Kernel-mode anticheat is a huge nope

[Quasar]

I won't go into the full details because there's already an excellent thread on the Bethesda.net forums about this:

https://bethesda.net/community/topic/407885/why-you-should-remove-doom-eternal-from-your-pc-immediately

 

What I'd add to the above is a larger amount of emphasis on the fact that this doesn't require any malfeasance from Denuvo to be a threat - if any sort of exploit can be found in the coding of the AC's components, it becomes an open door to third-party hackers. As a developer, former IT staffer/sysadmin, and part-time hacker (in the old-school sense of that word) I strongly recommend that people do not install this on any machine they have sensitive personal information stored on, including bank account numbers, have used credit cards to purchase online, SSNs, account passwords, etc.

 

Apparently on top of being an unacceptable security risk, it's also making the game really unstable for most people. What a monumental fuck up.

Update: As of 5/20, Marty Stratton has announced that the anti-cheat will be rescinded in the next patch while they consider how to implement it in a way that is fair and allows for offline-only play, and has also confirmed that performance issues in Update 1 are a separate issue.

Edited May 20, 2020 by Quasar

[Vic Vos]

So far, I can only confirm that my FPS has already dropped by about 10-15, i.e. from avg. 130fps to 120-115fps.

Edited May 15, 2020 by Vic Vos

[MFG38]

Do notice the following line in the patch notes:

[Vic Vos]

9 minutes ago, MFG38 said:

Do notice the following line in the patch notes: 

Except when you launch the game after the fact, it just reinstalls itself back, lmao.

[printz]

Does Windows warn you when it tries to install this kernel driver?

 

I'm not immediately concerned about security and rootkits, but I am concerned that trivial entertainment stuff like "anti-cheat" are tolerated by Microsoft to be installed as kernel drivers, especially with all the trend of sandboxing applications, not rooting them! That stuff should be reserved for critical device access stuff going through high validation scrutiny, not entertainment junk.

Edited May 15, 2020 by printz

[Cacodemon345]

3 minutes ago, printz said:

Does Windows warn you when it tries to install this kernel driver?

I don't think Windows would warn, just fail the install (unless you are talking about that unknown driver prompt, which will trigger on installation of a new signed driver which can be refused to avoid installing it but then the game won't be working properly).

[Maes]

9 minutes ago, printz said:

That stuff should be reserved for critical device access stuff, not entertainment. 

 

Considering how seriously the industry and some players take gaming, the distinction is somewhat blurred -besides, people accepted crap like Sony's rootkit DRM, SecuROM or StarForce anti-copy protection, or anti-cheat services like PunkBuster in the past.

Edited May 15, 2020 by Maes

[taufan99]

I hate how Denuvo keeps murdering the modern gaming industry, despite not being a "modern" gamer myself.

[Doom_Dude]

Ugh, this really annoys me as I was trying to get back into the game after a long, long break and I ended up installing this shit, thinking the update was some game fixes or whatever. So I went ahead and uninstalled Denuvo after reading about this, this morning.... does that really get rid of all of it. Bah.

 

Gonna go back to playing something else for awhile, again. ;)

[printz]

Antiviruses follow the same practice of rooting into your kernel and yes, they do fuck up your system with BSODs and inconsistent behavior when you try to do unusual stuff. I expect anti-cheat rootware (which sound like something highly related) to have the same problems sooner or later. I'm mainly concerned about shitty programming ruining your user experience. 

 

I would say this is a failure on Microsoft's part of not serving a sandboxed development environment (if not walled garden) for games like this. But that opens another can of worms about independency...

Edited May 15, 2020 by printz

[andrewj]

I'm not sure any anti-cheat system can really work without having full access to the machine.  If it is sandboxed in some way, then software will be developed which will be able to fool it (bypass it), since it won't have all the information about what is running on a user's computer, or its internal state could be manipulated.

 

So it doesn't surprise me at all that this system requires a kernel driver, though it's not something I would want running on my machine.

[Maes]

Well, in the end, online multiplayer games rely on a honour/trust system to work. How do you know that you opponents' client isn't hacked to high heaven? Client-to-client or client-to-server verification only really works if you trust the client itself.

[printz]

I wonder if Denuvo Anti-Cheat is going to block any input automation software (which triggers user events normally originating from mouse and keyboard). Those are useful even for legit cases.

[Lampenpam]

Many other anti-cheats are ring-0 too. Why didn't we boycot these before? Seems like a pointless complaint to me.   

