David Gerard frames analysis as cheat guide on Mastodon
3 Yesterday 7:45 AM · 1d ago · 2 posts · 17 comments · 3 sources · development 3 of 3
David Gerard amplified the analysis on Mastodon with framing suggesting it shows Linux users how to bypass the anticheat to play Fortnite, characterizing EAC2 as a rootkit.
“There have been many attempts to do remote attestation, going back to the mid 2000's. Variations like NAC, SoH, trusted computing, etc. All of these attempts failed. Why? Because you're asking a potentially compromised system if it's compromised.”
alandekok, Lobsters commenter · lobsters ↗
Matthew Garrett Security researcherEpic Games Game publisher / anticheat developer
The whole story postscomments the bright band is this development · numbered dots are the others · click one to jump
What people said 23 voices · verbatim
-
D
if you really *must* play Fortnite on Linux, here's how to bypass Epic's EAC2 rootkit https:// codon.org.uk/~mjg59/blog/p/epi cs-eac2-v2-seems-fairly-easily-bypassable/
-
I'm not sure that's correct? There's a significant difference between announcing a new product, and describing how that product is likely ineffective
-
I suspect that they will end up only allowing fTPMs built into CPUs. Most CPUs already have that anyway (from what I can find, Intel has it since Skylake, which is 10 years old, and AMD since Zen 1). I don’t buy the argument that cheaters would avoid spending 20$ or so on an external TPM when they already spend more than that on cheating tools. I…
-
From what I'm told by friends who work in the gaming industry, there are hardcore cheaters that hook into the HDMI and USB via an external computer. Assuming this hearsay is viable, I don't think you can really prevent dedicated cheaters while keeping the games playable.
-
I'm half wondering if the UI could be better/amended so we could tag "related stories" but not outright merge them. Basically not as vague as the same tag, but not as close as "3 people writing about the same thing in the span of one week". Although this one is tricky. It's timely, and it's a direct response. I think the mods tend to merge those?
-
Each TPM needs a chain-of-certification for its key, so presumably you require that the chain is rooted in a CPU manufacturer key and not on-board chip manufacturer key. I think exotic x86 CPU manufacturers don't pass the official performance requirements anyway…
-
There have been many attempts to do remote attestation, going back to the mid 2000's. Variations like NAC, SoH, trusted computing, etc. All of these attempts failed. Why? Because you're asking a potentially compromised system if it's compromised. That can't end well. TPMs help a bit, as you get at least the promise that a private key isn't being…
-
Android typically uses a hardware root-of-trust inside the SoC, accessible to TrustZone but not to Android or anything in the "non-secure" world, for attestation. The bootloader informs TrustZone of whether it's unlocked before running any unsigned code, and that's included in subsequent attestation quotes. So there's no architectural weakness…
-
I would guess that having to buy a cheat dongle will stop a fair chunk of potential cheaters, but obviously not the determined ones. Perhaps a large enough chunk to not ruin the game for everyone else, and instead just make the high score boards (or whatever games these days use for clout) useless?
-
from the minimial research I’ve done into this they usually use a direct memory access card over pcie that can inspect the memory of the game and then they can use an overlay box to layer a ui over the hdmi output. USB hid injection isn’t too bad either you just need a microcontroller with two usb interfaces. There was a project about a year ago…
-
The simple and universal answer is: anticheat requires forcing the computer to act in a way that the user doesn't want, and Linux is very good at keeping the user in control.
-
An IOMMU (so, VT-d on x86) will stop the DMA based attacks. Injecting input is harder to detect, but in theory you could do heuristics on the USB devices.
-
Note that "a second computer processing the video feed" is also what a Twitch stream looks like on a technical level
-
This doesn't seem to be Linux/EAC2 specific - people have been doing similar external TPM hacks to get anti-cheats running on VMs. I specifically didn't use the word "bypass", because all you're doing here is satisfying the anti-cheat's requirements. Also, usually when you get banned on these systems, the private "unextractable" key on your TPM…
-
Much harder, I expect. I _suspect_, but don't know, that play integrity only accepts measurements with an endorsement key associated with a [play protect certified manufacturer](https://www.android.com/certified/partners/), so you can't just use a PC TPM with an SPI over USB adapter. So now you have to find a phone (or at least TPM chip, to use…
-
No, a virtual TPM wouldn't be trusted. Physical TPMs include trusted keys: AMD has the Secure Processor, Intel has the On-Die Certificate Authority. Going back a few years, the TPM used to be on the motherboard - not the CPU. Keys from those vendors are usually trusted too.
-
Same way you validate that you're using an actual TPM and not some random private key you came up with, you whitelist the vendor's Endorsement Key.
-
I think it's a bit of an arms race. Cheating both creating solutions to do so and actually doing so can make money. So I wouldn't be surprised if that arms race will go on for a long time, because you can essentially always create something closer to a robot that ends up better than humans. In the majority of situations you don't even need AI for…
-
As I posted on another [comment](https://lobste.rs/c/d8q5bf), I don't think that's going to happen, because it would mean that used CPUs could have perma banned internal TPMs and be forever unusable with these anti-cheat systems, even after changing owners. While I see a future where used CPUs on ebay are listed as "AMD Ryzen 5600X | No Vanguard…
-
They can make bans longer than a week but not by too much, and maybe per-game, and with elevated risk signal afterwards, and immediately for other games? And an old/active/good-standing account would be a risk-reducing signal.
-
“Install a custom kernel and short the reset pin to ground” feels pretty sophisticated for an anti-cheat bypass. Is it possible to package all of this into a virtual machine that emulates the relevant hardware?
-
Yes, but you still need to pass it a real TPM via passthrough. In the past you could get a certified vTPM from Microsoft is you were using HyperV, but I'm not sure if that's still a thing.
-
Is there a way to identify if a TPM is external or fTPM?
All 3 developments of Security researcher details vulnerabilities in Epic's EAC2… →
Hacker NewsMastodonLobsters