue.png

    Now, do you have any other (un)constructive points of critisticm to add to Dulcibel's (evidently) thoughtful discussion?

  • NoaaniNoaani Member, Intrepid Pack, Alpha Two
    2 accounts created for 1 topic and nothing else.
    Anyway...

    2 accounts for the same person or not (op, don't do that), he is right.
  • George_BlackGeorge_Black Member, Intrepid Pack, Alpha Two
    edited May 8
    You are not share holders.
    Agree to the terms or dont. The internet is not safe. Leave the studio to make the game.
    Go chase some other bigger companies that have fallen to data breaches. You are still using their services like it or not.

    Discuss the game dev, not the company structures decisions.
  • DulcibelDulcibel Member, Alpha Two
    edited May 8
    You are not share holders.
    Agree to the terms or dont. The internet is not safe. Leave the studio to make the game.
    Go chase some other bigger companies that have fallen to data breaches. You are still using their services like it or not.

    Discuss the game dev, not the company structures decisions.

    This is a general discussion forum. This is where we, as players, can share our opinion about the game's development. I don't need to be a shareholder to speak here. The studio will make their game, but this forum exists for them to hear their community's voice.

    I am making this post because I want to agree to their terms and play their game but I cannot, in good conscious, do this if they implement kernel-level anti-cheat.

    You mentioned the internet is not safe...that is the core of my argument. It is not safe, and therefore I don't feel like we should offer a paved road to the deepest levels of our computers for the sake of playing an online game.

    Additionally, could you please explain how deciding what kind of anti-cheat to be utilized in a game isn't part of game development? I'm not trying to pick a fight, I'm genuinely trying to understand your position on this.
  • XeegXeeg Member, Alpha Two
    edited May 8
    Seems fair to me. The design of the game should keep as much important information server side as possible so the user's computers have less to hack. This works well in MMOs traditionally anyways.

    They probably won't need a kernel-level anti-cheat.
  • DiamahtDiamaht Member, Braver of Worlds, Alpha One, Alpha Two, Early Alpha Two
    Well I mean he does bring up valid concerns.
  • DulcibelDulcibel Member, Alpha Two
    edited May 8
    Xeeg wrote: »
    Seems fair to me. The design of the game should keep as much important information server side as possible so the user's computers have less to hack. This works well in MMOs traditionally anyways.

    They probably won't need a kernel-level anti-cheat.

    Thank you for the input!

    I've hesitated to bring this up anywhere for a long time, because I didn't know exactly what kind of anti-cheat Intrepid intended on using, however I recently spoke with one of their Customer Support representatives about this and they confirmed that they plan to use Easy Anti-Cheat, which runs at the kernel-level.

    They also mentioned:
    "Unless something changes between now and Launch, that is likely the solution we will use."
  • OtrOtr Member, Alpha Two
    Dulcibel wrote: »
    As a cybersecurity professional and a passionate gamer,
    ...
    , the idea of a kernel-level anti-cheat system sends shivers down my spine.
    Sounds like risk vs reward :)
    There are no UEFI level anti cheat solutions yet?
  • OtrOtr Member, Alpha Two
    edited May 8
    Dulcibel wrote: »
    As gamers, we should not have to sacrifice our security and privacy for the sake of fair play. Plenty of alternative approaches to combating cheating do not require such drastic measures

    Accordingly, I urge game developers to reconsider their approach and prioritize solutions that strike a balance between security, privacy, and fair play.

    Give some plenty of examples.
    List them all.
  • NoaaniNoaani Member, Intrepid Pack, Alpha Two
    edited May 8
    Otr wrote: »
    List them all.
    I men, this is a stupid request in the best of circumstances.

    If you are unaware of non-kernal cheat protection methods, why are you even in this thread?
  • Potato BasketPotato Basket Member, Braver of Worlds, Kickstarter, Alpha One, Alpha Two, Early Alpha Two
    Dulcibel wrote: »
    Xeeg wrote: »
    Seems fair to me. The design of the game should keep as much important information server side as possible so the user's computers have less to hack. This works well in MMOs traditionally anyways.