 

Valorant only got under fire because the anti-cheat runs literally all the time, but Denuvo closes with the game. So what's the issue with ring-0 anti cheats suddenly when we had them for years? 

[Smouths]

22 minutes ago, Lampenpam said:

Many other anti-cheats are ring-0 too. Why didn't we boycot these before? Seems like a pointless complaint to me.   

 

Valorant only got under fire because the anti-cheat runs literally all the time, but Denuvo closes with the game. So what's the issue with ring-0 anti cheats suddenly when we had them for years? 

 

So we should just shrug off every bad practice that's happened before or been normalized? That sounds horrible.

 

It's worsening performance and outright breaking the game for a lot of users. Personally, I don't want invasive exploitable security risks added to my machine, and especially when they're snuck into an update for a game I've already purchased and installed.

_____

 

Oh well. Didn't really care for the campaign or battlemode, so this is a pretty easy decision to uninstall on my end.

Edited May 15, 2020 by Smouths
typo

[printz]

1 minute ago, Smouths said:

Oh well. Didn't really care for the campaign or battlemode,

Says YOU. But for me Doom is my life.

[Vic Vos]

3 minutes ago, Smouths said:

So we should just shrug off every bad practice that's happened before or been normalized?

Apparently, yes.

[Maes]

25 minutes ago, Lampenpam said:

Many other anti-cheats are ring-0 too. Why didn't we boycot these before? Seems like a pointless complaint to me.  

 

Uhh...actually, many of those earlier anti-cheats and (mostly) copy protection schemes got such a bad rep that the warezed version of a game (or even a plain old audio CD) was a thousand times preferable to the "genuine advantage". The most annoying/broken of them were pretty much weeded out of the marketplace by natural selection.

[Lampenpam]

9 minutes ago, Vic Vos said:

Apparently, yes.

 

Then why didn't anyone complain when other anti-cheats are ring-0? If it this actually was an issue (let's imagine it actually is, just pretend) then all these games with ring-0 anti-cheat would have continously get criticism for that. But they don't, probably because it's not an issue after all, and everyone is just scared of ring-0 because it was mentioned with Valorant's Venguard, but the issue there was that it runs all the time, which is stupid.   

 

So using ring-0 anti-cheats for years with no issues ever reported, I think it is stupid to complain out of the blue just because you have heard something remotely relevant from the Venguard incident. 

Also 5G towers don't cause cancer either. 

[seed]

Now the bigger question is, why did id think about implementing such an anti-cheat measure in the first place? 2016 was just fine just with Denuvo...

[Lampenpam]

Just now, seed said:

2016 was just fine just with Denuvo...

 

Denuvo-DRM. Note that Denuvo-Anti-cheat is something else. And 2016 did have hackers, it wasn't fine. I even hope Denuvo-Anti-Cheat is actually as good as Denuvo-DRM recently is, as some games are uncracked for months, even years now. If this could allow to fully prevent hacking in multiplayer, then this anti.cheat could be great news. 

[Maes]

Actually, for people to complain about something it has to be noticed first. In medical terms, if we consider cheating to be a sickness, it's one thing for someone to discreetly slip in a tiny 5 mm suppository while you sleep, and another to plow you when wide-awake with a big, spiky dog-toy sized contraption that causes discomfort and cramps all the time. That's what this latest thing is all about.

 

That's also how people can get multiple malware proliferating on their system -most are discreet enough to be almost asymptomatic on their own. Those that are overly aggressive will prompt immediate action, as in this case.

Edited May 15, 2020 by Maes

[Smouths]

24 minutes ago, Lampenpam said:

 

Then why didn't anyone complain when other anti-cheats are ring-0? If it this actually was an issue (let's imagine it actually is, just pretend) then all these games with ring-0 anti-cheat would have continously get criticism for that. But they don't, probably because it's not an issue after all, and everyone is just scared of ring-0 because it was mentioned with Valorant's Venguard, but the issue there was that it runs all the time, which is stupid.   

 

So using ring-0 anti-cheats for years with no issues ever reported, I think it is stupid to complain out of the blue just because you have heard something remotely relevant from the Venguard incident. 

Also 5G towers don't cause cancer either. 

Not familiar with Valorant or Venguard, but uh, you're saying people did complain? Just because that situation was worse, then this is fine? ...What?

 

And it isn't causing zero issues, because people are reporting issues. Plus it's shitty that it's been shoehorned into the product people already paid for. Knowingly adding security risks to users' machines just isn't okay.

