List of models affected?
It’s all motherboard models for certain Intel chipsets, AMD looks to be unaffected: https://thehackernews.com/2025/12/new-uefi-flaw-enables-early-boot-dma.html?
Thanks!
Yet another nail in the coffin of client-side anti-cheat. If you’re seriously affected by people using these kinds of cheats on their PCs (this one requires specialised hardware) then no amount of client-side anti-cheat is going to make a difference anyway.
They could always bring back paid in game mods, spend money on ppl actively checking games for cheaters and banning them, but nah then theyd make slightly less
Well the most popular cheats can’t properly* be detected on server side so I guess nothing can be done then.
(* some of those you can use metrics to guess but tuning that to catch all cheaters but never any real players is impossible)
Fair to say you can never prevent false positives entirely, but you can get asymptotically close. Server-side is the way to go even if it’ll never be perfect.
Ironically, League of Legends was formerly one of the crowning examples of a competitive game that effectively managed cheats without aggressive client-side AC. In >5000 hours of gameplay, I saw one probable cass scripter and maybe one person scripting dodges on Vayne.
I would guess that type of game is much easier to do more comprehensive anti cheat for then the kind I was thinking of(i.e shooters) but I can’t be sure as I’ve never worked on one. The prime thing that I think makes it easier is that the game has a clear “no you cannot see or hear this person at all” state.
Yeah, shooters are definitely harder but not impossible. Some games are starting to implement occlusion culling (i.e. the vision detection strategy you’re describing), but that’s impossible or hard to pull off in certain contexts.
Overwatch 1 is probably the best case study in that genre: while it absolutely had cheaters, their player report system took action pretty fast, and anyone banned had to pay $30 for a new account. In practice, that was a strong enough deterrent to keep people from doing anything game-breaking that ruined the fun for other players.
It does become basically impossible if there aren’t strict limits on the art and level though(i.e ensuring walls or other blockers do not have small openings in them). Especially if you also want to use bushes as a thing to normally block sight as well. Though even then it’s still less effective then people think as you still need to replicate players not yet visible but could be if the local player moved a bit.
Let’s also not forget that you still need to deal with replicating things such as footsteps sounds through walls. Even if you replicate those as individual sound events instead of part of a replicated character that still gives a cheater enough information to know someone is there.
amazing, I approve of this. People should get locked out of playing if they have old systems that no longer receive BIOS updates. And also if they don’t even know what BIOS is. Once this kind of inconvenience gets more broad and companies will start losing players then maybe this BS with intrusive anti-cheats will stop… I hope
if they have old systems that no longer receive BIOS updates
You just went the Microsoft route there: “their system is too old and doesn’t have TPM, they need a new system to stay secure”
Or the BF6 route “you need to have Secure Boot enabled to play our game”
This just creates more e-waste and doesn’t really solve the problem as their user base will happily follow them for much longer than you’d probably think.
BF6 requires secure boot? …fuck outta here…
Huh? Why? That’s none of the game’s concern.
I think they were being facetious.
The point was that alienating their main player base this way will lead to the demise of companies that use kernel level anti-cheat and those companies will deserve it because they did it to themselves.
Fair point. Tone was hard to read
sorry, i’ll use italic next time
It was very clearly a combination of sarcasm and dark humor.
Make bios illegal.
So like, no more going to the bathroom while gaming?
UEFI gang rise up!
How does the AC check the BIOS version? If you have DMA you should be able to spoof that, even against the kernel I assume. I guess its a cat and mouse of spoofing detection by the AC versus the cheat devs?
Possibly TPM backed remote attestation. Having said that, once you are at the point of being worried about hardware DMA attacks, TPM attestation is not as full proof as you might think.
The bios flaw they were exploring was the bios having flawed anti DMA protections.
From the article
According to the company, the Input-Output Memory Management Unit (IOMMU), which protects system RAM from Direct Memory Access (DMA) devices, is not fully initializing upon boot in some motherboard models. This means that even though the BIOS might indicate that Pre-Boot DMA Protection is active, it’s not actually protecting the entire system.
stumbled over this a couple days ago, kinda relevant in case one wants to know more about ac and why its as it is on linux
At the end of the article, my takeaway is “anti-cheat is a tool used by bad developers to fix their security issues.” Properly written games are more resistant to bad clients, regardless of anti-cheat usage.
I’m also reminded of a Microsoft blog: What if two programs did this? which leads to being unable to play Battlefield 6 while Valorant is installed.
Wow, what a bad article. “Companies can spy on you anyway so just give them kernel access” is interesting logic… They tout the effectiveness of kernel-level anti-cheat by claiming they’ve never encountered a cheater in Valorant. This is either a lie or ignorance that demonstrates the author isn’t qualified to write on the topic. A websearch will return pages of results and examples of working cheats for Valorant. Valorant is actually one of the easier games to write cheats for.
The majority of cheats used today are not impacted or detected in any way by kernel-level anti-cheat. At all. This is because most cheats are not even run on the machine that is used to run the game. Its wild that the author just doesn’t address this reality.
Cheaters use a 2nd computer, outside the reach of anti-cheat, that receives and processes the video-output of the game. The kernel-level anti-cheat can only monitor the system that the game actually runs on, which is completely clean. The 2nd computer runs either a colorbot (especially trivial and effective for games like Valorant that outline enemies in a solid color) or an AI object-recognition model (a quick search will return loads of specialized models trained for various online shooters) to identify the location of enemies on screen. It then generates mouse movements and inputs that are sent back to the 1st computer running the game, while the kernel-level anti-cheat is completely unaware.
These cheats are so efficient that they are commonly run on cheap hardware like an arduino or raspberry pi, and the code is often very simple, sometimes just ~100 lines of python. They can also be subtle and hard to notice by other players (probably why the author may believe they don’t play with cheaters in Valorant), providing aim-assist or click-assist that works with the cheater’s authentic mouse movements, and sometimes only kicks in when an enemy is already close to the cheater’s crosshair.
The author also cherry-picks examples to lead the reader into believing that all multiplayer games require Windows anti-cheat to be successful, while conveniently not mentioning the many competitive multiplayer games that do support Linux and are a perfectly normal online experience, eg Marvel Rivals, Overwatch, Halo Infinite, or Dota 2. Can the author explain why these games are completely fine without Windows anti-cheat?
They don’t challenge, and misrepresent, the invalid reasoning given by some of these game companies for why they arbitrarily chose to block access from Linux, for example Apex Legends claimed the majority of their cheaters use Linux. But wait, how could they know that if cheaters cannot be detected on Linux? So they must be successfully detecting Linux cheaters. Apex Legends’ actual reasoning for disallowing Linux directly contradicts the claims that the author is trying to make. It’s not true that the majority of their cheaters run Linux, of course. The majority of cheaters fly under the radar by running Windows and allowing the anti-cheat to verify a clean system, while just running the cheat software on a 2nd computer.
Awesome article, thanks!
deleted by creator
