Just as another thing to add to your notes, in ordinary circumstances, it’s practically impossible for non-government actors to get rootkits on modern machines with the latest security patches (EDIT: I’m talking remotely. Physical access is a whole other thing). To work your way up from ring 3 (untrusted programs) all the way to ring 0 (kernel), you’d need to chain together multiple zero day vulnerabilities which take incredibly talented cybersec researchers years to discover, keep hidden and then exploit. And all that is basically one-use, because those vulnerabilities will be patched afterwards.
This is why anti-cheat rootkits are so dangerous. If you can exploit the anti-cheat software, you can skip all that incredibly difficult work and go straight to ring 0.
EDIT: Oh, and as an added note, generally speaking if you have physical access to the machine, you own the machine. There is no defence possible against somebody physically being able to plug a USB stick in and boot from whatever OS they want and bypass any defences they want.
Cheers to the note as to why the anti-cheat is basically satan in software form. This is the real reason that riot isn’t open to community discussion on this topic. It’s indefensible… and if the userbase understood more they wouldn’t have any users left.
It’s the same reason stuff like antivirus is a huge vector for attack. It runs at elevated permissions generally and scans untrusted inputs by default. So it makes for a great target to pivot into a system. These anti cheat kernel modules are no different in their attack profile. And if anything them being there is a good reason to target them you have a user that has a higher end gpu so the hardware is a known quantity to be targeted.
Glad to hear it!
Just as another thing to add to your notes, in ordinary circumstances, it’s practically impossible for non-government actors to get rootkits on modern machines with the latest security patches (EDIT: I’m talking remotely. Physical access is a whole other thing). To work your way up from ring 3 (untrusted programs) all the way to ring 0 (kernel), you’d need to chain together multiple zero day vulnerabilities which take incredibly talented cybersec researchers years to discover, keep hidden and then exploit. And all that is basically one-use, because those vulnerabilities will be patched afterwards.
This is why anti-cheat rootkits are so dangerous. If you can exploit the anti-cheat software, you can skip all that incredibly difficult work and go straight to ring 0.
EDIT: Oh, and as an added note, generally speaking if you have physical access to the machine, you own the machine. There is no defence possible against somebody physically being able to plug a USB stick in and boot from whatever OS they want and bypass any defences they want.
Cheers to the note as to why the anti-cheat is basically satan in software form. This is the real reason that riot isn’t open to community discussion on this topic. It’s indefensible… and if the userbase understood more they wouldn’t have any users left.
It’s the same reason stuff like antivirus is a huge vector for attack. It runs at elevated permissions generally and scans untrusted inputs by default. So it makes for a great target to pivot into a system. These anti cheat kernel modules are no different in their attack profile. And if anything them being there is a good reason to target them you have a user that has a higher end gpu so the hardware is a known quantity to be targeted.
Hell yes I’m adding this to my notes as well, thank you!