 

21 minutes ago, Lampenpam said:

...I even hope Denuvo-Anti-Cheat is actually as good as Denuvo-DRM recently is, as some games are uncracked for months, even years now. If this could allow to fully prevent hacking in multiplayer, then this anti.cheat could be great news. 

I'd rather have people potentially cheating in online games sometimes than tolerate performance problems and real-world security risks. Hell, I'd even like for games' code to be more transparent and accessible for that matter.

Edited May 15, 2020 by Smouths

[Lampenpam]

4 minutes ago, Smouths said:

you're saying people did complain?

 

yeah because it was running all the time, even stopping certain software from working while the game was closed. People misinterpreted that ring-0 is the actual issue. Probably it sounds scary.  

 

The performance issues are legit concern, but on all threads about this anti-cheat the complaints are 99% "ring-0 spooky" and hardly anything about performance. Not saying it's not a legit complain! If some people have performance issues it need to be fixed soon, just like Proton not working needs to be fixed asap! But it seems only few people have performance issues and this isn't what the current shitstorm is about at all. It's all about that ring-0, which isn't anything new if we had this type of anti-cheat for years with everyone being fine with it.     

So instead to complain about something that clearly isn't an issue for years, I much rather prefer having that, than having more cheaters in my online game.

 

[Maes]

11 minutes ago, Smouths said:

I'd rather have people potentially cheating in online games sometimes than tolerate performance problems and real-world security risks. Hell, I'd even like for games' code to be more transparent and accessible for that matter.

 

You know, this is also supported by some socio-economic theories that argue that having a perfect 0% crime rate in the real world is impossible and actually undesirable, for similar reasons as those you mentioned -it would be impractical and inefficient to enforce, especially without giving away all of your freedom and civil liberties.

Edited May 15, 2020 by Maes

[Graf Zahl]

Here's another reason why I do not buy modern games anymore. DRM is bad enough, but games becoming a stability issue for the entire system is a clear no-go. The main problem with these things isn't that they run in Kernel mode but that it has been a known issue for a long time that developers of such tools often just have enough knowledge to get the intended job done but not caring one bit on overall system impact.

 

I've also stopped using third party AV because these companies give me zero reason to trust them.

 

[Archvile Hunter]

The performance impact caused by this update is insane! My fps went from 200+ all the time, to scraping double digits! Before the update, my CPU frame-times were around 2ms, but now it's consistently above 6ms, averaging 8ms in places, and occasionally hitting 10ms. I've noticed random performance hitches, where the game pauses for half a second, and the physics get all messed up. I have not had any crashes, but I've heard others reporting that the game won't run at all, or that it causes BSoD. This is a total shitshow.

 

The security concerns are overblown, but not completely invalid. Installing kernel-level drivers to operate entertainment software is absolutely unnecessary.

[Vic Vos]

50 minutes ago, Lampenpam said:

 

Then why didn't anyone complain when other anti-cheats are ring-0?

I'm about to end this man's whole career.

 

Boom

https://news.ycombinator.com/item?id=17555582

Bam

https://security.stackexchange.com/questions/160635/are-anti-cheat-software-vac-easyanticheat-battleye-etc-considered-as-poten

Bop

https://www.schneier.com/blog/archives/2005/10/blizzard_entert.html

Bada-bop-boom

https://antipunkbuster.wordpress.com/2008/04/22/netcoders-case-punkbuster-busted/

POW

https://massivelyop.com/2016/02/22/battleye-clarifies-anti-hacking-program-and-privacy-to-ark-players/

[Lampenpam]

@Vic Vos None of these ever blew up. People kept playing Battle-eye games, with no mention of ring-0 issues at all unless you google for them and find some thread in some obscure forum (which you probably did right now, am I right?). If the complains never hit mainstream, I don't think they were important to begin with. It only got a big discussion now because of Valorant for actually a different reason. 

Edited May 15, 2020 by Lampenpam

[printz]

6 minutes ago, Archvile Hunter said:

The performance impact caused by this update is insane! My fps went from 200+ all the time, to scraping double digits! Before the update, my CPU frame-times were around 2ms, but now it's consistently above 6ms, averaging 8ms in places, and occasionally hitting 10ms. I've noticed random performance hitches, where the game pauses for half a second, and the physics get all messed up. I have not had any crashes, but I've heard others reporting that the game won't run at all, or that it causes BSoD. This is a total shitshow.

Hopefully that should motivate id more to fix the problem. Performance drops are a visible degradation of quality which may render a game unplayable. I wonder if customers can post such issues to id's support.

Edited May 15, 2020 by printz