    They probably won't need a kernel-level anti-cheat.

    Thank you for the input!

    I've hesitated to bring this up anywhere for a long time, because I didn't know exactly what kind of anti-cheat Intrepid intended on using, however I recently spoke with one of their Customer Support representatives about this and they confirmed that they plan to use Easy Anti-Cheat, which runs at the kernel-level.

    They also mentioned:
    "Unless something changes between now and Launch, that is likely the solution we will use."

    Easy. Just buy a dedicated pc only for ashes of creation.

    Obviously I'm joking but having it pretty much confirmed now, what's the course of action?
    Put pressure on Steven to change that? I doubt it will be effective.
  • daveywaveydaveywavey Member, Alpha Two
    Dulcibel wrote: »
    in some cases, the organizations implementing the software may explicitly state that they have no intention of invading your privacy

    Yeah, all this means is that they're not going to do it "soon". All it takes is for a change to the T&Cs once you're a few years in, and you then have the choice of: lose your last few years and the investment made in it, or protect yourself.
    This link may help you: https://ashesofcreation.wiki/


    giphy-downsized-large.gif?cid=b603632fp2svffcmdi83yynpfpexo413mpb1qzxnh3cei0nx&ep=v1_gifs_gifId&rid=giphy-downsized-large.gif&ct=s
  • daveywaveydaveywavey Member, Alpha Two
    Dulcibel wrote: »
    One small slip-up in code or a security flaw could expose players to a myriad of risks, ranging from data breaches to full-blown system compromises.

    Presumably this would make Intrepid legally responsible, and liable for a multitude of compensation cases?
    This link may help you: https://ashesofcreation.wiki/


    giphy-downsized-large.gif?cid=b603632fp2svffcmdi83yynpfpexo413mpb1qzxnh3cei0nx&ep=v1_gifs_gifId&rid=giphy-downsized-large.gif&ct=s
  • NoaaniNoaani Member, Intrepid Pack, Alpha Two
    daveywavey wrote: »
    Dulcibel wrote: »
    One small slip-up in code or a security flaw could expose players to a myriad of risks, ranging from data breaches to full-blown system compromises.

    Presumably this would make Intrepid legally responsible, and liable for a multitude of compensation cases?

    Nope.
  • XeegXeeg Member, Alpha Two
    I was just reading a bit about how blizzard does it. They have an anticheat called Warden, which is usermode.

    This is probably part of the reason why it is hard for them to stop botting.

    Ashes is trying to go hard on bots and addons and stuff, so likely why they are aiming at kernel-level. Still, I agree with the OP, we shouldn't have to put this stuff on our computer.

    Can they not have more server side methods to detect these things rather than create massive vulnerabilities in their user base? Its like we just met them but they will only have sex with us without a condom... Kind of rude.
  • DulcibelDulcibel Member, Alpha Two
    edited May 8
    Hi everyone! Thanks for all of the engagement!

    I'd like to respond to several of you in this one comment.

    @Potato Basket
    "Just buy a dedicated pc only for ashes of creation...Obviously I'm joking but having it pretty much confirmed now, what's the course of action? Put pressure on Steven to change that?"
    For those who don't wish to buy a second pc and keep it on a dedicated network that's both physically and logically separated from your main one (I know you were joking, but that's really the only way to even remotely justify installing rootkits), I think coming together as a community to ask Steven to change it is exactly what we should do. The stance I'm taking is: If they use it, I will not play their game.

    @daveywavey
    "Yeah, all this means is that they're not going to do it "soon". All it takes is for a change to the T&Cs once you're a few years in, and you then have the choice of: lose your last few years and the investment made in it, or protect yourself."
    Exactly. League of Legends is a good example of this...while it's not a 1:1 comparison (it's the best one I could think of off the top of my head), they've decided after so many years to start using kernel-level anti-cheat, effectively telling their players "accept our rootkit or uninstall." This has put the community in a difficult position due to the insane amount of time and effort people have poured into their accounts.

