Kernel Anti Cheat - Pros / Cons - Dangerous?

 Kernel Anti Cheat
Pros & Cons
Is it Dangerous?
By Vas Vadum

    So, I've had to tell people many times the same thing over and over and really, its getting annoying, so why don't I just type up a blog about it so I can copy paste a link instead hmm? So first off, if you want a TL:DR version; Yes, its dangerous. It has no pros, only cons. Protest it. Uninstall it if you're allowed to. If you're forced to use it, use it with caution and protest against it at the company's pages.

 Pros & Cons?

Pros: None. There are no pros. It doesn't stop cheating. It only inhibits it a little bit for a short while. Cheaters will find a way around it, they always do. No anti-cheat has successfully stopped all cheating. Ever.

Cons: A lot. System resources are diverted to scanning the environment. The anti-cheat system is loaded at the Kernel level which means it has unrestricted access to your entire computer. Every file, ever process, every permission granted, bypasses anti-virus, bypasses windows security, bypasses hardware level protections.

Is it dangerous?

Yes. Lets start with the most likely to the least likely risks.

    A kernel level driver with a security vulnerability can allow a hacker access to your entire file system, bypassing 100% of every protection system you have in your computer. A test was done on a previous anti-cheat that had a major vulnerability discovered in it, and they could use the vulnerability to terminate AVG anti-virus so that the attacker could freely install malware and grab your information. Once in your computer, an attacker can read your screen, download your files, log your key strokes, copy your browser cookies and session IDs (which means they can login as you on any computer without even knowing your passwords). The attacker has full unrestricted access to your computer, thanks to the anti-cheat running in Kernel which grants it supreme permissions.

Want some examples of this? Look up the ESEA Bitcoin Mining Scandal. There's also the Genshin Impact Ransomware Incident in 2022 which directly involved an anti-cheat.

    What if your kernel driver has a mistake in it? Well, you can face a similar problem as two other kernel drivers have in the past. One was an anti-cheat, another was not. Both, caused a BSOD boot loop that prevented people from accessing their computers. The biggest incident known is the 2024 CrowdStrike incident which cost several billion dollars in damages after it was ultimately concluded. Whats that mea for you? Your computer could stop booting up and you'll have to pay someone to help you get back in, if you aren't savvy enough to do it yourself.

Want more examples of this? Look up the Riot Vanguard System Crash Incident which was caused by their anti-cheat.

    Alright, surely thats the most risk there is, right? Nope. There's one more less likely risk but its the biggest risk you could ever take. Its such a massive risk, even a 0.1% chance of it happening seems too much to risk. What is it? Well. If the kernel level driver were to incorrectly send a voltage spike to your CPU even for a nanosecond, it would fry the CPU and your computer will shut down, or catch fire. Either way, the computer is done, forever. No repair. No proof of who or what did it. No chance of ever suing a company for damages. You'll be forced to buy a new CPU/computer. This doesn't only affect the CPU, it could hit any of your hardware. Thanks to Kernel allowing the driver to talk to any piece of hardware and send any command.

What should I do?

    Well, that's simple. Protest. Every game that doesn't need anti-cheat, like VRChat, protest it. Give it a bad review, tell the devs they need to find a different way to fix problems. What about games that do need anti-cheat? Simple, they can run anti-cheat on the server side, which stops cheaters far more often than client side anti-cheat. Give gamers the choice of disabling anti-cheat by hosting their own servers. Give people the choice. Tell these companies you want the choice. You want control over your computer and to know that your computer is safe.

 Server side anti-cheat is actually based on checking for things that appear to be impossible, such as a person moving too quickly, or firing too fast, or an inhuman amount of actions per minute. There's quite a few things they can do to prevent cheating on the server side without slowing down your computer to do it, and without putting your computer at risk. It only costs THEM resources, which is why they'd rather pass that load and risk onto you. Don't let them. Your computer shouldn't be punished just because a few 1% or less of people would prefer to cheat in a multiplayer game.

Simply speak up, even if you're forced to use the anti-cheat to continue using an app, just speak out against it. Express your distaste for having your computer put at risk of several dangerous things just because the company was lazy or cheap. All it takes is speaking out, to help cause change.