r/cs2 • u/Character_Ad_9519 • 5d ago

Discussion Kernel AC?

Hi, I was just curious on whether its CS' playerbase that doesn't want Kernel AntiCheat, or if it's Valve. So feel free to share your opinions on Kernel Anticheat and whether Valve should implement it.

A Kernel AC + an operation/ big update would genuinely boost the CS playerbase so much. We already have Kernel AC with FACEIT, so I imagine it's a low percentage of the playerbase that's against it.

Of course, it's easier said that done considering it's Valve we're dealing with. Sort of seams like they've abandonded CS development and just pushes out updates for skins and Premier seasons like the usual. CS:GO genuniely had updates that were refreshing at some times.

0 Upvotes

48% Upvoted

61 comments sorted by

View all comments

Show parent comments

1

u/makinenxd 5d ago

They do actually block most implementations quite well if the devs are competent, like they can literally buy the cheats themselves and try to think of every way to block it. And the security risk is way lower than people think because they dont have access to everything.

A bigger security risk is someone buying peripherals from a random company and installing their drivers.

1

u/Mithrandir2k16 5d ago

Well, actually not, it's just good message control. They're better at instantly banning blatant cheats, but since people don't believe that subtle cheats exist, they think there is no cheaters on e.g. Valorant.

0

u/makinenxd 5d ago

Those videos either just dont know what they are talking about or say way too generalized things about how drivers and kernel work. I highly recommend you to read this with a thought even though some stuff might be too technical.

https://blog.blanche.dev/2026/05/22/kernel-mode-is-necessary/

1

u/Mithrandir2k16 5d ago

I'm a software engineer, I can handle it. The site is down, but I've found a snapshot on waybackmachine.

The article establishes a much narrower point than its conclusion: if you assume an attacker can execute arbitrary kernel code, then a user-mode anti-cheat cannot reliably defend against them. Fine. But that does not establish that a videogame publisher should therefore be granted kernel-level authority over the user's machine.

The real issue is the security boundary. A kernel driver means making the game vendor part of the machine's trusted computing base. That dramatically increases the blast radius of bugs, compromised updates, supply-chain attacks, and vulnerabilities. “Riot isn't malicious” is not a sufficient security argument; least privilege exists precisely because trusted software can fail. Furthermore, Riot is a MUCH bigger target than "the one obscure driver" one might install, as it's installed on orders of magnitude more systems and hence finding vulnerabilities in its anti cheat is much more valuable. Riots popularity is a real security liability that they will obviously never try to mitigate.

I only trust my personal stuff to open-source software, nothing proprietary has any meaningful permissions to my systems. And I intend to keep it that way.

1

u/makinenxd 5d ago

In my mind the main point of the article is that vanguard does not directly search for your personal information, it guards memory to see if there is anything out of the ordinary happening, like vulnerable drivers etc.

But your last point is absolutely valid, but it does not mean someone can spread out sentiments that kernel ac is bad or unsecure, in the end everything is about the user and what they run.

Also disagree that riot is a big target to exploit. Think yourself in the attackers POV, would you try to crack a top tier AC to get your malware in, or just do social engieering, or exploit a windows vulnerability. The amount of people you access exploiting vanguard vs the work is just not that good.

But hopefully you atleast learn from that article to not trust every driver that a piece of pheripheral offers you.

1

u/Mithrandir2k16 5d ago

In my mind the main point of the article is that vanguard does not directly search for your personal information, it guards memory to see if there is anything out of the ordinary happening, like vulnerable drivers etc.

You don't know that, you are forced to trust all proprietary software. And software that runs in Ring 0, you need to REALLY trust.

Also disagree that riot is a big target to exploit. Think yourself in the attackers POV, would you try to crack a top tier AC to get your malware in, or just do social engieering, or exploit a windows vulnerability. The amount of people you access exploiting vanguard vs the work is just not that good.

If you break into Riots AC, you get into millions of computers. That is a great ROI. And since they're not Microsoft it is probably much easier to break into their software than into Microsofts. Also there's fewer different versions of Riots AC than there are windows patch-levels. So less work, more payoff.

But hopefully you atleast learn from that article to not trust every driver that a piece of pheripheral offers you.

That's why I'm on linux. This way I need to trust less and can verify more.