Kernel Level Anti-cheat

[SecondLeaseGamer]

Jesus... I love Fromsoftware and was hype AF for a multiplayer game, but the only thing worse than Denuvo is Kernel Level Anti-cheat. Whats with devs being so lazy and poor at programming that they require the kernel level access to prevent cheater and hackers? This is gonna be a hard pass for me.

[Persephone]

oh crap no way....i swear every multiplayer is going to this nonsense. this makes it a no buy for me then. thanks for the info

[Severian]

Originally posted by SecondLeaseGamer:

Originally posted by Chibirion:

Um... sorry. What is Kernel Level Anti-cheat?

It means the program requires control over your entire PC to view all processes you run and to look through your memory for whatever it deems might be "illegally" accessing it. Its a very lazy and poor-practice that many devs have taken to using to stop hackers etc. But its an unsafe practice that many security experts have called out.

Heres a short of a youtuber named Thor who was a government hacker and a Blizzard security expert previously discussing it: https://www.youtube.com/shorts/LY2hG-_asKU

That Thor guy is poor choice of evidence as he's notorious for lying and ratting out. Just go read article about Karnel level done by experts, not frauds.

[Le_Langusto]

i really dislike this and thinking about a refund. its a f&ing coop game and no PvP hardcore esports thing. i dont get a anticheat at all. cheaters are already sad people.

[Nyx]

Originally posted by csand:

It's EAC same as Elden Ring. Sadly there is no other good way to stop the vast majority of cheaters other than thrse types of anti cheats. It only runs when the game runs so imo its not a big deal.
Ofc, Valve broke it in Proton so we will see cheaters coming from Linux, again

Can you stop spreading lies about Linux? Are you being paid by Microsoft to post this?

[De_faulty]

If ER nightreign is using the same AC as ER, ie Easy Anti-Cheat, you also have the problem that it doesn’t work very well.
There are countless cases where people have encountered cheaters in ER, some even managing to go as far as corrupting your save files.

[Something]

Originally posted by SecondLeaseGamer:

Originally posted by Chibirion:

Um... sorry. What is Kernel Level Anti-cheat?

It means the program requires control over your entire PC to view all processes you run and to look through your memory for whatever it deems might be "illegally" accessing it. Its a very lazy and poor-practice that many devs have taken to using to stop hackers etc. But its an unsafe practice that many security experts have called out.

Heres a short of a youtuber named Thor who was a government hacker and a Blizzard security expert previously discussing it: https://www.youtube.com/shorts/LY2hG-_asKU

Take what Thor says with a grain of salt though. Dude did NOT work security for Blizzard. He was a QA tester nothing more nothing less, and we all know how much Blizzard listened to their QA testers. Also, Thor habitually gives out bad advice. Like if you followed any of his advice on taxes and/or work you'd both be out of a job and in prison so fast your head would spin. Dude has a pathetically desperate need for people to feel like he knows everything.

Easy Anti-Cheat is already a kernel level anti-cheat. The only difference is that with ER: Nightreign is that it wont uninstall when the game does. Not only does an anti-cheat NOT need kernel level access to do it's job, but it doesn't need to stick around after it's host game has been removed. The problem is EAC is in basically ever game now because it's super cheap for the developers to use. Odds are you all have EAC on your PC already and just don't realize it. If you've played a Blizzard game, you got EAC on your system. If you've played basically ANY F2P game you've got EAC on your system.

Furthermore I've never actually seen or met anyone who's been banned by Easy Anti-Cheat. I honestly feel Easy Anti-Cheat is just malware. Malware that instead of stealing your credit card/debit card or login information or browser cookies is monitoring your daily PC habits to as to be able to sell the data gathered to places like Twitch and YouTube to give you those ads that seem oddly targeted.

[Something]

Originally posted by csand:

Originally posted by Mag Smrodu:

Take what Thor says with a grain of salt though. Dude did NOT work security for Blizzard. He was a QA tester nothing more nothing less, and we all know how much Blizzard listened to their QA testers. Also, Thor habitually gives out bad advice. Like if you followed any of his advice on taxes and/or work you'd both be out of a job and in prison so fast your head would spin. Dude has a pathetically desperate need for people to feel like he knows everything.

Easy Anti-Cheat is already a kernel level anti-cheat. The only difference is that with ER: Nightreign is that it wont uninstall when the game does. Not only does an anti-cheat NOT need kernel level access to do it's job, but it doesn't need to stick around after it's host game has been removed. The problem is EAC is in basically ever game now because it's super cheap for the developers to use. Odds are you all have EAC on your PC already and just don't realize it. If you've played a Blizzard game, you got EAC on your system. If you've played basically ANY F2P game you've got EAC on your system.

Furthermore I've never actually seen or met anyone who's been banned by Easy Anti-Cheat. I honestly feel Easy Anti-Cheat is just malware. Malware that instead of stealing your credit card/debit card or login information or browser cookies is monitoring your daily PC habits to as to be able to sell the data gathered to places like Twitch and YouTube to give you those ads that seem oddly targeted.

Jfc dude get a grip.

