In South Korea, cheaters could be punished with up to 5 years in jail or fines exceeding $40,000.

StarForce actually bricked my Windows 7 PC when I installed an old game that required it. Only after a full reset the PC worked again. It's real

No. Back door callers aren’t just tinfoil. The kernel is serious fucking business. You create a back door just by having a bug - it doesn’t have to be intentional. Valve doesn’t want to put that in ppls computers because they’ll be responsible for

>Install super invasive spyware "anticheat" software to play your favorite online game >Game dies after 11 months when either the sequel comes out or the studio goes defunct >No support causes exploits to be discovered >Exploiters get through the back door >Because the spyware can't be uninstalled without rebuying Windows, most users keep it on their systems >Everyone who has it installed instantly gets malwares, trojans, and other viruses put on their devices and their identities stolen through backdoor exploiters >Even if you installed the spyware through other games, you're still affected >The twelve billion page EULA has a clause in Chapter 112, Section 81, Paragraph 14, Line 57 that clearly states they bear no legal responsibility should just such an exploit occur >No one can do anything about it >Studios who make online games still continue to add the spyware in, despite everyone knowing how broken and useless it is >Be Denuvo

Even kernel based anti-cheat can be bypassed with hardware devices and increasingly sophisticated methods. Obviously the barrier for entry will be much greater but the cat and mouse game will always live on. The drawbacks of essentially having to bundle a rootkit with your game should not be taken lightly.

If history has taught us anything, Valve will never take a simple, temporary solution when they think a more permanent solution is on the horizon. Valve time can be a bitch, but it often pays dividends.

Kernel level AC is simply annoying, doesn't allow you to install ReShade, or mod the game at all and if you have some non-standard stuff like Process Hacker (misleading name btw, it's better task manager) installed they throw a fit, quite often even when the program is not running. And the best part is that it has, well, kernel level access, why is that an issue? A) The developers have complete access to your PC and since it's not open source, you don't know what it's doing or what kind of information it might be reporting to the company B) if the developers fuck up, they just created a possible attack vector that can be used by malware to infect your PC in the worst possible way

My Linux is allergic to invasive anti-cheats

One problem of kernel level anticheat besides the unnecessary access level on your pc, is that anti cheats are softwares, and EVERY software has vulnerabilities, meaning that if one day vanguard get “hacked” or anything, the person/group behind this would have TOTAL control of your machine, that’s why every single person that cares about cybersecurity hates it. It’s effective, but there are another ways you can do the same thing but without kernel level access.

At this point I just don't believe they have anything. The insane spin botters and fast shoot isn't even being detected when it should be so easy, they even banned people for spinning mouse too fast absolutely insane

No. You do not need to access to my entire system for a *video game*.

As a Linux user, I ideologically can not accept kernel level anti-cheat unless I can run the game in a virtual machine without the fear of getting banned.

I think that the plan to use AI to detect cheats is a really smart move, considering that most players can accurately spot a cheater just by looking at their POV, if you had an AI that basically does the same thing but without having to enslave people for it to run consistently, than you'd have an amazing anticheat that doesn't require any crazy file access.

1:17 I'm really glad we're back to non-painful audio levels with this track

short answer: no longer answer: nothing should have kernel level access. its great power that I've not seen anything yet have the correct responsibility.

not sure if you used it before, but thanks for including "Cruising the countryside". first time i've heard it and i absolutely love it

This is a really well put together video and I feel so happy to have someone like you in the CS community, who isn't just here for publicity stunts and to seek attention by being the loudest at saying the current popular thing, but rather constructing your thoughts in a way that's a lot more mature.

Hopefully there won't be any Cabossing business in this video. Edit: it happened sooner than I thought.

There's literally 0 reason to play official matchmaking right now. You either get people who are rage hacking from warmup, or toggle when they start losing or think you're cheating because you're doing better than them. Had back to back games last week where 2 guys were spinbotting from warmup at 11k and then the next game someone toggled because I killed 3 people in a 1v5 and then lost the round, but apparently the shot I hit on them was hacks. Guy didn't even have to leave the game so he was already injected, either turned them on or ramped them up because he was hittin them scout headies. When I called him out he just said he learned it from me, implying I was hacking. Uninstalled, no point.

