Security researcher details vulnerabilities in Epic's EAC2 v2 Linux anticheat
Matthew Garrett's analysis shows Epic's TPM-based approach to prevent cheating can be bypassed with hardware modifications costing ~$20.
What to know
- Matthew Garrett detailed multiple technical pathways to bypass EAC2 v2's TPM-based anticheat on Linux, from physically resetting TPMs on desktop boards to using external USB TPM modules with modified kernels.
- The core weakness: remote attestation fundamentally struggles on consumer PCs where a single TPM cannot be securely bound to a specific system, unlike enterprise environments.
- Practical barriers exist—Garrett estimates ~$20 in hardware costs for the bypass—but technical commenters debate whether this cost threshold will actually deter determined cheaters already investing in cheat tools.
- The debate reveals a deeper architectural tension on Linux: preventing cheating requires kernel-level control that conflicts with Linux's design philosophy of keeping users in control of their own systems.
The dispute Whether the vulnerabilities represent fundamental flaws in remote attestation on consumer PCs (unfixable without restricting user control) versus engineering challenges Epic can address by restricting TPM acceptance to CPU-integrated versions. · positions read across 27 posts and comments
EAC2 v2 has fundamental architectural weaknesses that cannot be fixed without restricting user control.
-
“There have been many attempts to do remote attestation… All of these attempts failed. Why? Because you're asking a potentially compromised system if it's compromised.”
alandekok · Lobsters ↗
Epic can likely mitigate the vulnerabilities by restricting TPM acceptance to CPU-integrated versions and using hardware attestation roots.
-
“I suspect that they will end up only allowing fTPMs built into CPUs. Most CPUs already have that anyway… I don't buy the argument that cheaters would avoid spending 20$ or so on an external TPM when they already spend more than that on…”
pta2002 · Lobsters ↗
The $20 hardware cost and technical sophistication required will effectively deter most cheaters, even if not determined ones.
-
“I would guess that having to buy a cheat dongle will stop a fair chunk of potential cheaters, but obviously not the determined ones.”
m_eiman · Lobsters ↗
Dedicated cheaters already use sophisticated methods (DMA cards, external computers processing video) that make any single-layer anticheat ineffective.
-
“There are hardcore cheaters that hook into the HDMI and USB via an external computer. Assuming this hearsay is viable, I don't think you can really prevent dedicated cheaters while keeping the games playable.”
orib · Lobsters ↗
Matthew Garrett Security researcherEpic Games Game publisher / anticheat developer
How it unfolded 3 developments, newest first · click a bar or a number to jump postscomments
-
3
David Gerard frames analysis as cheat guide on Mastodon
David Gerard amplified the analysis on Mastodon with framing suggesting it shows Linux users how to bypass the anticheat to play Fortnite, characterizing EAC2 as a rootkit.
“There have been many attempts to do remote attestation, going back to the mid 2000's. Variations like NAC, SoH, trusted computing, etc. All of these attempts failed. Why? Because you're asking a potentially compromised system if it's compromised.”
— alandekok, Lobsters commenter · source -
D
if you really *must* play Fortnite on Linux, here's how to bypass Epic's EAC2 rootkit https:// codon.org.uk/~mjg59/blog/p/epi cs-eac2-v2-seems-fairly-easily-bypassable/
2 more of the top 3 · 23 posts in this stretch
-
I'm not sure that's correct? There's a significant difference between announcing a new product, and describing how that product is likely ineffective
-
I suspect that they will end up only allowing fTPMs built into CPUs. Most CPUs already have that anyway (from what I can find, Intel has it since Skylake, which is 10 years old, and AMD since Zen 1). I don’t buy the argument that cheaters would avoid spending 20$ or so on an external TPM when they already spend more than that on cheating tools. I…
-
-
2
Lobsters discussion begins on technical feasibility and implications
The Hacker News and Lobsters communities engaged in detailed technical discussion about the bypass methods, the costs and sophistication required, and whether the vulnerabilities represent fundamental architectural problems with remote attestation on consumer PCs.
-
Awesome. I wonder if something similar could work for play integrity on Android.
1 more of the top 2 · 3 posts in this stretch
-
I spent a long while looking at why anti-cheat was a difficult problem on Linux and this is one of the conclusions I came to too (not an expert).
-
-
1
Matthew Garrett publishes technical analysis of EAC2 v2 vulnerabilities
Security researcher Matthew Garrett posted a detailed blog post explaining how Epic's new Easy Anti-Cheat v2 for Linux uses eBPF monitoring, secure boot, measured boot, and TPM remote attestation to prevent cheating, then systematically describes multiple ways each layer could be bypassed.
“I'm not especially impressed by Epic's EACv2 approach…”
— mjg59@nondeterministic.computer -
M
Another blog post! I'm not especially impressed by Epic's EACv2 approach: https:// codon.org.uk/~mjg59/blog/p/epi cs-eac2-v2-seems-fairly-easily-bypassable/
-
What people are saying 17 voices from 1 site · best of 27 · verbatim
- Can Epic effectively restrict TPM acceptance to CPU-integrated versions without impacting legitimate users?
- Will a $20 hardware cost barrier actually deter cheaters who already invest significantly in cheat tools and subscriptions?
- Is any form of anticheat truly viable on Linux given the OS philosophy of user control over the system?
- Today
-
They can make bans longer than a week but not by too much, and maybe per-game, and with elevated risk signal afterwards, and immediately for other games? And an old/active/good-standing account would be a risk-reducing signal.
-
I think it's a bit of an arms race. Cheating both creating solutions to do so and actually doing so can make money. So I wouldn't be surprised if that arms race will go on for a long time, because you can essentially always create something closer to a robot that ends up better than humans. In the majority of situations you don't even need AI for…
-
As I posted on another [comment](https://lobste.rs/c/d8q5bf), I don't think that's going to happen, because it would mean that used CPUs could have perma banned internal TPMs and be forever unusable with these anti-cheat systems, even after changing owners. While I see a future where used CPUs on ebay are listed as "AMD Ryzen 5600X | No Vanguard…
-
This doesn't seem to be Linux/EAC2 specific - people have been doing similar external TPM hacks to get anti-cheats running on VMs. I specifically didn't use the word "bypass", because all you're doing here is satisfying the anti-cheat's requirements. Also, usually when you get banned on these systems, the private "unextractable" key on your TPM…
- Yesterday
-
Note that "a second computer processing the video feed" is also what a Twitch stream looks like on a technical level
-
No, a virtual TPM wouldn't be trusted. Physical TPMs include trusted keys: AMD has the Secure Processor, Intel has the On-Die Certificate Authority. Going back a few years, the TPM used to be on the motherboard - not the CPU. Keys from those vendors are usually trusted too.
-
The simple and universal answer is: anticheat requires forcing the computer to act in a way that the user doesn't want, and Linux is very good at keeping the user in control.
-
Android typically uses a hardware root-of-trust inside the SoC, accessible to TrustZone but not to Android or anything in the "non-secure" world, for attestation. The bootloader informs TrustZone of whether it's unlocked before running any unsigned code, and that's included in subsequent attestation quotes. So there's no architectural weakness…
-
Much harder, I expect. I _suspect_, but don't know, that play integrity only accepts measurements with an endorsement key associated with a [play protect certified manufacturer](https://www.android.com/certified/partners/), so you can't just use a PC TPM with an SPI over USB adapter. So now you have to find a phone (or at least TPM chip, to use…
-
An IOMMU (so, VT-d on x86) will stop the DMA based attacks. Injecting input is harder to detect, but in theory you could do heuristics on the USB devices.
-
from the minimial research I’ve done into this they usually use a direct memory access card over pcie that can inspect the memory of the game and then they can use an overlay box to layer a ui over the hdmi output. USB hid injection isn’t too bad either you just need a microcontroller with two usb interfaces. There was a project about a year ago…
-
“Install a custom kernel and short the reset pin to ground” feels pretty sophisticated for an anti-cheat bypass. Is it possible to package all of this into a virtual machine that emulates the relevant hardware?
-
From what I'm told by friends who work in the gaming industry, there are hardcore cheaters that hook into the HDMI and USB via an external computer. Assuming this hearsay is viable, I don't think you can really prevent dedicated cheaters while keeping the games playable.
-
I'm half wondering if the UI could be better/amended so we could tag "related stories" but not outright merge them. Basically not as vague as the same tag, but not as close as "3 people writing about the same thing in the span of one week". Although this one is tricky. It's timely, and it's a direct response. I think the mods tend to merge those?
-
Same way you validate that you're using an actual TPM and not some random private key you came up with, you whitelist the vendor's Endorsement Key.
-
Each TPM needs a chain-of-certification for its key, so presumably you require that the chain is rooted in a CPU manufacturer key and not on-board chip manufacturer key. I think exotic x86 CPU manufacturers don't pass the official performance requirements anyway…
-
I would guess that having to buy a cheat dongle will stop a fair chunk of potential cheaters, but obviously not the determined ones. Perhaps a large enough chunk to not ruin the game for everyone else, and instead just make the high score boards (or whatever games these days use for clout) useless?