Any anti cheat without kernel access is useless, because an app like cheat engine is making changes to items loaded in memory. In order for anti cheat to detect this it needs system level access to monitor that.

EAC isn't gathering usage habits and it only runs while the game is running.

It's not ideal but there is no other way to prevent the type of game ruining cheats that are being used

EAC isn't going to stop cheat engine. An anti-cheat doesn't need ABOVE ADMIN privileges on your system to determine whether or not a game file has been altered or added/edited by outside sources. And until Valorant anticheats have been doing it successfully for many many years. Valorant proved proved that a lot of people are willing to look past rootkit AC's if the game they wanna play is popular enough.

Are you the same type of dude who thinks McAfee Anti-Virus and Norton Anti-Virus aren't ransomware programs?

[FIGBird]

I'd like to see some of the sources you are using to make any of the claims you speak of @csand.

Firstly, in regards to the linux assumptions, EAC when enabled with proton is still running. It just runs inside of a userspace, rather than be given kernel level access. While I am sure that can allow a cheater to bypass it more easily, its far from the only route to actually cheat in a game "secured" by a kernel level anti cheat.

Not only are the cheat developers funded and capable of finding other work arounds, there are also plenty of ways to cheat via hardware which stuff like EAC will not capture. If you spend some time doing research around whether kernel level anti cheats actually work you will rapidly find that they are a deterrent at best.

This leads into why I am against anti cheat systems that require kernel access. They provide very little benefit while increasing the attack surface of the system they are installed in. In other words, they are a route that an attacker can use to gain access or control over a system.

A previous post noted the Genshin Impact driver being used to install randsomware, and that is the kind of security and privacy concerns that should be enough to migrate away from KLAC.

The reality is that server side anti cheat systems are likely the only way we are going to prevent cheating and the problem is that they are going to be expensive to create since they would need to be custom made by the developers to look at what is not possible given their game. This is why EAC and other kernel level anti cheats are so readily used, not because they are good, but because they sell the lie that there are no cheaters on their game to investors and players alike.

I hope that Nightreign will remove the anti cheat, but I am not holding my breath. At least with this one it might work with proton given ER itself was set up to allow it.

[Nyx]

Originally posted by FIGBird:

snip

THANK YOU! I couldn't have the patience to write all of that myself, and honestly, I don't think that guy will care about that and will continue spreading his lies, but thank you anyway.

[FIGBird]

You're welcome. You're right that it is unlikely that comment will change their stance or mind.

The comment is actually meant for others, though. Its meant to have a calm and reasoned response that might catch someones eye and lead them actually ask questions to make their own informed choices on what they are willing to install on their machines.

Ultimately I think people do not understand what they are installing with things like EAC, and my hope is simply to get more people to ask for alternatives so that we can get away from them some day.

[That Laggy Guy]

Elden Ring has Easy Anti-Cheat (EAC) which is also a kernel-level anti-cheat. Not sure why everyone's shocked by this having it, too. I don't like it either, but this isn't news.

[FIGBird]

I am going to guess that a lot of people are shocked because the Steam store pages now require proper disclosure of the anti cheat being kernel level. For many this may be the first time they've heard Elden Ring even has EAC, or the phrase "kernel level anti cheat".

It also may be that folks are reacting to reactions of content creators which are over sensationalizing this fact. This is pure speculation, but it would not surprise me given the long standing trend of sensationalism to drive engagement. To feed the YouTube algorithm, as an example.

For me, its not a surprise, but it is still a disappointment. It also means I am no longer sure I can even play the game, given that I am a linux user myself. I also just wanted to chime in given some of misleading statements I was starting to see here.

[De_faulty]

Originally posted by FIGBird:

For many this may be the first time they've heard Elden Ring even has EAC, or the phrase "kernel level anti cheat".

Don't you immediately see "EAC" and its logo when you boot up the game?

[FIGBird]

Until the Shadow of the Erdtree DLC came out, no actually. The splash would render as a white rectangle for most of my playtime. Also if you are using the randomizer or seemless coop mod, that splash isn't going to pop up either.

I would also not be surprised if most folks have no idea what the EAC logo looks like, or that they generally ignore those kinds of splashes. Given how much is thrown in your face at the start of a lot of games, that seems natural to learn to tune it out.

I cannot speak for everyone, though. I am just making an educated guess as to why there may be such a high sense of surprise around EAC.

[MLGrocket]

i love scrolling through posts like this cause typically, not a single person ever understands how anti-cheats work. kernel doesn't mean anything, every anti-cheat out there right now is kernel. the only way for it to be a security risk is if you give someone direct access to your computer through something like teamviewer or in person. or you download something you shouldn't.

remember the RCE exploit in apex? people were quick to blame the anti-cheat, but they quickly shut up when they realized it was the very old modified source engine apex uses and had nothing to do with the anti-cheat.

also, EAC is garbage anyway and is incredibly easy to get around. hence the "easy" in the name.

people like to quickly bring up vanguard, for example, but not once has there been actual evidence of it doing anything people claim it does. i will never forget when someone linked me riot's own FAQ for it as proof, where they explain in detail that it doesn't do the things people claim it does.

a few minutes of research goes a long way.