Summary of “Anti Cheat at Embark Studios” prensentation by Embark Studios Senior Software Engineer Tom van Dijck, at devcom in Germany on August 24.
… Linux presents an even worse situation. Because users can custom-build the OS kernel, embedding a cheat directly into the kernel and compiling it makes it nearly impossible for a game to detect its existence. “How do you detect that?” van Dijck asked, adding that while support for SteamOS and Proton will remain, platform requirements will become stricter.
Though he mentions anti-cheat on Linux being more challenging to implement that on Windows, he doesn’t seem to think that it’s impossible. He goes on to talk about “undetectable” cheating hardware becoming cheaper, which sounds like a bigger problem, but he sounds optimistic about being able to detect those as well.
IMO “platform requirements will become stricter” could mean something like only allowing signed kernels with anti-cheat module built in + secure boot.
No one has mentioned the thing they’re doing right here:
This led to a shift in hiring strategy. “We had focused almost entirely on software engineering, but we had no one who actually understood this data,” he recalled. “We completely pivoted our hiring toward data scientists, and today we spend far more effort analyzing data than reverse-engineering programs.”
A huge part of the argument from us Linux users has been: These companies say a bunch of stuff, but from the words it seems pretty clear that the maths is off. It would be nice if they actually shared some of the maths, but actually having someone who studied statistics on the payroll is at least some measure of trust.
Having said that, the inflated sense of importance of these companies thinking they deserve root is pretty astonishing:
Kernel-level anti-cheat operates at the innermost layer of the operating system, allowing it to inspect the entire PC. While this offers a broad detection scope, it presents significant privacy and security concerns for users. Introducing this topic as a “controversial slide,” van Dijck acknowledged, “It is invasive, and we agree.”
However, he argued that it is an unavoidable necessity at present: “Cheat software is already doing the exact same thing, reaching the point where cheaters boot via USB drives to hijack the system before the kernel even loads.” He also noted that while Microsoft is enhancing platform security, those measures do not apply to older Windows versions used by many players.
OK, but people who aren’t cheating aren’t doing that. They have banking information on their computers. The kernel code could be exfiltrating that in the normal telemetry (which makes servers a target), or be hacking your invasive kernel module (which is a honeypot). The fact that they’re not even considering that some other game’s anti-cheat could be used as a vector for cheats is, like I said, astonishing.
The cherry on top is the admission that this highly risky kernel module is vibe coded.
He also noted that AI coding assistants influenced their approach. “Thanks to tools like Claude and Codex, solutions that used to take years can now be built in a short time,” van Dijck explained. “The barrier to building custom solutions in-house has dropped significantly.”
Just use the data scientists bro.
Is any anticheat as effective as a community server with active moderators to ban cheaters?
Shhht not so loud you’re scaring away the AI investors.
No.
But that doesn’t give them as much control so they don’t want to do it
While I agree with you (and upvoted to match), I also acknowledge that not every game is suited for that kind of server structure. Competitive ranked games, that rely on a fair matchmaking algorithm and consistent server performance, simply can’t just route matchmaking players to a random community-hosted server. And communities can’t really form that way, either.
Or to make it short, esports can’t do this while maintaining their esport status. And those are the games that need anti-cheat the most.
Me personally? I don’t even like those kinds of games. I barely play multiplayer games at all, and when I do it’s because I’m playing with friends, and couldn’t care less about my rank (if I even get one). So for my kinds of games/scenarios, community or self-hosted servers are the obvious choice with zero drawbacks. But I can still acknowledge that it’s not a solution for all cases.
Lo and behold, most multiplayer games do run on Linux!
Didn’t we have competive games before matchmaking existed? People used forums… (and met up in person, or something). Don’t route matchmaking to us then but know that we ought to have the option to host it ourselves anyway.
Correct me if I’m wrong, but those games didn’t track official player rankings. Which is perfectly fine, and doesn’t make a game any less competitive, but official rankings is a legitimate feature that some people gravitate towards.
To be extra clear: I’m mostly with you, I think every multiplayer game should at least offer the option of self-hosted servers, and I backed Stop Killing Games to force them to do so (after official servers shut down).
Though to be honest… My opinion on this topic isn’t worth much. As I said, I don’t play any competitive games. So it’s very likely I’m missing some important info in my perspective.
Sure, but that was before people started making a lot of money on esports and they don’t want to give that back.
Yeah. How would you tell if someone is cheating or just really good at aiming?
