Valorant's anti-cheat software 'Vanguard' loads kernel-based driver on system boot

guest · Apr 17, 2020

Valorant's anti-cheat software loads kernel-based driver on system boot
Riot Games says it's the only way to detect cheat software that uses Ring 0
April 15, 2020
https://www.techspot.com/news/84841-valorant-anti-cheat-software-loads-kernel-based-driver.html

Riot Games' new team shooter Valorant has an anti-cheat system called "Vanguard" that has raised some security concerns. When the game launches, the Vanguard client loads with it into the userspace. However, there is a kernel-mode driver for the system that loads when you boot into Windows.

Riot claims that it needs this since some cheating software uses kernel-mode drivers to evade detection. Regular applications cannot detect kernel-mode drivers because of the higher privileges required.
Back in February, Riot explained the new anti-cheat software, initially designed for use in League of Legends, and why it was needed.
Click to expand...

Running a driver in kernel-mode raises concerns that Riot is only improving its cheat detection at the cost of increasing the attack surface of Windows, and at the root level no less

"Whenever you have a driver like that, you're at risk of introducing security and reliability issues to the computer," independent security researcher Saleem Rashid told Ars Technica.
Before freaking out too much about Riot's decision to use a kernel-based driver for cheat detection, bear in mind it is not the only developer to use this technique. Battleye, a popular third-party anti-cheat solution, describes itself as a "kernel-based protection system."
Click to expand...

Ars Technica: Ring 0 of fire: Does Riot Games’ new anti-cheat measure go too far?

With Vanguard, Riot would like to patch up this hole with a kernel-level driver that can hopefully detect any and all abnormalities running at the user level. That doesn't make the game impervious to other kernel-level attacks, of course, but it "requires a different (more strenuous) approach from cheat developers to attack," Riot anti-cheat lead Paul Chamberlain told Ars in an email.

Still, granting such high-level OS access to a game maker can make some users nervous [...]
“A large attack surface for little benefit”
That's all fine—if you're going to install any Riot application on your device, at some level, you have to trust it isn't stealing grandma's casserole recipe (or that it would be found out if it did). The real risk of installing a kernel-level driver, though, is the level of security exposure it creates on the rest of the system.
Click to expand...

guest · Apr 18, 2020

Riot responds to concerns about 'Valorant's' new anti-cheat driver
April 17, 2020
https://www.engadget.com/riot-valorant-anticheat-driver-013854500.html

Over the past few days, some Valorant players have raised concerns about the fact that the game’s anti-cheat driver (vgk.sys) runs as soon as you turn on your computer. Now, Riot Games, the new first-person shooter’s developer, has published a post explaining why its anti-cheat system works that way along with an assurance that it doesn’t collect any personal information.

Riot’s anti-cheat technology loads at start-up to counter advanced cheats that run before you even fire up the game. You can uninstall the vgk.sys driver anytime, but the game won’t run without it — Riot’s client won’t recognize your PC as a trusted machine if you do.
The company says it only collects data for the operation of the game, though.

“We can’t get too deep into the technical specifics without potentially compromising Vanguard, but we’ll go as far as we safely can... plus we can assure you that it has been reviewed by both internal and external security experts,” Riot’s post reads.
Click to expand...

In an effort to assuage privacy concerns even further, Riot has also expanded its bug bounty program with a special category for anti-cheat vulnerabilities that fetch even higher payouts than usual.
Click to expand...

Riot Games: A Message About Vanguard From Our Security & Privacy Teams

The bottom line is we would never let Riot ship anything if we weren’t confident it treated player privacy and security with the extreme seriousness they deserve. With that in mind, let’s look at our philosophy for Vanguard and the fundamentals of its architecture.
Click to expand...

guest · Apr 28, 2020

'Valorant' update lets players disable its anti-cheat software
But you'll still need to enable Vanguard to play the game
April 28, 2020
https://www.engadget.com/riot-updat...disable-its-anticheat-software-123031730.html

So seriously, in fact, that unless you’ve got its Vanguard software installed and switched on, you won’t be able to play its competitive hero shooter Valorant at all.
Earlier this month Riot responded to these concerns in a blog post, explaining how the system works, and now it’s made a few tweaks to further allay gamers’ concerns.

From today, Vanguard will show a system tray icon while it’s running, Riot explained on Reddit. From there, you’ll be able to turn Vanguard off and on as you please (reboot dependant).
You still won’t be able to play Valorant without it enabled, but being able to tangibly turn it off may provide peace of mind for some users. Plus, doing so could help mitigate any problems arising from Vanguard blocking other system software.

And if you want to keep Vanguard switched off until you next play Valorant — i.e. across multiple system reboots — you can just uninstall the software directly from the system tray, and it will be automatically reinstalled when you next launch the game.
Click to expand...

guest · May 15, 2020

A closer look at Valorant's always-on anti-cheat system
Riot explains how Vanguard works, and why, and then an expert weighs in
May 15, 2020
https://www.engadget.com/valorant-vanguard-riot-games-security-interview-video-170025435.html

So, with the launch of Valorant and Vanguard, the competitive shooter’s always-on anti-cheat system, the question is clear: Do you trust Riot Games?

“It's easy to go, ‘This is new, why should I trust it?’ But it's hard to get a satisfying answer because at the very end of it all you should trust us because we're trying to do right by you.”
That’s Paul Chamberlain, security and anti-cheat lead on Valorant. I talked with him and Riot’s chief information security officer Chris Hymes two days after their teams announced a handful of updates to Vanguard. The changes were in response to persistent online skepticism of Riot’s new, kernel-level anti-cheat system, and they were intended to give players more control.

Just three weeks after Valorant and Vanguard went live in a closed beta, Reddit was packed with criticism and conspiracy theories relating to Vanguard’s omnipotence.
Click to expand...

“That's the only assurance we can really give, is that we care about this a lot and we've put a lot of effort into doing things the right way with security reviews, transparency and all this,” Chamberlain said. “But at the end of the day we're just saying that it's good, and if you're uncomfortable with that, then we understand if you don't want to play.”

With all of this in mind, I asked Chamberlain to explain why Vanguard works the way it does. And then, I ran his answers by independent security researcher Saleem Rashid.
Click to expand...

Log in or Sign up

Valorant's anti-cheat software 'Vanguard' loads kernel-based driver on system boot

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Valorant's anti-cheat software 'Vanguard' loads kernel-based driver on system boot

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches