Stopping processes is actually a user space action.

Now you backpedal and say

Pretty much all code is making requests to the kernel.

But I don’t know what I’m talking about? Sure. We’ll go with that if it makes you feel good. I only literally taught it at a post-grad level at an R1 institution, but what do I know.

It’s side stepping the kernel. That’s the whole point.

You’re getting it! Kind of at least. The anti-cheat actually modifies the kernel (in an extension kind of way, like drivers do). That’s the point though. Which seems to have repeatedly whooshed over your head. But I can only say it in so many ways and be ignored. Good luck. Hope I don’t run into your code.

Stopping processes is actually a user space action. You can do it without admin rights btw. Even if it popped the admin screen that’s still not a kernel level action.

Absolutely not. Task management is the job of the operating system/kernel. You can request to end a job/task. The kernel will do it on it’s own time. UAP prompts are attempts to elevate permissions so that you can access higher kernel calls.

https://linux-kernel-labs.github.io/refs/heads/master/lectures/syscalls.html#linux-system-calls-implementation

https://unix.stackexchange.com/questions/111625/how-does-linux-kill-a-process

You can make requests the to the kernel. If you have permission/ownership to the process the kernel will work through the sigterm/sigkill to meet your request. It is not a user space action at all to kill a process, you make requests to the kernel to do it. Hell in linux it’s even more obvious as you can instruct the kernel on HOW you would like to kill the task and even then it may not follow your direction. https://www.man7.org/linux/man-pages/man1/kill.1.html with kill being a kernel tool. If you spawned the process, then you have permission/ownership to the process. But my point in the previous post was that anti-cheats can reach into the system, reading dlls and such that are absolutely NOT user space to begin with, require elevation beyond user space to install.

Yeah that it’s considered malware. I did Google it and there’s nothing saying that.

Seriously? You can’t find anything? You sure about that? Cause I can literally pull up thousands of articles and forum threads by literally typing “is vanguard anti-cheat malware?” or “is easy anti-cheat malware?”

https://forums.malwarebytes.com/topic/288793-easy-anti-cheat-launcher-detection/

Heuristics detect these things for what they are. Anti-virus software have to whitelist them because people choose to play the games anyway.

https://www.techguy.org/threads/is-valorant-vanguard-a-malicious-rootkit-or-not.1267682/

https://www.pcgamer.com/the-controversy-over-riots-vanguard-anti-cheat-software-explained/

The name is appropriate, because Vanguard doesn’t just sniff around for cheats when Valorant is running: It starts up with Windows and keeps an eye on other processes whether or not you’re playing Valorant at the time. […] Vanguard detects software with vulnerabilities which could be exploited by cheat makers, and blocks some of it.

https://www.sp-cy.com/article/is-valorants-anticheat-spyware/

Vanguard cannot be easily fully disabled since after manually quitting the process, a system reboot will be required to be able to open Valorant again.
The EULA prevents any legal recourse against Riot Games.
Valorant/Vanguard sends encrypted data to Riot. Which is Chinese owned by a giant corporation called Tencent.

Let’s attack this question from another perspective. Do you trust a games developer to properly develop kernel code? Most people BARELY trust Microsoft to do it these days. And you can’t review/evaluate it yourself at all. You have no fucking clue what they’re doing and never will. We’ve seen what happens when random companies inject shit into the kernel like crowdstrike did. You think that these anti-cheat softwares are acting in your interest when they’re being implemented and paid by a corporation? How can you look at these anti-cheats that have made backdoors on systems, cause people everywhere unstable kernels/BSODs, send data about your system without permission, interacts with software on your system that isn’t their code, etc… and say they’re not malicious?

but so far at least I’m happy with the bandwidth.

Oh for sure, it’s boatloads and I love it… but I’m in the market for a /28. I want to hand them like $40 extra a month. LET ME PAY YOU QUANTUM/LUMEN/CENTURYLINK/LEVEL3. It’s effectively free money as once it’s setup there’s nothing that changes or goes down. There’s so little maintenance/upkeep cost to it that I just don’t understand why they don’t want to print free money.

