By /robex/, August 2024. Back to Articles and Guides
The following post will address some of my concerns and thoughts about third-party client-sided anticheat solutions, in particular the L4D2Center anticheat (AC from now on) that will soon be mandatory in order to play. Since the intended audience is pretty much any L4D2Center player who is (rightfully) concerned about the security of running the AC on their computer, I will try to keep the post as non-technical as possible so everyone can understand, without losing too much accuracy.
By definition, anticheat software that runs on the client is pretty much indistinguishable from malware, at least from an antivirus point of view. It scans your filesystem, it is heavily obfuscated to prevent people from figuring its behavior out, it sends data back to an external server, and it must be invasive to stop (or detect) cheat makers from doing things like process injection, hooking, network packet manipulation, and so on.
In the particular case of L4D2, the entire problem stems from the lack of a properly updated AC from Valve themselves. As an example, the lack of well implemented integrity checks for game files leads to easy, undetectable abuse in the form of tampering with sound files, loading addons that give you unfair advantages, and more.
Since server-sided anticheats can only go so far, as they only have access to the data that the server has, the only 3 real options left are:
When it comes to popular anticheat solutions such as VAC, Easy Anti-Cheat, BattleEye, Vanguard and others, these solutions are created by or together with the developers of the game. Without becoming too paranoid, if the developers of these games wanted to run malicious code on my computer, they could do it in the game executables themselves, so from that point of view the extra step of running their own AC program does not add that much of an attack surface (kernel-level ACs aside).
Some of these companies also have verifiable people behind them who are liable to privacy laws such as GDPR in the EU, and subject to fines or other penalties. While this does not stop potential privacy violations, it definitely creates a bit more trust in users than some program developed by a "random", anonymous, unaccountable person.
The biggest issue in the case of L4D2Center players (or any third-party AC users, really) is that unless you are a programmer with access to the anticheat source code, and you understand it and build it yourself, you have no way of telling what is actually running on your computer. And obviously, publishing the source code would defeat the purpose of the AC, since a determined cheater with the right knowledge could simply modify it and remove all detection methods.
Like many things in life, in the end it comes down to whether or not you trust the developer of the AC. Are their intentions legitimate, or do they have some malicious objective beyond stopping cheaters? Nonetheless, putting all negativity aside, is there anything we can do to make things more trustworthy? In my opinion, yes.
In the world of software development, there exists the concept of reproducible builds. In short, the way programs are made is by transforming source code (readable text) into an executable (what the player would run on their computer) via compilation. What a reproducible build does is it ensures that the same source code is always transformed into the same executable.
And how does this help us? A reproducible build allows for verifiable, independent review of the behavior of the program. You could have a few trusted members of the community, from all sorts of backgrounds, review the source code and verify that there is no malicious code embedded in it. And since the final executable is guaranteed to have come from said source code, there is no possibility that it has been tampered with in the process of distribution to the final users (in this case, the players).
This does not solve all problems, but it creates a shared trust between multiple independent people instead of centralizing it all into the same person, making the addition of malicious behavior into the AC much less likely to go uncaught. The next problem to solve, is deciding who these trusted reviewers will be. And that is not up to me :), perhaps a community vote would be the choice here. And you have to keep in mind that reviewing the source code after every update of the AC is pretty time consuming for the reviewers, whose time is probably rather valuable.
Another issue to solve is that players who are new to the community will not have trust in anyone at the beginning, so why should it matter to them that the AC has been reviewed by xx_super_trustworthy_xx_admin if they do not know who this person is? This is likely to stop new players from flowing into the site, as the requirement of the AC will be too high of a barrier to entry. So, to address this, I will propose a few mitigations in the next section.
Beyond what was discussed in the last section, here are some other compromises that could be made in order to prevent the playerbase from decreasing or stagnating:
TL;DR:
Unfortunately, there is no good solution for a third-party AC that does not involve a bit of blind trust, however, with the right measures in place the risk of malicious behavior slipping into the AC software can be considerably reduced.
I also want to point out that I have not gone into many other topics here such as: do we really need the AC in the first place, what does it do exactly, antivirus detections, code signing the executable, how to actually verify the executable via its hash, and so on. I wanted to keep this post purely about trusting and running the AC in a more generalized way.