Let’s see, we’ve got EFI cheats, DMA cheats, and custom microcontroller cheats. While a kernel level anti-cheat may be effective at raising the bar, it’s not perfect.

Phil, pls save surf. All the servers are dead. What can be done? Possibly make it a main menu gamemode?

Starforce actually did manage to shatter a single cd(completely destroying the reader in the process) once. I suspect cd was already damaged a bit though but it did happen. It was a game borrowed from a friend and when I told him it exploded he did not believe me.

GW1 map ! 9:20, let' gooow, great stuff btw keep doin this !

While I understand why people want aggressive anticheat to combat cheaters, I hate giving anything kernel permissions. I don't think people understand just how insane that level of access is. The administrator/root account has fewer permissions.

CS2 is going through the TF2 problem, just with extra steps. The funniest thing is both games can win if they just use community servers.

or for a few lines of code you can detect someone spinning whilst getting 100% headshots with a fully automatic scout

I love your deep dives on these strange topics :)

4:10 made me actually laugh out loud. The timing and everything. Best KZfaqr

I play on a Mac using whiskey bottle and I don’t think vac would like it if it was kernel level

quick answer: no, gaben shouldn't have ring zero access to my windows kernel

Great video. Very informative

Great vid!

The open qualifiers for the major used kernel level cheats and people were still complaining cause you could still cheat. People crashed or had bad performance, and funniest of all, there were people online saying that they shouldve used a kernel level anti cheat INSTEAD of what they use now even though IT ALREADY WAS KERNEL LEVEL. People just think kernel means "good" or some shit, once you realize this you realize that most people are basically just asking valve to invent something that just somehow gets rid of the cheating problem. Its like asking tesla to just make flying cars that cost nothing to make and pose no threat to the environment. We are not that technologically advanced, and people dont seem to realize you cant just get this problem to "disappear" there are pros and cons to every approach and nothing you do can just suddenly pop a perfect anti cheat with no downsides that works forever into existence

The current VAC is so effective you'd think CS doesn't even have an anti cheat system.

Thanks for the video!

This is a fantastic video

once phillip makes a video there will be an update next tuesday

Thank you making a video addressing the issue. Don't know if it's a region thing but being put in Singapore servers it feels like more games have hackers than not, not in a salty way either as most the times the hacker/ hackers have been on my side (I just want a clean game). To add onto it, I'm from Aus, but get 5 better ping to Singapore and can't do nothing about it because Valve offers a ping restrictor, not a region selector. The last 3 region blockers I've installed don't work and have pop ups that say "valve/ steam has reset server options"

One of my favourite examples of anti-piracy is when an audio plugin added it and it slowed everything down and made everything significantly bigger, so people would buy the plugin and then use the cracked version as it was superior

For the record, Vanguard causes blue screens on some devices and caused plenty during tournament matches. I have 2,000+ matches on Valorant over the past couple years and I've gotten around 10 blue screens, all during Valorant matches. No other game does the same to my system.

ngl if someone has a velocity of X and gets 3 headshots through a wall... Surely... if someone flicks more than 30 degrees in a frame and ALWAYS lands perfectly: ban. There are so many things that could be done without an invasive anticheat. I may be wrong, but surely stats required for this are possible to create even server side.

bro the type who advocates surveillance cams on every possible public space

this is a certified banger

Rootkit anti-cheats are only a brute force band-aid solution. They are going to be bypassed anyways, so in the end it'll only become an annoyance for the rest of the players while the bad actors it's supposed to target won't even think about it.

Currently fighting StarForce in an ancient game. Seems like reversing it will be the only solution at this point...

Something people miss in these convos about kernel level anticheat: I imagine the labor is very expensive

Literally a decade and its still the same discussion.

Also, Linux. They kinda want to keep the game there

I think the endgame of multiplayer games is that everything is done serverside and the server only tells you what to render, the client knows nothing beyond the state of the UI and what it has been told. That way cheats have no data to go off beyond what you are intended to see.

Damn the Drok's Forge shortcut reference really was a blast from the past lmao

That "Hack v Hack" quote reminds me of "Interview with a Cheater" you did a few years back. Honestly, that entire video is relaly interesting when you think about anti-cheat and…blarg, I am tired, it is like 3:15 AM.