Source for what in specific?

That stopping processes is a kernel action? Go ahead. Open powershell and ask it to close some other system process… The UAP prompt (if you’re on windows, linux will just fail silently most of the time unless you sudo or are root) that shows up is the kernel validating that you even have permissions to do that. The kernel handles ALL task scheduling/management. When you close something you’re asking the kernel to do it. The kernel also handles ALL file management and driver management (drivers being extensions of the kernel). So the fact that it can read other active DLLs and such hooked into other processes (say your graphics drivers) is literally proof.

That industry agrees that it’s malware? Depends on which part of industry I suppose. But if it’s able to do all these actions at the kernel level, and attached itself it to other software to install, often doesn’t uninstall when you remove the game it was attached to, AND gets flagged by anti-viruses that don’t have it whitelisted yet… It’s definitionally malware. Go search for “Is <insert anticheat> malware”. Very few people will argue that they’re not.

Hell it’s possible for anti-cheats to write to UEFI if they really wanted to. There’s no legitimate reason for that level of access, 0, none.

They have kernel access… They can control anything since they’re in the kernel. And yes, I’ve seen it.

If you remember back in the late 2000’s early 2010’s there were a boatload of apps that would hook into games to do things like display overlays for chats (Teamspeak for example, overwolf as another.) some kernel anti-cheats would stop those processes from starting up.

But don’t take my word for it.

https://www.pcgamer.com/according-to-experts-on-kernel-level-anticheat-two-things-are-abundantly-clear-1-its-not-perfect-and-2-its-not-going-anywhere/

I’m less worried about developers abusing kernel access, and more concerned with potential vulnerabilities introduced for third-party actors to exploit. Rigney cited two examples: the infamous Extended Copy Protection (XCP) from Sony, which bad actors used to compromise affected systems, as well as a backdoor vulnerability introduced by Street Fighter 5’s kernel level anticheat. In 2022, a ransomware developer also took advantage of Genshin Impact’s kernel level anticheat to disable antivirus processes.

Introduces backdoors to be used by malicious actors.

https://www.pcgamer.com/the-controversy-over-riots-vanguard-anti-cheat-software-explained/

Vanguard detects software with vulnerabilities which could be exploited by cheat makers, and blocks some of it.

Blocks external softwares that it deems “vulnerable”

https://old.reddit.com/r/gaming/comments/xf1cwr/the_insanity_of_eas_anticheat_system_by_a_kernel/

This is far from the first time that boot level firmware or kernel mode code inserted via patches or drivers have been used to install spyware, but every time I see it happen I want to warn users about the consequences, and provide some information about the danger.

Kernel devs beg users to not allow this shit.

Just look it up. All sorts of articles and experts have spoken on it.

Taking kernel level actions to stop processes on YOUR machine is absolutely taking control of the system.

Kernel level anti-cheats meet every requirement. Just because you think there’s gymnastics going on doesn’t make it so. It’s actually well established in the security field that they count.

Malware isn’t defined by its privileges but what it does.

Correct… and anything that intercepts all system calls and forces closed applications that it deems “not safe” even if I the user specifically run it is malware. You bet your ass they feed back information to the mothership too.

And btw, if you’re accepting the “Spyware” moniker from the other comment chain. Spyware is a form/category of malware.

Definition from Malwarebytes:

Hostile, intrusive, and intentionally nasty, malware seeks to invade, damage, or disable computers, computer systems, networks, tablets, and mobile devices, often by taking partial control over a device’s operations.

Hostile - it’s not meant to help you at all. If you’re doing something deemed “unsafe” in their eyes. They will take action up to and including stealing your money that you paid for the game. intrusive - embeds itself in the kernel Intentionally nasty - Well it’s not accidentally nasty.

invade - attached to games with little to no input on what you’re installing. disable computer systems - specifically the software you paid for Taking partial control over a device’s operations - the whole fucking kernel.

