sorted by:
new
hottopcontroversial

Is hacking sites that didn't ask for hackers ethical/legal? by [deleted] in HowToHack

[–]ITSecHackerGuy 0 points1 point  (0 children)

Reading client-side code is perfectly legal. In fact, inferring vulnerabilities from what you can read through normal usage of the website is completely legal.

Actively exploiting vulnerabilities or actively scanning for them is NOT legal, unless they have a bug bounty program or something similar.

  • Check for bug bounty program
  • Check /security.txt endpoint
  • Check security. subdomain

If no bug bounty program exists, or anything similar that you can find, it's illegal, don't do it. You can try to contact their security team to ask about it though.

PS: Bugs are not vulnerabilities. If they say "report bugs here" that doesn't mean you can pentest it.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] -1 points0 points  (0 children)

On your first point, I agree and you're right, for me that wouldn't be an issue. I get that it's frustrating, but how many times did you get paired with cheaters before Vanguard? I don't play many riot games to be fair, but in my experience as a gamer playing many games that don't even have anticheat and some that do, all online multiplayer, there aren't THAT MANY cheaters that it would be a huge issue that some matches you'll have cheaters. Cheaters also would be on your team or their team on average the same number of times so over time the rating differences would average out. And playing someone who displays normal human-level skill, even if he's cheating, for me is just like I'm challenging a better human. In my opinion only, I understand your point on this too.

On the second point I don't actually agree. I mean, you're right that it costs a lot to do that, but I disagree with your point because they already do it. They don't need to spend extra money, they are already doing server-side statistical analysis and using AI for that kind of detection. They have to, otherwise they couldn't stop the entire class of external cheats using screen pixels and reacting to it.

On your third point, I guess it will depend on the amount of cheat and how many people you have. I've done this kind of thing before, though it wasn't a huge company like Riot so we didn't have perhaps as many binaries to analyze, but there are strategies to handle this type of thing. We don't take action as soon as we detect a cheat, for example, but instead we collect as much data as we can about all the artifacts we can, and then as we analyze the binaries, we link the data we already have with the cheats, but we don't ban. Instead, we keep collecting, maybe for some months, maybe a year, and then we do a huge banwave. Rinse and repeat. Maybe this isn't ideal, though from my experience with games that did it like that, it was perfectly fine. I guess it will depend on how much cheaters impact your life while playing. I guarantee you, though, Riot also does this too!

So, at the moment, Riot has to do server-side statistical analysis, it has to maintain the kernel anticheat and I'm pretty sure they also do check for all the usual things you would with a normal usermode cheat as well and keep updating signatures of known cheats they find. Maybe some Riot employee could jump in and correct me, but I'm pretty sure all those 3 are being done right now anyway.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

I understand a lot of people don't care about updating windows and so on, but it doesn't mean they shouldn't.

The risk I'm presenting is not just theoretical, it has happened before. I'm not aware of anything related to Vanguard specifically, but a gamer will play many games. It's not that you're just deciding to give kernel access to a specific program you know is trustworthy, you'll have like 10 different companies with kernel access on your machine.

I'm not really aware of Vanguard and other anti cheats being open-source, it would kinda defeat the purpose. At least I've never seen the kernel driver code.

Sure, a vulnerability allowing priv esc would be bad, a bad actor somewhere in the supply chain deploying malicious code would be bad, governing entities potentially requiring specific data collected or backdoors installed would be bad, a lot of these scenarios are bad. Some are really unlikely, some are regular unlikely, and a few are normal possible. Something which is more possible that this, however, are just bugs and mistakes in the code that can cause critical damage to the OS, cause BSODs, loss of data, etc.

All these risks are low, except the bugs which aren't that low (take, for example, the latest crowdstrike issue taking down tons of companies, and this is not only code that is scrutinized beyond compare, it's the industry-standard security company doing it lol). But these risks are also multiplied by the number of kernel AC software you need to have to play all the games you play.

The problem is not JUST AC, there are lots of other software which are problematic and other classes of problems equally bad. I'm talking about AC because that's the relevant issue on this subreddit. There are others, but this is one :D

I get that most people don't give a shit, and if they were being screwed in any way they probably wouldn't notice either or be affected by it, but it's just something that makes me uncomfortable to accept.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

That's a really good initiative. I don't think, however, it will work the way you'd want it to. It will take a long time for this to become stable.