3klicks posted about VAC, VAC Anti cheat fix is invevitable at this point. Thank you 3klickphilip u r truly a gem to the CS Community

Kernel is a complete meme that hasn't stopped cheaters at all in other games.

I would have never expected to see a reference to oldschool Guild Wars in a 3kliks video. You truly are a man of culture.

The problem is that CS:GO's VAC, in its later years, was heavily dependent on AI to recognize potential cheaters. However, it took Valve *years* to train this AI up properly. Unfortunately, CS2 runs on a new engine with new code, and this means they need to completely retrain their AI Anti-Cheat. While it likely won't take *as* long to train, as I expect Source 2 was deliberately coded to better mould with this AI, the process will certainly not be quick.

it would be cool if VAC simply *fucking did anything*

As soon as VAC gets kernel level access, im done playing Valve Multiplayer Games.

That final meme image reminds me of when I used to try playing CS with a Steam controller and the 'mouse intertia' setting (or whatever it was called) for the touchpads switched on. Anyone watching me play on Overwatch would have been 100% convinced I was a bot with the way my view moved in perfectly straight lines...

lol, that final 9 in the slay the spire clip made me cry

gotta love installing a kernel level backdoor that thousands of individuals are constantly working hard to gain control of.

If VAC required kernel access, I would stop playing CS.

HAPPY MILLION BTW!!!!!!! 🎉🎉🎉🎉🎉

Hey, I like the new upbeat fast music

Thank you for making this. I am so tired of seeing 15 year olds on reddit saying "just do kernel level anti-cheat, the only thing I use my computer for is video games and the only thing I care about is CS2 cheaters". If you install kernel level anything (rootkits) then your computer is no longer JUST your computer, comrade. Now it's Riot or Epic's computer too, along with any malicious actors inside their networks. Fuck that, no video game is worth backdooring your own computer, it's just not that serious

it would make no sense for valve to add kernel AC to VAC considering it would kill their games (admittedly only two games) on linux which is used on the steamdeck.

Good video

Philip have you considered making a follow up video talking about VACNET? In the long term detecting symptoms (weird player behaviors) instead of trying to detect the cheat itself (no matter if it is kernel-level, hardware , etc..) seems to be the way to go, because no matter how much effort you place on hiding it, if you cheat you will always play with a different pattern, some may be obvious to experienced players (like weird crosshair placement) others might be only to AI (micro adjustments only possible by machine code). For me Valve has the best solution in the long term, the problem seems to be the short/medium term, and that could be solved by bringing back Overwatch (fixed of course) and improving the thrust factor system.

I think just about all client level anti cheats are just about useless. There will always be a higher level. If the anticheat is on the kernel level, the cheat will be on hypervisor level or via DMA boards. Kernel anticheats just open more holes to lower parts of the system which will only enable bad actors to get access to those parts more easily. The best way (imo) to detect and mitigate cheaters is by server level anticheat, where the server will only send information to the client when needed thus lowering the effectiveness of ESPs and closely watch (either automatic or by humans) the behavior of player to detect aimbots. Server level anticheat wont be perfect but so will be client level anticheat but I still think resources are better used in server level anticheat. Edit: whoops, commented before watching the video...

