6

At home, my personal PC and work computers all connect to the same network, via ethernet and WiFi.

A video game on my personal PC is requiring an install of a "kernel mode driver." At the risk of asking the obvious,

  1. Can this compromise my other computers that share the same network? (They're often connected at the same time.)

  2. Is there any way to play this game without compromising my security?

Official reference:

https://support-leagueoflegends.riotgames.com/hc/en-us/articles/24169857932435-Riot-Vanguard-FAQ-League-of-Legends

Unofficial articles:

https://leagueoflegends.fandom.com/wiki/Riot_Vanguard

https://readwrite.com/riot-has-finally-launched-vanguard-to-overwhelmingly-negative-response-from-players/

1
  • 1
    First - check whether kernel driver has digital signature on executable files (.exe, .sys, .dll). If there are digital signatures, the risk is lower. Which company provides the driver?
    – i486
    Commented May 6 at 7:44

4 Answers 4

29

Is it possible?

Could a kernel mode driver deeply compromise your computer?
Yes, kernel mode driver have very high privileges on the system.

Could a compromised computer affect the whole network it is connected to?
Yes, especially if the systems trust each other (which is common).

Will this actually happen in your case?
Unknown.

Can you do something about this?

Don't let any system or software in your network which you don't sufficiently trust. This includes not only games, but also any other software like the operating system, text processing software ... This includes also other systems on the network like the printer, smart light bulbs, smartphones etc.

This might also be achieved by isolating the risky system, i.e. don't connect it to the same network as the other systems. One might also do dual boot (maybe using different external disk) and integrate the system only back in the network when it is running a "clean" software stack.

Alternatively, consider anything potentially compromised and protect your other systems in the network accordingly. This will not eliminate the risk but reduce its impact.

Sounds infeasible?

You need to find the right balance between paranoia (not trusting somebody just because they could do harm in theory) and blindly trusting anybody. You need to decide which risks you are willing to accept in order to keep things usable or where you rather degrade usability (including not using some software) because the risk is too high. You need to decide which costs are acceptable to you to reduce the risk, which highly depends on how valueable the assets are which you need to protect. IT security is not that much different from "real" life in this regard in that it's all about trade-offs.

2
  • 1
    I trust my work computer not-at-all, so when its at home laptop lives on a separate LAN into the firewall, and has zero access to anything else in my home. 10 different items of monitoring/spy/helpware on it.
    – Criggie
    Commented May 5 at 23:49
  • I'm not certain dual-boot would help in this case. Kernel modules get very low-level access which could potentially be abused to install persistence at a level below the OS or to infect the boot media of those other OSes.
    – BlueCacti
    Commented May 7 at 9:19
6

Another thing worth noting is that your computer has many kernel mode drivers and adding some random fly by night hardware might present a greater risk that you do not even know about. For the anti-cheat software they mostly play up the kernel mode driver because it is so egregious for a video game to demand one, not because nobody uses them ever.

In this scenario you are looking at two risks, the first is the publisher. Riot games seems well known and many people use the software. They are a public company that could easily be liable for sending you pure malware. It is unlikely they are going to send you malicious software, so long as you make sure to obtain it directly from them.

The other risk is more subtle in that video games are often more concerned with working than being entirely stable or secure. Combine this with an online game having user generated content and yes, there is some risk involved that the software may be attacked by other users during play. This risk is only going to present itself rarely when a fresh exploit is discovered. The only real mitigation here is that the publisher is still supporting and patching the game, and that you install them. Again, this seems like a massively popular game that Riot is still making money from and not abandonware.

IF you are really paranoid and have a totally separate gaming PC, consider segmenting/firewalling your network in a way that isolates it from other devices. Consider not keeping your most valuable secrets on the gaming PC.

Realistically though, having this PC with your other devices is not more dangerous than say using public WiFi. Your other devices would need to also be vulnerable. The kernel driver does not give the gaming PC ultra magic hacking abilities!

6
  • 8
    Huge video game developer will happily distribute malware if it makes their work even a little bit easier, mainly because they lack sufficient imagination to consider that their intentional security bypass will be used by anyone but themselves.
    – Ben Voigt
    Commented May 5 at 20:28
  • 3
    "It is unlikely they are going to send you malicious software," - maybe not deliberately malicious, but it can have security issues which then can be exploited by others. And maybe also a bit too noisy what users are doing on the system. Even large companies do this - see Sony BMG copy protection rootkit scandal Commented May 6 at 5:00
  • 1
    @SteffenUllrich does paragraph 3 not address this? Commented May 6 at 5:50
  • Also, this is entirely different from the Sony rootkit. It is open about existing and maintained consistently. Commented May 6 at 5:54
  • @le3th4x0rbot: The question is asking about the risk of kernel mode drivers in games in general and takes a specific one only as example. That's why I've added an example where the risks were clearly present: deep access to the system, invading privacy, buggy, used by malware to elevate privileges, ... . As for patches: they come only after the vulnerability is already there and got maybe already exploited. Or maybe they never come because the user is not aware of the problem and does not install the patch. Or because the product gets EOL before the vulnerability is found. Commented May 6 at 6:03
2

It depends on what you mean by "compromising" the network. If you want to have as an invariant that "nothing untrusted is connected to the network", such that the network can be trusted, then yes, connecting anything compromised to the network breaks that invariant. Note that you probably already have a lot of untrusted stuff connected to the network, like smart TVs, a router provided by an untrustworthy ISP, possibly security cameras, voice assistants, cheap Android phones, any such devices belonging to guests in your house to whom you give the wifi password, etc.

If on the other hand you treat the network layer as untrusted, which is what all good security professionals will tell you to do, there is no such thing as "compromising the network". It wasn't something you had to trust to begin with.

1

A kernel driver with full hardware access (typically kernel drivers need that to control the hardware) can do anything the processor can do with the hardware.

For a driver accessing the network card, it could read and change any RAM of flash location and send arbitrary network packets (make connections, change data, etc.).

It could also put the card into "Promiscuous mode", reading traffic intended for other nodes (if nodes share a cable or WLAN).

In an extreme case, the driver could download other software and install it.

So basically it's a matter of trust; that's why Windows drivers are usually digitally signed, and unsigned drivers are rejected.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .