Wyniki wyszukiwania

Wyświetlanie 1-10 z 294,653,573 pozycji
6
hercules so balanced.
W tej chwili
PuNcH 1T
5
Sound proplems
W tej chwili
Tony Crow
93
5
EA AntiCheat try to access LSASS passwords infos AND RISE ATTACK SURFACE of your computer
W tej chwili
Kylvan
Początkowo opublikowane przez KADELUXE:
Początkowo opublikowane przez Kylvan:

You have no idea cause you keep asking questions. I did asked you to stop fourth times i think.


Finally, OP couldn't answer something meaningful and tried to deflect the inconvenient question.

I won't go deeper into the rabbit hole because it's obvious that OP posted this with a hope that everyone will just blindly believe his extraordinary claims about "accessing passwords" and not with an intention to actually educate himself.

Technical summary

1. Anticheat has to check all running processes, there are no exceptions, cheats may use own process or abuse some legitimate 3rd party process such lsass.exe, discord.exe, myintimatephotos.exe etc.
2. In order to get an idea about the process, anticheat has to get a process handle, in other words, it has to "open" a process.
3. OP suggested that one way to check the process is to "Checking and compare signatures of original and doubted .exe". Let's see how you get a filepath of the running process in code: https://stackoverflow.com/a/1933140/1535767, the important part is OpenProcess function call that literally access a specified process.
4. Let's see OpenProcess function description: https://learn.microsoft.com/en-us/windows/win32/api/processthreadsapi/nf-processthreadsapi-openprocess?redirectedfrom=MSDN
Opens an existing local process object.
4. On the screenshot provided by OP, there is a message that comes from Windows Defender ASR rule called "Block credential stealing from the Windows local security authority subsystem (lsass.exe)", here is the description: https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#block-credential-stealing-from-the-windows-local-security-authority-subsystem
5. Rule's description states:
In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log.

ANSWER

EAAC anticheat wants to check running processes to ensure that process is legit.

Even before EAAC can actually "check" something, it has to "open" a process, it asks Windows to provide an access to the desired process.

Windows Defender denies the access to lsass.exe specifically when that rule I linked above is configured, that's why there is a alert in a log.

EAAC does NOT try to "access passwords".
EAAC doesn't even know that this process contains passwords because at this point EAAC doesn't know what the process is.
It has to ACCESS the process to actually get an idea that this process is a legit Windows thing and not some "battlefield_cheat.exe" renamed to "lsass.exe".
"Access" means "Windows, please give me a right to see this process information". It doesn't mean "read and dump personal data from this process".

Every other thing OP tries to claim or respond is misleading because OP doesn't have enough knowledge about the topic.

Lol guys who can't even prove his points relying on a stack overflow post without any knowledge using chatgpt as a piece of truth to find the sources LMAOOOOOOOOOO :D

Point Godwin reached ! :D

Speaking facts without accurate sources and relies on forums LOOOOOOOOOOOLLL
Na forum „MORDHAU Dyskusje ogólne
3,734
10
Why do new players keep leaving?
W tej chwili
[‡]=Storky=[‡]
Na forum „Off Topic
264
European leaders not invited to the Alaska summit
W tej chwili
Despiser
7
Jesus fffυck how do you beat that samurai dragon mf?
W tej chwili
Kelrycor
Na forum „PEAK Dyskusje ogólne
18
3 Bugged Badges
W tej chwili
LewandaSillyFeathers
23
Rearrangements to the British Ground Forces Tree
W tej chwili
WilHan
73
1
Last Epoch Achieves Another Major Milestone
W tej chwili
Autumn
491
8
[Mod] Galactic War Overhaul
W tej chwili
Quitch
Wyświetlanie 1-10 z 294,653,573 pozycji