I’d say meeting the VAST majority of the definition and at least one portion of each category is sufficient to call them all malware.

I’ve been repeatedly told by everyone I talk to over there that it’s not ready yet… still… even though it was supposed to be ready by end of Q2 this year.

Calling them today still yielded the same answer for me.

I’m forced to use DDNS and a service to route my emails for me. But email and PBX servers really don’t do well on DDNS type stuff.

I have basically a full rack of equipment. Here’s the network side of it all. My desktop is 2 SPF+ fiber connections back to the core switch. Tons of stuff in my rack is all 10gbps or 40gbps.

Dual opnsense firewalls (top 2 slots, dual 40gbps connecting to core switches), though one is inactive until they let me buy static addresses. I run some business stuff on this. Boatloads of homelabbing and self-learning.

If you want to do full IPS/IDS, then yes you need some horsepower. But just connection with basic rules there’s plenty out there that’s not super expensive. Ubiquiti has their dream machine line which even the “cheap” $400 one can do 10gbps (2gbps with ips, or something like that. I dunno, I don’t keep tabs on them).

I didn’t stop any active connections/downloads happening on the network. I very likely had a gig of other stuff going elsewhere on the network.

Their “smart-nid” is also a router… so that works too, but I don’t trust it and in my setup it’s in transparent mode.

Edit: Formatting sucked

My personal best so far is 7TB in a month 😂

This is just my past month… I have no idea what my record is… but would likely be significantly higher as I slowed down on some stuff recently. I need more harddrive bays/harddrives… Stupid ebay doesn’t have what I want.

Edit: here’s past 90 days as well

Harris did not out perform Biden in ANY category.

The only downside is it’s still IPv6 Rapid Deployment.

And no static IP addresses yet… Even though it was supposed to be rolled out Q2.

And yet here I am in the USA with 8/8 Gbps fiber with no caps. Though I do pay $185 a month. I live in a Red state, and in a metro area, but not near the metro core, in unincorporated county land.

last 30 days stats to prove no caps:

You said you’re using OPNSense for routing… Just keep it up to date and you’ll be fine.

If you’re worried about your ap, I think you can set omada APS to restart nightly… Though I could be misremembering.

Every network manufacturer has had some CVE for something.

Why are you attributing some emotion to text? Why is it that you can’t answer something in context and instead just need to inflame some anti-cop nonsense when you know damn well the answer is basically “that’s not happening, except in very very rare cases”?

I’m not mad, I don’t give a shit. I’m just tired of seeing obvious nonsense. Claiming that you can’t call 911 cause cops will be a cause of that is literally nonsense. That is the insinuation and you’re furthering it.

I know you know how threads work. There is context before that post. You should read it.

It means police officers [and I don’t know why I have to say this, but not 100% of all police officers] quite possibly could sit at polling places and harass people.

Cool since you admit it’s not 100%… Then call 911. My original statement doesn’t change. The Officers who aren’t part of the 0.01% that’s a problem can deal with it. Calling an 800 number will not change anything.

Edit: Maybe now with that curt response you can see how your statement could only be taken in such a way and why I responded why I did.

The FBI estimates that between 2,000 and 2,500 people entered the Capitol Building during the attack, some of whom participated in vandalism and looting, including in the offices of then-House speaker Nancy Pelosi and other Congress members.

So you think there’s only 2000 police officers in the USA? That 100% of them are at polling places harassing people and have a coverage of all polling places in America?

The fuck looney world are you all going on about? Your own source says

Nearly 30 sworn police officers from a dozen departments

Okay so at worst that’s 30 polling places. And somehow this is something to bring up like it’s going to be a statistical probability. This constant ACAB bullshit has infected you all and it’s disappointing.

30 out of 21000 polling places is not “quite possibly” get out of here.

Edit: There’s an estimated 900k police officers in the country. 30 did something you think is shitty, therefore the other 899.999k are also bad and will be there to make you regret voting and harass you! What a silly stupid argument.

The fuck relevance is that? Where do you think police are sitting at polling places harassing people?