    "Presumably this would make Intrepid legally responsible, and liable for a multitude of compensation cases?"
    Just as @Noaani said, surprisingly not...often times no one is held accountable for something like this. I hate to use the same reference twice, but see the Genshin Impact attack that happened in 2022. Sure, an entity might take responsibility for it happening, but it's no different than when Sony has a data breach and all they do is send an email like "hey, we messed up. oops!"

    @Xeeg
    "Can they not have more server side methods to detect these things rather than create massive vulnerabilities in their user base?"
    With their recent job posting, (see I would hope that this is something they're looking to explore, but since their customer service representative told me they plan to use EAC, I can't assume that will change without some kind of uproar from the community.

    I'd like to thank you all again for joining the conversation and keeping it honest. I appreciate your input!
  • XeegXeeg Member, Alpha Two
    Dulcibel wrote: »
    @Xeeg
    "Can they not have more server side methods to detect these things rather than create massive vulnerabilities in their user base?"
    With their recent job posting, (see I would hope that this is something they're looking to explore, but since their customer service representative told me they plan to use EAC, I can't assume that will change without some kind of uproar from the community.

    I'd like to thank you all again for joining the conversation and keeping it honest. I appreciate your input!

    Thanks for staying on top of this issue and bringing it to our attention!
  • OtrOtr Member, Alpha Two
    Dulcibel wrote: »
    The stance I'm taking is: If they use it, I will not play their game.
    That is a good choice from your side.
    If you don't trust a piece of code, you should not install it.
    That is true not only protection software but for operating system, for drivers, games and their mods. Even open source software can be compromised by automated pulling of dependencies when you compile.
    And some people try to abuse it.
    https://research.swtch.com/xz-timeline
    Dulcibel wrote: »
    @Xeeg
    "Can they not have more server side methods to detect these things rather than create massive vulnerabilities in their user base?"
    With their recent job posting, (see I would hope that this is something they're looking to explore, but since their customer service representative told me they plan to use EAC, I can't assume that will change without some kind of uproar from the community.
    So you want to create an uproar and let cheaters in.
    That kind of "balance" you want.
    I thought you want to change some AoC features which make cheating unnecessary/not possible.
  • XeegXeeg Member, Alpha Two
    Dulcibel wrote: »
    @Xeeg
    "Can they not have more server side methods to detect these things rather than create massive vulnerabilities in their user base?"
    With their recent job posting, (see I would hope that this is something they're looking to explore, but since their customer service representative told me they plan to use EAC, I can't assume that will change without some kind of uproar from the community.

    I'd like to thank you all again for joining the conversation and keeping it honest. I appreciate your input!

    Another good "antibot" thing they already have in the game is the open world PVP. Although that has to be balanced with the corruption system as the point of that is to prevent griefing, and likely the only way to stop a bot is to grief it. Unless Intrepid can find them. But with 10,000 players on a server, it could be very difficult to manually confirm each botter before banning the account, and we wouldn't want legitimate players banned accidentally.

    The whole addon debate is an entirely other story though. If they really want to be against "addons" then it is difficult, if not impossible, to enforce. My argument from the very beginning is that they shouldn't give the player's computer any information that they don't want them to turn into an addon. Otherwise you are really only giving an advantage to people who cheat and use addons rather than "prevent" addons. Even the anti-cheats can't stop everything.

    Rules that can't be enforced or upheld only serve to put rule followers at a disadvantage.
  • tautautautau Member, Alpha One, Alpha Two, Early Alpha Two
    I am sure that there are some readers of this thread who would appreciate a straightforward definition of "kernel-level anti-cheat system".
  • AzheraeAzherae Member, Alpha One, Alpha Two, Early Alpha Two
    In the simplest terms I personally can think of...

