this video is going to be a bit of a rant about the state of anti-cheating games and how it's weirdly related to the crowd strike incident from last week and why I think the trend of putting code in the kernel is such a bad thing. I think it's going to negatively affect the games industry and, as a result, basically the average user of a computer unless we figure this situation out and undo this trend. Now if you're new here, hi, my name is Ed. This is Ol, a learning a channel where I makes videos about software security, cyber security, bunch of other cool stuff. I'm a security researcher during the day, so what that means is I look at code that people write. I'm like, you probably shouldn't do that there, you probably shouldn't do that there, write up a little report, give it to them, and that's my day job. Now if you aren't aware of what happened a couple of weeks ago, crowd strike happened, right? Now what actually went down was there's a

piece of software called CrowdStrike Falcon. It's an EDR solution. Basically, it's a program that is meant to replace a security team at a company, or at least heavily augment it. So, you have all these nodes that are on computers that are monitoring for malicious activity. And when they see activity, it sends a flag up to CrowdStrike, and they tell the company, and they handle the incident, right? So, it's like incident response as a service kind of thing. Now, the reason that the world basically exploded about two weeks ago is that CrowdStrike pushed a channel update, or basically an update in the logic to the kernel mode driver that runs the Falcon EDR system. Right? So, for anyone who's not like super computer literate, what that means is they shipped an update to the logic to a piece of code that runs in the kernel. The kernel being a very privileged ring of software in the CPU that runs on Windows. And because they shipped a malformed update, a piece of software that was incorrectly shaped, that caused every CPU that was running

the piece of software to crash. Now the issue with this, you know, computers crash all the time, software goes down, software breaks. The reason why the CrowdStrike situation was so bad is because the drivers that are running the CrowdStrike system, or that were in the CrowdStrike system, are what are called boot start drivers. They're pieces of software that are required to come up at start. If the assumption is that other kernel drivers could be malicious, you want to be in a privileged state where you can monitor them as they come up. Now, how does this relate to gaming? There have been a significant number of anti-cheat engines. Vanguard being one of them. I have a whole video about that where I talked about why it's such a stupid bad idea. And then, by the way, when Vanguard came out, there were a ton of issues. People were blue screening all over the world because the system was not compatible with their computer, or there was a TPM issue or something like that. I don't think it is okay for game companies to be shipping kernel

mode code for two primary reasons. One, these companies do not have security at the forefront of their model. And I'm not saying that they're evil. I'm not saying that they have some malicious intent. I'm saying they are responsible for putting out a game that is enjoyable as quickly as possible and updating the game as player demand changes. You know, player demand for video games lately has been so ephemeral. It's been changing so quickly because the ability to produce games is so fast. Feels like a lot of games feel unpolished. There are games that are going out that aren't even done. And if game companies begin to ship out kernel-mode code like this, we are going to live in a world where there are just computers riddled with kernel-mode code that are doing some kind of security thing but have vulnerabilities that can be taken over by malicious actors. And when a poorly formed update comes out like the CrowdStrike vulnerability, if that were to happen in a widely used game like League of Legends, for example, and it crashes the Vanguard VGK, dosis.

colel mode driver, which by the way is also a bootst start driver, just like CrowdStrike's was. We're going to have a significant issue. People's computers are just going to be falling out of the sky. It is nonsense. And the second point that I want to make is that I have a significant problem with companies pushing out technology that the majority of people don't understand. I feel this way about kernel mode code in video games, and I feel this way about artificial intellig. The average consumer has no idea what the hell is going on when I say kernel mode code, when I say language learning model, Microsoft co-pilot, things like that. Microsoft, what was that piece of code that they were going to use that would like watch your Windows machine and take pictures every 5 seconds? That thing. I don't like the idea of somebody like my grandmother, for example, and I made this exact same analogy in the Microsoft video, where my grandmother, who doesn't know anything about computers, who just plays mahjong tiles or whatever on her PC.

when she downloads the the anti-cheat that comes with maang tiles, she may be unknowingly exposing yourself or are opening up the attack surface of her computer to a place where if a bad update goes down and you know they blue screen her computer at boot, she now has no compute you know they're taking her offline with an update and they put out a bad update because they're more profit-driven to put out the game update and they didn't test their code. It just I don't know it just doesn't feel like it's okay, okay. I I don't like the trend that we're going down. I think my again who the am I right I'm just some guy on the internet my demand really for the games industry is stop shipping code in the kernel stop with the anti-che trend maybe if we want the problem is what we could do is we could create an open-source anti-cheat that everyone uses and now I don't think easy anti-cheat is open-source but the idea is that if we

had one anti-che engine then we could just all have the same code and would be we could publicly audit it. But the problem is then the whole idea behind anti-che is there are cheaters. If the cheaters know what the code does, they can write cheats at bypass the code. And then you get into this really annoying arms race of like, you know, we have a new cheat put into the anti-che and then eventually they figure out a new one and you just do it over and over again. Now, in my opinion, I think that is better than compromising the entire chain of trust of computing by having every video game company ever come up with their own proprietary dosis and antiche that likely doesn't go through proper Security review, doesn't get cicd on the way out, doesn't get, doesn't get tested on the way out to production. And then eventually when the, the, the popular game TM pushes out a I keep saying malicious, I mean Malou formed, uh, an update to the world, they take down the consumer.

and in a lot of the cases against their will unknowingly. I don't know man, I don't like it. Let me know what you think in the comments down below. Bit of a rant on my part, but I really just I had to get this off my chest. I couldn't figure out why I kept in my head relating crowd strike to the games industry, and these two thoughts have been coming into my head ever since like crowd strike happened. And I've had, you know, the Vanguard thing. I stopped playing league if you're new here in this year actually because of Vanguard. I don't like the idea of Riot having a kernel mode driver in my computer that is closed source, and I have no idea what it does. And also again when Valorant, when Vanguard came out, it took down a lot of people's computers. Again, there were some claims that there were bricking happening like their computers wouldn't turn back on. I don't think that actually happened, but there were people who when they got the

update they either boded or they couldn't play league not a great place to be anyway let me know your comments let me know what you think in the comments down below I really appreciate a bit of a rant I hope you uh enjoyed this one see you in the next video take care guys

the games industry is next

Teaching you 🧠 about the lowest level
