Anti cheats on linux

[xilliam]

With the recent introduction of BattlEye (I think thats how its written) on GTA Online, and the popularity of the Steam Deck running linux by default, theres now more eyes than ever on the ever evolving issue of anti cheats on linux. And speaking of the Steam Deck (along with the recent controversial changes in Windows that has pushed people to change operating systems), I’m suprised there isn’t more pressure to make anti cheats work on linux. And will we even ever see a future where they will

[vanpuffelen]

Anti-cheats, including BattlEye, outright support Linux. Companies, including Rockstar, don't check that box when they added BattlEye to GTA Online. Also, the YouTuber SomeOrdinaryGamers managed to bypass the anti-cheat by using a VM, but also managed to use some kind of kernel patching trick from a GitHub repo to enable GTA Online on Linux. 

 

Personally, I'm more concerned about the fact the anti-cheat is kernel-level than that Rockstar practically pulled the plug on Linux support.

[Mark Kaine]

1 minute ago, vanpuffelen said:

Anti-cheats, including BattlEye, outright support Linux. Companies, including Rockstar, don't check that box when they added BattlEye to GTA Online. Also, the YouTuber SomeOrdinaryGamers managed to bypass the anti-cheat by using a VM, but also managed to use some kind of kernel patching trick from a GitHub repo to enable GTA Online on Linux. 

 

Personally, I'm more concerned about the fact the anti-cheat is kernel-level than that Rockstar practically pulled the plug on Linux support.

yeah, if linux supports kernel level anti-cheat,  is it really better than windows?  i thought security is BIG by the fuck Nvidia guys over there?  guess not. 

[vanpuffelen]

Just now, Mark Kaine said:

yeah, if linux supports kernel level anti-cheat,  is it really better than windows?  i thought security is BIG by the fuck Nvidia guys over there?  guess not. 

Security is important for some of us "fuck Nvidia" guys (cries in GTX 1060-6GB), but we just... don't install the kernel-level anti-cheat. I personally don't play many online games, so I don't really suffer from it. 

[Mark Kaine]

8 minutes ago, vanpuffelen said:

Security is important for some of us "fuck Nvidia" guys (cries in GTX 1060-6GB), but we just... don't install the kernel-level anti-cheat. I personally don't play many online games, so I don't really suffer from it. 

but seriously... does linux inform you "this program is about to drastically change your kernel" or something,  cause on windows there's no such thing, so people potentially don't even know what they're installing... most you get is "allow this program to change system settings?" which is basically almost every game, so of course people click "yes", they wanna "play the game"! 

[FI Fheonix]

1 hour ago, Mark Kaine said:

but seriously... does linux inform you "this program is about to drastically change your kernel" or something,  cause on windows there's no such thing, so people potentially don't even know what they're installing... most you get is "allow this program to change system settings?" which is basically almost every game, so of course people click "yes", they wanna "play the game"! 

Thats the thing with Linux, it at least warns you before you make changes to the kernal of your OS. Silly microsoft.

[Kilrah]

1 hour ago, xilliam said:

And will we even ever see a future where they will

Whenever game publishers decide that "people buying the game to play on linux platforms" significantly outweighs the cost of developing an anti-cheat to work on said linux platforms, which is likely really high if they make it a kernel module and thus would need explicit work done for every distro and kernel release. And yeah if it happens it'll be as invasive or more than on Windows because that's the whole point of it. 

 

There might be support for SteamOS only if publishers decide the majority of linux players are on the steam deck and the rest isn't worth the effort, i.e. console-like.

[Alex Atkin UK]

17 minutes ago, Kilrah said:

There might be support for SteamOS only if publishers decide the majority of linux players are on the steam deck and the rest isn't worth the effort, i.e. console-like.

Its also slightly less worrying on SteamOS, as its primarily for gaming so the odds of someone getting their bank details stolen via a rootkit is dramatically lower.  Even so, it feels like using kernel level anti cheat is a bad solution, as if the cheat is also running at kernel level then you've really not achieved anything.

 

I can't see how they will ever solve this problem without running the game on a box where the end user has no control whatsoever, like consoles.  Or move the game to a streaming-only setup so that no game code runs on the client, which is the worst solution for competitive gaming where you want minimal latency and a crystal clear image.

 

I've often wondered if they could just sandbox the game, but I suspect the problem is then they can't know if someone is hacking the sandbox from the hypervisor.

 

I lost interest in online gaming years ago because I would always get my ass handed to me and I was never sure if I was just terrible, or people were cheating.

[thevictor390]

6 minutes ago, Alex Atkin UK said:

I can't see how they will ever solve this problem without running the game on a box where the end user has no control whatsoever, like consoles.  Or move the game to a streaming-only setup so that no game code runs on the client, which is the worst solution for competitive gaming where you want minimal latency and a crystal clear image.

