Yup, kernel level "anti-cheat" is a rootkit spyware that "pinky swears" it's only spying for a good reason.

Yes, works on the same layer.

Yup.

Yes, and I've seen it happening. Usually it doesn't instantly brick every PC, but it can sometimes brick certain PCs with specific configurations. Then it will be silently patched without acknowledgement for the bug.

I've seen it mess with (and crash) graphics and network drivers, rendering PCs useless until forced reboot. It can also mess up other games, processes, and even updates.

People have been warning gamers about kernel level anticheats since they were introduced, because no userland code should run with that level of privileges, period. However, people still installed those games not really understanding the threat, and that's why we have so many games with a kernel anticheat.

Pro tip: don't install rootkits.

I'm far from an expert, but Vanguard is a kernel-level program. If a kernel-level program crashed, the whole system crashes. So yes, any kernel-level program could do the same thing CrowdStrike did, intentionally or not.

Kernel-level programs can do whatever the hell they want.

It's also potentially a infiltration vector for malicious activity.

Genshin impacts anti-cheat has been used to enable ransomware taking over windows computers, and you don't even need to have Genshin installed.

It was a danger to all windows users just by existing, because the ransomware just came with the genshin anti-cheat, which it would install on its own. Because it was a "verified" piece of software windows would just go "oh ok seems cool, go right ahead" and the ransomware would gain complete control of the system through the anti-cheat.

Yes, the key difference being that nobody’s playing Valorant on airport displays. Just yesterday I installed a new early access game for two accounts at home and discovered that it just wouldn’t work with the non-admin account because of anti-cheat. All of this is making me consider going back to running games under flatpak.

Helldivers 2 does the same thing. If this continues it will be extremely advisable to move any non-gaming use-cases to a different computer as you have no idea what the "anti-cheat" is doing with that level of authority over your computer.

I'm less worried about bugs causing boot loops with these kernel anti cheats and more worried about security holes.

I'm sure they test these things thoroughly though and take security extremely seriously.... right?

Preface: I'm not an expert in this yet but I'm pretty interested in learning about systems-level topics so if I'm wrong please correct me!

Yes, the thing about anticheats and anti viruses is that they are only useful when they have access to the underlying resources that a virus or cheat engine might try to modify. In other words, if cheating software is going to use kernel-level access to modify the game, then an anticheat would also need kernel-level access to find that software. It very quickly became an arms race to the lowest level of your computer. It's the same with anti viruses.

IMO the better strategy would be to do verification on a server level, but that probably wouldn't be able to catch a lot of cheats like wall hacks or player outlines. At some point you just have to accept that some cheaters are going to get through and you'll have to rely on a user-reporting system to get cheaters because there will always be a way to get past the anticheats and installing a separate rootkit for each game isn't exactly a great idea.

It has comparable access, yes, ~~but assuming no malicious intentions, it's extremely unlikely that they achieve something as catastrophic.~~

~~If they fucked up in a similar fashion, that would cause your PC to bluescreen, too, but since League does not start up during boot, you could still use your PC, just not League.~~

Nope.

It is a bit complicated. Any kernel level program that crashes will cause the entire operating system to crash. But it won't cause the system to continuously blue screen because it isn't a required program in the way that crowdstrike was.

Crowdstrike is basically an antivirus program so it has to run when the operating system starts up and if it isn't running then the operating system should not boot for safety reasons. The problem is that if it must be loaded, and it has a crash, then it loads and kills the system. So you get an infinite loop you cannot get out of.

Vanguard only has to run when you're playing online though, so it's not loaded when the system runs, or at least it doesn't have to be. So it won't cause a recurring boot loop. It might fail to load and you wouldn't be able to play online games that require it until they fix it, but it isn't going to prevent the computer from running.

Theoretically it should only be running during gameplay, and that's probably true as I'm sure security researchers would've pointed it out if games installed a persistently running rootkit. So it's different than Crowdstrike which was running immediately from boot.

So there is that, if it caused your PC to crash it should be fine after reboot. The driver has God power though as far as your PC goes so if it was the point of entry for a malicious attack you could be really screwed.

Edit: apparently I'm wrong and it runs all the time what the fuck