This is going to be a long and rambly multi-part post. ============================================ I don't think Valve can realistically try to roll out kernel AC, primarily because they wouldn't have to just roll it for Windows' NT kernel, but also for Linux, some people say this isn't possible because we can just roll our own custom kernels and modify whatever we want, however, Linux users with Nvidia GPUs have been dealing with Nvidia's proprietary kernel modules for years, so Valve technically could drop "vac-dkms" for Linux if they really wanted... but with our kernels being open source and letting us customize them as we see fit we could indeed just modify them to lie to the AC and effectively bypass this hypothetical vac-dkms*. All that being said, the privacy concerns of kernel AC have always rang a bit hollow for me, ANY proprietary software that you run on your pc (discord, steam's client, steam games, your keyboard and mouse RGB software...) has access to everything your regular user has access to, which is where 99% of your actual sensitive information is, and you *don't know* what it is doing because you cannot see the code, any of these programs could spy on you if it chose to just as easily as vac can, but kernel access doesn't really do much more in that aspect unless you have multiple users in your system, since that would compromise them. The security concerns on the other hand are absolutely real since otherwise, a remote access vulnerability in a game would only give you user permissions, but with network-enabled software running in the kernel you're essentially leaving root ssh open at all times, which is even worse since some of these AC will run even while the game itself isn't. I don't believe there's a single valid reason for why a *videogame* would require kernel access to my main workstation, it violates the principle of least privilege. =========================================== Since I'm already writing a comment, I want to also mention that I've been a big fan of your channel(s) for many years (since the first (modern) Odgrub video on 2kiks) and I love your particular style of video and narration, but it's always broken my heart a little to see that, despite being super into technical things, like game engines, graphic technologies and whatnot, you don't have much interest on Linux things, even though you got yourself a steam deck. I remember a video about the steam deck where you mentioned you couldn't screen record "because it's Linux" and I just didn't really understand what that was about, and it makes me think you could get a lot out of getting a little more into it and learning about it, it's a whole world full of interesting things that 2kliks could get dozens of videos out of, you could even more easily tinker and mess around with newer AI models and whatnot, and I'd personally be more than happy to walk you through some things. I know a lot of users are akin to the vegans of computing, but there's a whole rabbit hole of cool things underneath that surface and when you really know it, it makes a lot of sense why Valve decided to stick to it rather than use Windows for their handheld. =========================================== Nice to see that Unity Research video getting some love it was so good. Cheers ~sesu * edited point about vac-dkms to reflect input from @Spartan322

X2 mentioned! Im surprised phil is a fan but not disappointed!

Love the Guild Wars map!

Something to consider is that Valve is pushing for Linux, hard. Has been for some time, now. And Kernel access for an anti-cheat on Linux is a much more complicated issue, not only because of how Linux users are on average *much more* sensitive to privacy issues and invasive software, but also because making this work on Linux based distrubitions systems would be a massive technical hassle for tons of reasons.Valve put a ton of work for gaming to be a thing on Linux, you could argue that they're single handedly responsible for gaming being basically a thing on Linux, that's how hard they pushed for it. It's simple: _For CS2 to get a Kernel Based Anti-Cheat, _*_they have to drop CS2 for Linux._*

90% of current cheaters could be banned by writing a script that detects if a gun shoots faster than it's supossed to, hitting frequent bunny hops (10-20 jumps in a row continiously), if you have a stupid high spin rate AND kill enemies in a fast fashion, there's a lot of tiny scripts that can go a long way.

That Guild Wars Map brings back beautiful memories.

The thing with invasive anti-cheat software is actually trusting the company that makes it. Like Vanguard, Tencent owned means authoritarian government owned.

what i dont get: isn't there a simple "server side" system that can detect when someone has a 100% hs rate with a scout and has 30+ kills? Atleast you would get rid of the super obvious cheaters.

I remember downloading Valorant so i could play with a few friends, and suddenly my PC was so much slower than before. I thought I had installed some kind of virus, but i decided to check Task Manager to check what was running at the time. I noticed that something 'Riot' was running in the background, so i uninstalled 'Riots' game, Valorant, and magically my PC ran significantly faster. So from my own anectdotal experience, it must've been some kind of thing related to Valorant, and I'll hazard a guess that it was the Anti-Cheat software.