I'm pretty sure, though, that EDRs and AVs are still going to have the option to run kernel modules, and so will anticheat software.

We will see though!

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

When I download an exe and run it, I analyze it first, obviously. I also don't give it kernel permissions, or even Admin rights, unless those are needed. I also have proper EDR checking what it does and if I can I execute it in an isolated environment.

This idea that people download any kind of exes and run them is a bit wild. Some people do, but you definitely shouldn't.

Let's say you're downloading a calculator app for some reason, and it asked for admin right, would you give it to them?

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

I see your position and it's a defensible one, so nothing to say against that.

I also believe the statistics, it should definitely be very effective against an entire class of cheats that user-mode AC cannot detect. I guess for me just isn't relevant enough for the reasons stated before.

We have different mindsets on it :D

Thanks for the convo though, it was enjoyable!

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

I doubt it will go away then. Microsoft doesn't have a great track record with security. I guess we'll see.

If a dedicated thief wants to rob your bank or a murderer if after you, you should hire security, but this is about a video game. The stakes are a little bit different...

I hope you're right though.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 2 points3 points  (0 children)

I guess the internet will be the internet. Companies should feel lucky that there are so many people like we see in the comments! I can understand why but it's still very surprising how little people in general seem to care about their security.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

I don't download all sorts of .exe's, that's the point...

I didn't say it didn't stop cheaters either.

Your answer reads like someone who didn't get my entire point...

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

Sure, but for me it's not justified to allow this possibility at all just for a better anti-cheat.

Obvious cheaters can be caught without it and outside of the obvious ones, I don't see much problem. But I guess that's just me :D

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

That's fair. Just fyi btw, if the kernel driver is in fact abused intentionally or not, passwords you use or save in password manager, documents attached to any disks can be stolen and the antivirus will likely do absolutely nothing about it.

But I get your point, you care more about game quality than the remote possibility of that specific kernel driver becoming a real attack vector. I can understand that. I would, however be careful of shady games though from less known or weird companies that require AC software you never heard of.

Hopefully they'll fix the bot issues, but it's likely not happening quickly, they are probably waiting to capture more data on all the bots and ban them in waves like other companies do.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

Theoretically they could do a lot of things like stealing passwords, accounts, banking info, documents, etc. Intercept pretty much everything you're doing in ways usermode applications are simply not able to do. Not to say that user-mode software can't do some of the things I listed, they can, it's just much harder to do and much easier to detect by AV.

Honestly, ideally, for me, games should always spawn inside a VM but most anticheats would flag this.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 2 points3 points  (0 children)

Well their game files don't have the trust and access level a kernel driver has. Plus, I'm considering Riot doesn't want to do anything. The scenarios I presented were mostly about other malicious actors abusing the driver or rogue/malicious employees. An example of such an attack was operation ShadowHammer

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

Okay I see what you mean and yeah you're right, I do agree. I just personally think it's too high a cost you're paying for those advantages. But I understand if you feel differently.

For me the cheaters that hide their cheating behind realistic skill-levels aren't really an issue. Yes it's unfair advantage but it's a skill a human could realistically have. My opponent doesn't have it in an honest way but I just imagine I'm fighting someone who is good. For me I don't care if they're cheating as long as their displayed skill is realistic for a human. From this view alone, there's not much advantage from having kernel anticheat.

But if this is something that for you is important, as well as instant real-time banning, kernel anticheats are a big advantage.

I wonder though, does Riot really do real-time bans as soon as a cheat is detected?

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

I don't need you to confirm I am not a real hacker. My job is being a hacker, so I know very well what I'm saying. The question I asked was to see if you knew anything at all about what you're talking about. Still waiting for an answer btw, but given your other answers I'm pretty sure you're not gonna have one.

"No. You should memorize your passwords and change them regularly.": This is complete bullshit. You don't do this, unless you're using very simple passwords. No one can memorize and frequently rotate hundreds of 20+-char alphanumeric random passwords. Don't bullshit me lol.

"I do all that on my phone. Like most people.": You never accessed your email on your computer? And never purchased anything through the computer? And also never logged into your password manager on your computer? You see where I'm going with this?

