Anti-cheat softwares are often flagged by antivirus as malware before they’re manually added to the whitelist, under the assumption that the people behind the anti-cheat act in good intention, and will continue to do so forever. From what I've read online, some of them are essentially keyloggers and/or screenwatchers (among other concerns of low-quality code). Isn’t this like pointing a gun to the user’s head and saying “don’t worry I won’t shoot unless I think you’re a cheater”?

If I bought/subscribed to a game that mandates installation of this software, what should I do (short of buying a separate computer dedicated just to gaming)? Or is this nothing significant to be concerned about, even if sensitive data (private keys for website databases/cryptocurrency wallets) is kept on the same computer?

  • 1
    Vulnerability means a bug in a software which can be exploitable. I think what you mean by a vulnerability in your subject is threat. – Muhammad May 28 '17 at 22:05

The problem of anti-cheat software, is that they try to prevent low level operations that are normally allowed by the system. Essentially, they try to prevent an external application to send mouse events or keystrokes to a game without actual user interaction.

So to prevent that, they have to interact with the system at a very low level, which is exactly the level where keyloggers/mouseloggers should be. That means that the heuristics of an anti-malware have to flag them as suspect.

If you have bought a game requiring to install such a piece of software, my advice is to bring/send it back to the reseller and ask for getting your money back. Unless it was clearly advertised forcing you to use a third party application which is detected as suspect is not acceptable. And including in code operations that are detected as suspect by major anti-virus software is not professional either.

| improve this answer | |
  • I think modern anti-cheat software favours detection over prevention, even going so far as to introduce artificial delays to banning. The rationale is that it's much harder to test your cheat code when you get your results a few hours later. – Fax Apr 14 at 18:11

To understand what anti-cheat softwares do, let me tell you what cheats do at first.

How cheat works: To achieve cheating, cheats are used methods like code injection into remote process, manipulation of remote process and data, interfacing pointer hooks, hijacking exception handling etc. To kept hidden, cheats often use methods like direct kernel object manipulation (used by rootkits), virtual address descriptor hiding etc. So when you are using cheats you are giving it permission to look and manipulate your memory and other sensitive stuff.

How Anti-cheat Software works: What anti-cheat software do is it detects cheats by signature and heuristics (mostly like anti-virus). Sometimes it blocks cheats by detecting obfuscating code or by sandboxing the application. Anti-cheat software like VAC compares MD5 of cheats from VAC's database with the (DLL) files of your hard drive. VAC also check your DNS caches and it’s explicitly searching for entries that correlate with specific cheats. Why does it work? Because The cheat connects to a remote server to see if the user’s license is valid — thus leaving an entry in the DNS cache. VAC catches that entry, and bans the user. Anti-cheat software like PunkBuster scan memory to detects the presence of cheats and if it found one, then kicks the player out from the server.

Is it security risk: Yes it is if it's not from a reliable source. So like other software you should be careful about the digital signing, checking md5 etc. Some anti-cheat software installed with the game itself so you do not have to worry if you buy it from the official source and some are installed at servers end so you don't have to install anything hence you are clear. But the sensitive data you have mentioned are should be in a separate secure place where it's highly unlikely to infected by malware of any kind.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.