Kernel Level Anti-Cheats

Kernel-level anti-cheat (KLAC) is a subset of anti-cheat dedicated towards running above the user level. These types of anti-cheat, such as Easy Anticheat (EAC), have grown in popularity among large developers for their online multiplayer games. Alongside this rise in popularity is increasing concern from both consumers regarding their privacy with the use of this software, and from security professionals who recognize the significant risks of kernel-level software being breached.

How it works

Kernel level anti-cheats run at the kernel level; the deepest and most authoritative level of the computer. In layman's terms, this essentially means the software is capable of tracking every process occurring on a computer, and additionally exhibit control if necessary. Alternatives to kernel level anticheat include user level anticheat which runs as a standard process on the player's machine, and server side anticheat which leaves the user's machine untouched and solely operates on the game's servers.

The arms race between hacking and anticheat software has seen hackers better able to circumvent user level anticheat in recent years, pushing more anticheat developers to demand kernel access from players and more developers to require use of a kernel anticheat to access their games.

Consumer impact summary

Privacy concerns

Kernel-level anti-cheat has access to every process that runs on a computer, from a simple video running in the background, to processes that may be more private for the user. As this software is designed to run on startup, this means even if the intended game the software was installed for is not currently running, it retains the capability to track the user's behaviors. This can range from gathering data that could be sold to advertisers to, if the software itself is hijacked by a malicious actor, the harvesting of sensitive personal information.

Security concerns

As kernel-level software holds the highest authorization on the hardware of a user, this is favorable towards malicious actors.

If a malicious actor was to discover a security issue in a kernel level anti-cheat significant enough to allow them to hijack the software, they would be able to directly execute code at its level of access, allowing them to bypass security measures put in place by the operating system and anti-virus software.

This is not a purely hypothetical scenario; it has already taken place in an incident with the popular gacha co-op adventure Genshin Impact, where the game's anti-cheat 'mhyprot2.sys' was hijacked by malicious actors to disable users' anti-virus software, with the intent of distributing ransomware.

Another perfect example is Hotta Studios' Tower of Fantasy game. Users have reported that the kernel-level anticheat 'ksophon_x64.sys' has caused BSOD along with the DPC_WATCHDOG_VIOLATION. This incident occurs when the game is uninstalled, launched, closed, or even running before the new publisher Perfect World Games. As of now, since the update by the company, the file doesn't appear to exist in System32/drivers.

Support issues

Due to the nature of GNU/Linux-based operating systems, many KLACs end up becoming incompatible. Some have been aiming to fix this via compatibility layers under Proton or WINE, but due to how popular KLACs communicate with the system to verify integrity on the kernel level, it fails to work with Linux. As such, games that cannot have their anticheat function fully will entirely refuse to launch, even if it can be used for offline purposes.

In some instances, KLAC can be so aggressive towards Linux, that it refuses to launch even in a virtual machine, like with Rockstar Games' Grand Theft Auto V running BattlEye Anticheat, which has been known to explicitly block Linux users, or Epic Games' Fortnite.

For the game Diabotical, the developers explicitly ban users running Linux from playing the online-only game, citing their Linux anticheat being too weak.

Further reading

• EA has a history of using anti-cheats such as EAC, and recently switched to an in-house developed kernel-level anti-cheat.
• Rockstar's Grand Theft Auto V moved to Kernel Level Anti-Cheats, and in the process, additionally blocked Linux users from being able to play its online components.
• Hoyoverse's Genshin Impact has used a kernel-level anti-cheat since launch.
• Riot Games' Valorant uses an in house kernel-level anticheat called Vanguard
• Kuro Games' Wuthering Waves uses a kernel-level anticheat called ACE (Anti-Cheat Expert) since launch.
• Hotta Studios' Tower of Fantasy's history of kernel-level anticheat caused BSOD and would stay even after uninstalling the game.
• Ubisoft uses BattlEye kernel-level anticheat for Rainbow Six: Siege which prevents Linux gamers from launching it even after paying for it.
• Arrowhead Game Studios' Helldivers 2 uses a kernel-level anticheat called nProtect GameGuard.