It’s definitely not infallible but neither is anticheat software. How do you tell if someone is using a DMA cheat? Even kernel level anticheat can’t detect that.
Linux presents an even worse situation. Because users can custom-build the OS kernel, embedding a cheat directly into the kernel and compiling it makes it nearly impossible for a game to detect its existence. “How do you detect that?”
Server-side control and you won’t need to? Or am I missing something here?
Cheats today aren’t like the TF2 cheats some people imagine. The way modern cheats are described is “cannot distinguish from high level play”. To use a hardware cheat as an example, you have a mouse and capture card, and connect that to a raspberry pi, put some software on the pi, then make the pi imitate a USB mouse. Then, whenever aiming near a target, have the pi “lock on” to that target (the pi uses object detection to find targets). You can also make it more or less accurate to make it less detectable. In this example, it’s literally a mouse moving around. Doing something like confirming aim on the server side doesn’t help here.
To explain a (hardware) wallhack, you can plug in a USB-C device into the PC. Now USB-C devices can also use thunderbolt, which is just PCIe, which means it has DMA access to the PC’s RAM, no OS required (the OS needs to permit the device but after “trusting” the device, the device can do whatever it wants). So, you do a similar trick. Capture card + DMA access to the PC RAM. The Pi finds the place where the game tracks objects, finds targets, and places a box around them (so you see the game from the capture card with the box over all targets, including behind walls). Now you might be saying “well the server shouldn’t send targets behind walls”, but even if the server doesn’t do that, it needs to send them a little bit before they’d be visible, and that’s enough of an edge.
Kernel hacks are basically the same thing, but without the expense. You can see a target a fraction of a second before they’re visible, and the mouse can be told to move to the target. This is the same as high level play because people can often predict where someone is going to be, and are very, very good with tracking targets, so it just looks like a good player.
I’d imagine server-side detection wouldn’t work that well for things like ESP or non-obvious auto-aims, which are already a good chunk of FPS cheats.
The hypixel minecraft server, which by being a minecraft server cant have client side anticheat, shows fake players to make aim botters attack them. They are transparent so you can notice them as a non cheater.
Introducing proper matchmaking, which isn’t rigged to encourage dark patterns.
Non-obvious cheaters will end up playing against others like them or actually good players, in which case they either become obvious cheaters or stop being a problem.
Wardogs only has a server browser so that wouldn’t work for them. It’s also 100 players per game so even if they did introduce skill based matchmaking good luck with figuring out how to balance the teams in a way that actually works
True, only works if they hold the servers. And the pick your poison scramble does make it difficult to consider one’s options.
I’d have the semblance of a thought on an idea, but it’s kinda unfair to players. It would mean to mark those with high stats (pinpoint hits, low to no misses) and make them “stars”, as in bring the visibility on their hits and let the players decide.
But yeah, it’s a pain.
That’s not what cheaters do. They often buy smurf accounts or earn money to boost other people’s accounts to high ranks.
They can also just turn on the cheat when they start losing, you can’t detect server-side wether someone got a lucky shot or if they had aimbot on that masks it as a mouse.
Idk, it seems unfair that a good players have to deal with cheaters. It’s not like having cheats makes you similar to better players. Ambush is infeasible against people with ESP.
Good players smurf on lowbies all the time. That’s unfair, but you don’t see them complaining about it.
I’d think reminding them what it’s like on the receiving end, while unfair to them, kinda evens it out a bit.
But that’s just me being petty.That’s unfair, but you don’t see them complaining about it.
Smurfing is a widely known issue and pretty much every competitive game tries to ban people they know are smurfing or boosting multiple accounts.
No, I mean the smurfers.
Why would a server not be able to do the calculations a client does for rendering only the visible players? I know the answer and it’s money.
Uhh, no… It’s because that’s not how anything works. There’s so many flaws in your argument, but here’s just one: if an enemy player is really well camouflaged but technically visible, then they would be rendered on the client side, but a human player would have to be very observant to spot them and kill them.
A cheater can replace the enemy character’s texture so that, on their screen, the enemy’s camouflage is useless and the player can spot them with no effort.
From everything the server can see, the cheater’s gameplay is legit. They could just be really good at spotting enemy camouflage. Only by looking at the client side render output, you can spot the cheat.
Unless the server is actually rendering the game for each player (which, spoiler alert, isn’t the case), most cheats are not detectable nor preventable on the server side.
You cherry pick the argument of camouflage. But in many FPS games that isn’t much of a thing.