Kernel level anti-cheat is not something you can implement on Linux the way you can on Windows because on Linux there is no central distribution authority for the Linux kernel. No single organisation compiles copies of the kernel for you, including modules (including such a kernel level anti-cheat module). As such, even though the kernel supports module signing, you can just compile the kernel to disable this or use your own signing key. This means that a developer of a kernel level anti cheat can't go to "Linsoft Corporation" and say: Hey, can we get this kernel module signed so that users can install it but can't modify it. As such, it would be trivial to reverse engineer any kernel level anti cheat module's userspace APIs and to replace it with a dummy module. Moreover, since the linux project wants to encourage people to contribute source code to the kernel, they don't provide stable kernelspace APIs. It's the reason why nvidia drivers for linux must be updated with every linux update and re-compiled. Effectively all these features which make linux open and pleasant for end-users to deal with, are obstacles to kernel level anti-cheat. Kernel-level anti-cheat requires more control over the user's computer than the user themselves have which is not possible in the context of a project like Linux. What could technically work is if some entity created "gaming linux" which used efistub signed with collaboration from microsoft to implement a full secure-boot chain, which required secure boot, and where the signing keys for kernel modules were owned by that entity. Game developers could then go to that entity to get their custom kernel level anti-cheat modules signed and games could be required to run on that kernel. The issue is that because it would still have to be based on the open source linux project, the things I mentioned earlier would still apply. The userspace APIs would still be reverse-engineerable. Someone could still make a dummy module to run the game on other linux distributions without the signing restrictions. Even if the game used hardware attestation, it's possible to at the very least just use attestation forwarding (which I guess with more effort from "gaming linux" could be made more difficult). Simply put, the issue is valve is invested in Linux support and would not be willing to forego Linux support in order to implement a more intrusive anti-cheat. What you don't seem to talk about that in this video is also the privacy aspects. You meme about Gabe Newell finding out what porn you're watching, but anti-cheat software requires forfeiting your privacy. If you want to know effectively what it's like: VAC is like inviting someone to sit next to you whenever you your game. Kernel level anti cheats are like inviting someone to live with you and observe you 24/7 even when you're not gaming. These analogies are not even that far fetched when it comes to how much other stuff people usually do on their computers.

Before going with the invasive measures, especially for Counter Strike, I'd like to see measures like Overwatch revisited, as well as systems that notify players when one of their reports results in a ban. Games like Overwatch 2 and Rust already do this, and it makes me and all my friends far more likely to report someone AND provide useful information when we see the results of our efforts. If there is STILL a huge problem after both of those measures, then I'd be more open hearing arguments about invasive systems, personally!

Kernel based anti cheat systems are effective, only at the cost the internal privacy of your pc. This is essentially a well intentioned root kit that is just looking at and messing with memory at the lowest level. You should have insane levels of trust with the developers of the game to be consciously ok with this, due to the insane levels of potential breach of privacy. A factory reset of your computer will quite often not get rid of a rootkit installed in the kernel, so kernel level anti-cheats effectively embed themselves permanently, with the only way of removal being to either replace affected components or rebuild entirely. This could lead to false flags (as mentioned in the video) years after you've forgotten about it or even stopped playing the game entirely.

Flat point : Kernel would not have more success. We see plenty of cheaters still running rampant in games with Kernel anti cheat, its NOT the way forward, and with cheaters starting to make stronger cheats via algorithm learning, also wrongly called "ai", it will only become weaker. If I remember correctly, Valve is actually looking towards their own "ai" anticheat which I do feel has greater potential, knowing valve it wouldn't be as invasive as kernel and if tweaked right it'll probably be the new mainstay as it can actually detect what the player is doing and reacting to and see if it hints to cheating, also knowing valve it'll also probably not instantly ban them but rather flag them for review unless its absolutely blatant cheating, so we might still get some delays to bans. Some might then say what 3kliks says in the video : "wouldn't the cheats just become more and more subtle" TO WHICH I REPLY : Yes, and that's still a win. There's plenty of videos of people outsmarting and even defeating cheaters, usually blatant ones, and despite the impossible odds they win it out because most cheaters aren't good players, they're script kiddies that threw some bucks at a programmer to use their garbage for the game, whether to act like they're good or because they enjoy making others suffer. So I present this question to all who read this minor wall : What is worse? A Blatant cheater, wall hacking and aimbotting you, doesn't necessarily have to be a spinbot but if you spectate them you can definitely see them react to people moving through the walls, aiming towards heads before they're even supposed to know the person's there, locking onto it and never needing to aim for themselves and so on. OR A subtle cheater, forced to have the tiniest adjustments to their aim. Their cheats little more than a controller aim-assist, maybe they can still see through walls but they either have to keep a lock on their reactions for it or not have wallhacking to begin. AI Anticheat will potentially give us that subtle cheater more than the blatant cheater, because the blatant cheater would be detected and banned, the subtle cheater will be forced to downgrade their cheats, to be subtle, else they get banned. When the cheats do little more than the equivalent of tiny accuracy bonus, a controller aim assist, then cheats stop becoming the annoying threat they usually are, you could beat these cheaters and sometimes not even realize they were trying to cheat to begin with, that's a WIN in my book.

you should add that kernel cheat video to the description, someone else that hasn't watched it yet might want to

9:12 It's all about the droknar's runners bro through the pass.