I don't think it will ever be solved at the prevention step. But the detection in GTA V has been so nonexistent that it seemed malicious. You're telling me someone can warp all of the players in the lobby into a cage and no server side process thinks something unusual might be going on here? Well I guess that's the issue, there barely is any server, it's all peer to peer... still how can there not be some basic player protections in place to prevent another client from doing clearly impossible things to you.

 

As for Linux, it's a simple math question for Rockstar. Is the 2% or so of Linux gamers worth the time and resources they would spend supporting the platform. They seem to have decided no.

[Kilrah]

15 minutes ago, Alex Atkin UK said:

Even so, it feels like using kernel level anti cheat is a bad solution, as if the cheat is also running at kernel level then you've really not achieved anything.

You have, while the cheat has access to everything the anti-cheat does too and can thus detect anything unusual.

[Mark Kaine]

34 minutes ago, Alex Atkin UK said:

Its also slightly less worrying on SteamOS, as its primarily for gaming so the odds of someone getting their bank details stolen via a rootkit is dramatically lower.  Even so, it feels like using kernel level anti cheat is a bad solution, as if the cheat is also running at kernel level then you've really not achieved anything.

 

I can't see how they will ever solve this problem without running the game on a box where the end user has no control whatsoever, like consoles.  Or move the game to a streaming-only setup so that no game code runs on the client, which is the worst solution for competitive gaming where you want minimal latency and a crystal clear image.

 

I've often wondered if they could just sandbox the game, but I suspect the problem is then they can't know if someone is hacking the sandbox from the hypervisor.

 

I lost interest in online gaming years ago because I would always get my ass handed to me and I was never sure if I was just terrible, or people were cheating.

yeah i don't have any kernel level anti-cheat installed on my system (afaik! ) but i know for sure most of these games can still be cheated, its just more difficult,  and on the other hand you can make anti-cheats that are better at preventing cheating *without* kernel access... so it's kinda sus when devs use these methods to begin with... its mostly gatcha games (and i mean the vast majority) and i generally don't play those,  i like unlocking stuff in games, but *not* with gatcha its just such an unrewarding mechanic.

[xilliam]

47 minutes ago, Kilrah said:

There might be support for SteamOS only if publishers decide the majority of linux players are on the steam deck and the rest isn't worth the effort, i.e. console-like.

I think even just this would be a step in the right direction. Even if only one distro could get the anti cheat support on the majority of the games that need it, we would have a realistic competitor to gaming on Windows. 
 

Right now I think many stray away from using linux for gaming because of bad anti cheat support. With Proton Windows only titles run perfectly (atleast for me) and seeing how much time and effort Valve has put into it, I would be more than happy for SteamOS to be the distro for this

 

Seeing how much gaming on linux has improved over the last few years, I completely think that this could be a likely scenario, especially if Valve keeps supporting their third party linux support

[adm0n]

There recently was also an announcement from microsoft, that they want to move things out of the kernel again. They were mainly interested in it, because of the crowdstrike incident.

 

But one way this could be done and still offer games "kernel level" access, would be for microsoft to implement their own anti cheat solution, that lives in the kernel, which the games user level anti cheat can access via an API. That way, you won't have to allow random programs into your kernel anymore and I'd assume the API would mainly revolve about whether the system is in an secure state right now. So not much malicious that could be done with it.

 

This would of course also allow translation layers, like WINE to implement this more easily.

[Thomas A. Fine]

There's a lot of people saying that this new Microsoft move will bring anti-cheat to Linux.  I think this springs from a misunderstanding, and I think that 'a lot of people" are 100% wrong.  Or at least 80%.

 

Microsoft is talking about locking down the kernel - making it so that user applications can not load kernel modules.  And they'll put all the features people have been doing with kernel modules into the core of their kernel, into what people are calling an API (but what I would say are system calls, because an API is not the layer of calls provided by kernel; call me Mr. Pedantic).

 

So Linux can just do the same thing, right?  Wrong.  Or at best, maybe?  But probably still wrong.

 

Microsoft can lock down the kernel.  Linux can't.  Linux is open source.  Anybody can change the kernel, whether they're using kernel modules or have disallowed them.  This is why anti-cheat hates Linux.  The kernel can be anything.  If Linux does what MS does in terms of having a locked kernel mode and an "API" (ugh) for anti-cheat system calls, why would anyone trust it.  With Microsoft, they trust it because it's closed source, and MS can add some protections to detect after-the-fact kernel fuckery.  With Linux, whatever is implemented is open source.  The potential for rafter-the-fact fuckery is infinite, and not hard to implement.

 

To be fair, no matter what Windows does, there is still room for fuckery on that side too.  But the bar of entry is MUCH higher than just reading open source code and figuring out a workaround.

 

There's room, perhaps, to have some blessed locked Linux kernels.  There are things you could try to do to make it difficult to use an altered kernel undetected.  None foolproof.

 

None of this means better anti-cheat won't come to Linux.  But it  means that this step by Microsoft is not nearly as significant as people are saying.