Here’s an anti wallhack plugin for CS2: https://github.com/HLND2T/CS2FOW
You can clearly see how useful it is against wallhackers. But, as I said, it requires to do some sort of clientside rendering on the server, which costs CPU resources, and thus money.
You got it all figured mate 🤯🥳
ok hear me out: If a user is going to build and compile their own kernel to simply put in a couple cheats for a specific game then…hey let them cheat. I HIGHLY doubt your average cheater is going to go through all that to cheat in like arc raiders or something.
I just don’t see hundreds or even thousands of players doing this. Not enough anyways to ruin the online experience for others.
And they definitely would never sell those custom kernels to less motivated cheaters.
Glad I refunded wardogs after they disabled Linux from working.
I said it when Wardogs killed Linux support and I’ll say it again. This is just Microsoft paying these people to shit on Linux to keep a stranglehold on the PC market. They did the same thing when they release direct x. At the end of the day, it’s a monopoly. To my knowledge, you can’t even play these games on Mac OS. So your only choice is Windows.
This is just a blatantly wrong conspiracy, it’s just that companies don’t think there are enough players on Linux to justify working on and maintaining a Linux version of the anticheat. It’s not that deep.
But they are working on a Linux version of the anticheat, it’s just prioritized lower than getting the game running smoothly for Windows users. I wouldn’t give them any money before I see it with my own eyes, but the devs said they were hoping for Linux/Proton support “ASAP after launch” (presumably the EA launch on the 10th)
Who the fuck is so desperate to cheat that they’re building custom kernels!? Like, that just seems beyond far fetched to me.
It’s trivial, and many hacks for windows required loading unsigned drivers (functionally equivalent to kernel modding)
However, it’s a bit of a red herring. People also do bootloader and virtualization hacks, some also mod the bios or do spychip hacking (often called negative rings, effectively privilege rings lower than zero, but that aren’t actually modelled as privilege levels within the cpu)
However however, that’s also a bit moot, because DMA hacking exists. You don’t even need to load the hack into the target computer; you could read and write system memory directly from another device entirely.
Plus there are other non-invasive cheats, like fake hardware mice with vision-based aimbot.
This is all just a smokescreen and security theater. Partly trying to ‘raise the bar’ to stop cheap/low effort cheating, but also just as an excuse. This is for corporate and shareholders, not developers.
The only real solution to cheating is heuristic analysis, peer detection and attestation, and letting players block interactions with people they think are cheating
Client-side anticheat only exists to spy on you and make marketing departments feel nice.
Guess I underestimated the lengths people will go to to cheat!
Depending on your technical inclination, a custom kernel isn’t some arduous task. According to Gemini it takes six steps, not saying those are simple, but definitely doable for anyone who is motivated.
For some people, the anticheat becomes the game.
I feel like I’ve heard stories about famous DRM crackers that don’t even play the games - the DRM battle is the whole point. And for some people, it’s not about cheating, it’s about beating the anti-cheat. It just sucks that when you beat the anti-cheat you have the side effect of ruining the experience for other players.
And also, some people are just REALLLLY pathetic and have to cheat at games to feel adequate.
I make cheats (for single player games, usually in the form of mods or cheat engine tables)
I just clocked 60 hours in Pathfinder Kingmaker on steam. I’ve literally never left the starting room. I haven’t even walked more than 10 feet in any one direction.
It do be like that some times…
Reminds me of when I’d mod Skyrim for three weeks, play for two hours to make sure everything works, and then just never launch it again for some reason… I don’t know what flavor of autism I have, but it is tasty.
Partnered with VAIIYA Corporate
Lmaoooo it begins
spoiler
I suppose Embark predicted the “We don’t do ___, we ___” writing quirk of AI? Probably coincidence, but kinda cool
The Oracle™ Engine transcends mere prediction. It is a reality-modeling tool that analyzes quantum probability streams to compute and enforce a singular, optimal future timeline.
NGL I’m pretty sure they got an AI to write it and also told the AI it’s the Bene Gesserit.
Wow not only is that the slowest loading website I’ve been on in a while but it also spews near constant word salad
Vaiiya is a fictional company, from the lore of Embark’s The Finals shooter
Because they are doing so well at stopping cheaters on Arc Raiders right now. Couple that with how they walked back the content releases and then did a partnership with Subway to try and sell their customers sandwiches, Embark can get fucked.
Well, that’s the reason they decided to make their own anti-cheat, isn’t it? They also thought that their current combination of EAC+Denuvo+Anybrain doesn’t work… Stupid partnerships and ads suck though