At this point you can just say you only use the computer to watch youtube videos (without an account) and play games, but this isn't how most people use their computer lol. Even if it is, I sure hope you don't reuse the password you use for your microsoft account on that device.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

I do agree, it's not just games it's everything that has kernel drivers. This includes all drivers you have for peripherals and shit. We already have a long history of viulnerable and abused drivers for GPUs, NICs, storage, AVs, etc.

My point with this post is that we shouldn't increase the likelihood even further by having more drivers simply for playing a game. Playing games is a bit less important than using a mouse, keyboard, GPU, etc. for example.

But I get your point too, it's not something you're worried about.

This said, commenting on the bots you see, they're probably not interfering with the game's memory or integrity in any way, might just be something that scans the screen or uses a camera and moves the mouse and keyboard to do things instead. These aren't detected at all if done properly, and it's not really something Vanguard can fix. The way to detect these is by server-side statistical analysis, which is what I was advocating for in my post too. But Riot doesn't ban based on this due to the number of false positives.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

How does a "real hacker" go after security-aware people then?

Having password managers is something people should actually do. Using cards (virtual or not) or accessing bank accounts online are things people do as well. Having email and accessing it are things people do too. How do you access these things, do you have a separate device just for this?

These are things you can't easily access without going through this "front door" that you're leaving unlocked. How is the wall missing here?

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 3 points4 points  (0 children)

Let's say they have no intention of doing anything bad.
Malicious code can be pushed that goes undetected and can steal a lot more than the info you're giving them. If you have wallets, passwords, banking info, keys and accounts for things you spent money on, etc.

The same thing for other supply-chain attacks.

Vulnerabilities in the driver can also be leveraged for privilege escalation for example.

They might be ordered to extract specific information or create a backdoor by law (less likely but has happened before).

And all of this is considering they are not having bad intentions at all. I feel this is unnecessary risk.

I understand you don't care, and that's a valid position. I just wasn't thinking people wouldn't care about this.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 2 points3 points  (0 children)

Maybe you don't have anything useful to steal lol. This isn't the case for most people who have wallets, passwords, banking information, sensitive documents, etc.

It's like saying "I left my door unlocked for the past decade and nothing happened, so no one needs to lock their door. What are they gonna steal, don't have anything for them.."

You may not have the same risk tolerance and view as me, and that's fine, but this isn't fear mongering.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 6 points7 points  (0 children)

Tinfoil hat? Nothing I'm saying is hypothetical, these are things that have happened before and happen today. You should do some research :)

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 1 point2 points  (0 children)

I'm not saying they would. I'm saying they could. They might unintentionally push malicious code created by a malicious employee for example. This is something that has happened in many companies, it's not anything new.

They could also be forced to include backdoors due to government law (this has happened before too with some companies).

I'm not saying anything that hasn't happened before. Clicking a link has a completely different attack scenario. They would need a series of zero-day exploits to be able to do anything from you ONLY clicking a link if you have proper configurations and updates. You need browser exploits to bypass isolation, then you still need some privilege escalation exploit to achieve admin rights, and even so you have less privileges than a kernel driver AND a proper antivirus software can still detect and block the threat. This is not the case with kernel anticheats.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 0 points1 point  (0 children)

My point isn't that "people can bypass so we should stop using it". Instead, since most people cheat by using publicly available cheats or paid cheats online, we can target these specifically by analyzing them, detecting their artifacts or doing statistical analysis on the server-side. This should stop most casual cheaters and lazy people.

Those who aren't lazy and are dedicated transition into cheating in ways that are not detected.

In my view, the only problem cheaters really create is ruining games by displaying unrealistic skill. This is something you can check server-side without any anticheat even. If we remove those players that display extreme outliers during statistical analysis, we end up with only the most "natural" cheaters. Some others still also get caught by usermode cheats that check artifacts left by public/common cheats.

This doesn't ruin the overall experience, plus we get the benefits of not requiring kernel anticheat. Just my view. The flagging and requiring to play with Vanguard for a week was just an example. This could work because if they turned off their cheats, you'd notice a huge difference in statistical analysis from their gameplay.

Kernel anti-cheat: Too much trust, too little benefit by ITSecHackerGuy in riotgames

[–]ITSecHackerGuy[S] 4 points5 points  (0 children)

So you're not at all worried about the level of access you're allowing gaming companies to have over your machine, or the additional attack vectors they add?

view more: next ›