    A normal program that is not 'kernel-level' knows about itself and maybe one or two other things that your computer explicitly allows it to know.

    Kernel-level programs have ways to know basically everything happening on your computer. This does not necessarily mean they can influence it (but it's a computer, there's always a way), but that they at least have the capacity to know it.

    So a game knows what you type in the game, a kernel-level program might have a way to know what you typed in Discord, on this forum, etc.
    ♪ One Gummy Fish, two Gummy Fish, Red Gummy Fish, Blue Gummy Fish
  • XeegXeeg Member, Alpha Two
    edited May 8
    Azherae wrote: »
    So a game knows what you type in the game, a kernel-level program might have a way to know what you typed in Discord, on this forum, etc.

    Or entering your passwords into bank accounts, or scanning your computer for keywords and looking for personal information, or use your computer as a botnet to run mass DDoS attacks...

    Or any other nasty thing a criminal enterprise or government organization may want to use your computer for when given the backdoor access. Do you really trust EasyAntiCheat as a company to stop these types of organizations from gaining access to their network of convenient bots that everyone has downloaded on their computers?
  • leameseleamese Member, Braver of Worlds, Kickstarter, Alpha One, Alpha Two, Early Alpha Two
    As a cybersecurity professional myself i fully support this.

    A great example of non-intrusive software combined with innovation is https://anybrain.gg/.
    It is run client-side and tracks movement on a pixel level. one of the features is that it builds a 'behavioral profile'. When you activate a bot, it will detect that the movement is different then that off your profile.
    It will detect common bots based off the profiles off the bots. It can do a lot more.

    Definitely worth to check it out!
  • NerrorNerror Member, Alpha One, Alpha Two, Early Alpha Two
    Dulcibel wrote: »
    As a cybersecurity professional and a passionate gamer, I feel it’s my responsibility to address the growing trend of kernel-level anti-cheat solutions in the video game industry. While the intention behind these measures may be to ensure fair play, their implementation raises serious concerns regarding privacy, security, and user rights.

    That's exactly what a dirty cheater would say! I am on to you and your schemes to prevent anti-cheats.

    I am also not a fan of EAC.

    I think the best way to prevent cheaters (like you!) is to simply not allow client-side input. Players can email Intrepid, telling them what they want their character to do, and within 3 business days they get an email back with the results. This would also greatly reduce development time, and instead of UE5 devs can use HTML5, which is free!

  • LineagerLineager Member, Alpha One, Alpha Two, Early Alpha Two
    edited May 8
    Dulcibel wrote: »
    Xeeg wrote: »
    Seems fair to me. The design of the game should keep as much important information server side as possible so the user's computers have less to hack. This works well in MMOs traditionally anyways.

    They probably won't need a kernel-level anti-cheat.

    Thank you for the input!

    I've hesitated to bring this up anywhere for a long time, because I didn't know exactly what kind of anti-cheat Intrepid intended on using, however I recently spoke with one of their Customer Support representatives about this and they confirmed that they plan to use Easy Anti-Cheat, which runs at the kernel-level.

    They also mentioned:
    "Unless something changes between now and Launch, that is likely the solution we will use."

    I'm not a pro in the anti-cheat thread, but Easy Anti-Cheat is terrible. It is present in a large number of games that I have played or I am playing now, and there is always a dominance of cheaters.
  • NoaaniNoaani Member, Intrepid Pack, Alpha Two
    Xeeg wrote: »
    I was just reading a bit about how blizzard does it. They have an anticheat called Warden, which is usermode.

    This is probably part of the reason why it is hard for them to stop botting.
    Keep in mind, a big part of the reason bits are so prolific in WoW is because there is no financial incentive to get rid of them.

    The bot accounts generate more revenue than the people that leave the game due to bots. Blizzards stance is (and I don't actually fault them for this), if players don't care enough to leave the game, why should we spend money to reduce our subscription numbers?
Sign In or Register to comment.