I get that kernel level AC is not perfect and is still vulnerable to hardware cheats and whatnot, but brother getting hardware cheats is a big ass hurdle compared to downloading a random cheat software for some website, I feel that its a tired and not all that convincing argument against it. As it stands, anyone that is frustrated enough can just go online and download cheats and ruin the game, I've even seen ads for the on youtube, with developers showcasing their cheats, but getting hardware cheats requires more in depth investigation, they seem to be harder to find online, and I feel it's in general a step above software cheats in terms of commitment, at the very least some frustrated kid has to at least wait a few days before their cheating device arrives in the mail.

Anti-cheat that does more than scanning what you are trying to inject into the game is really creepy. I can understand habit tracking, but ring-0 is just a no go. I'm not having you brick my system for "my safety."

Philip showing off the droknar running skip in gw during tge explanation of cheating made my day

Thanks for giving me trust in Valve again. I believed they were unmotivated to do anything as they still make millions daily, but you're right about the long run.

I can never understand the argument of "oh but it doesn't detect every single possible cheat so it's not worth considering" like valorant doesn't have orders of magnitude less cheaters in ranked

@9:04 "VAC is still there to catch the casual cheaters who are using free and easily accessible cheats." Meanwhile, TF2's Casual Mode:

1:47 Yes pretty sure that's the reason, happened to me as well. I'm just not sure if it was Starforce or that other one that was almost as bad. Lost so many Windows 98 installs to 90's and early 2000's copy protection and back then I didn't even think of that being a possible cause for the problems. Sometimes it also caused other unrelated games to not find the CD drive anymore. But that was all in good fun if you compare it to the danger that could come from a vulnerability in a (in this case pretty much non-essential) kernel level driver in a modern OS. After all people tend to have a lot of sensitive data on their PCs nowadays. Back then computers were still a bit like glorified toys that might conquer the world one day, everything that was actually important was still analog in my country

There are different levels of Kernel access too btw

It simply does not work. Anti cheat gets updated or get more invasive -> Hack programmers take a few weeks to catch up and find workarounds -> hack situation gets worse again -> Ac gets updated again -> And so it goes on and on and on.... honestly I think going back to the old system of small communities self regulating their player base is probably the only good way of getting a good grip on the situation, be it with a lot of drawbacks (ie. human bias, delays as humans might take longer to audit things, etc.)

it has to do with corporate laws. Noone wants to get involved in some weird ass ACQUISITION. They can make a top tier anti cheat like face it but they wont because its pain in the ass to deal in terms of law and etc

I think I had a good idea; being able to opt in to different levels of anti cheat, entry being basically community servers and full anti cheat being like Kernal level

there is one function that VAC does that is quite useful for Valve at that no one talked about, it is an integral component of steam copy protection system that functions as a quasi DRM. Basically, if you circumvent steam in any way in order to illegally obtain your games, it is a lot harder to spoof VAC that the game you owned is "VAC-compliant", this means you cant play multiplayer/online on VAC protected servers and that locked you out of a major portion of servers you can join in multiplayer only games. This functionality of VAC is nothing new now, but back in the mid 2000s and 2010s where you had much more invasive DRMs doing the same thing, VAC had been doing it in a way that most people might not even realized it was doing.

if i can turn the anticheat on and off when and only when I want it, sure thing, Vanguard needing a restart is dumb.

Right now there is an AI in development which should be able to predict the behavior of clouds through analyzing patterns. Which is like the hardest thing to predict, ever. Now Valve, with their unlimited resources, wants to tell me they can't feed an AI with Rage-Hack-Demos to ban those players right away? They must have a hilarious amount of training data considering how long Overwatch was around.

Valve puts on a good demonstration of the effectiveness of certain approached to anticheat. Something as simple as having functional allchat and votekicking could be effective enough in of itself to stop most cheaters for a less mechanically inclined or popular game, but only on the condition that not enough people are cheating that its overrun with them (tf2, cs2). I can see a pros and cons list for each method forming, imagine how useful that information would be to an indie dev.

I was curious if you still did mapping? and if you'd ever do a tutorial like you did for the source 1 editor

VAC is currently on Ring 3? That's so sus.