Why giving games the keys to your PC is a cyber security nightmare.
If you are a Linux user or spend most of your evenings on a Steam Deck, you know the pain. You buy a game, boot it up, and get slapped with a connection error. Why? Because the game's anti-cheat doesn't like your operating system. We saw this massive drama unfold recently when Rockstar dropped Linux support for GTA Online, and EA completely blocked Steam Deck players from Apex Legends.
Before we get into the weeds, make sure to listen to our podcast episode on this exact topic! The player is embedded just below. Don't forget to drop a like, leave a comment, and share it with your mates.
The friction between Linux and modern games isn't just about lazy developers. It is a fundamental clash of philosophies. Game studios want total control over your machine to catch cheaters. Linux, by design, refuses to give up that control.
Let's break down why this is happening and why you should care.
The Keys to the Castle: Ring 0 vs Ring 3
To understand the mess we are in, you need to understand privilege rings.
Imagine your computer is a massive office block. Your everyday applications like your web browser, Discord, and your video games run in Ring 3 (user mode). They sit in the lobby. If they want to use the webcam, read a file, or talk to the graphics card, they have to ask the front desk (the operating system) for permission. If they crash, no big deal, you just restart the app.
Ring 0, however, is the vault. This is the kernel level. Code running here has absolute, unrestricted access to the entire system. It doesn't ask for permission; it gives the orders. Naturally, the only things that should be in Ring 0 are your operating system and essential hardware drivers.
But nowadays, anti-cheat software like Riot's Vanguard, Call of Duty's Ricochet, and kernel-level Easy Anti-Cheat demand to live in Ring 0. They operate as rootkits. Giving a video game kernel access is like giving a stranger the master keys to your house, hoping they only check the living room for cheaters. They can monitor every single thing your PC does, even when the game is closed.
A Cyber Security Nightmare
Publishers claim this extreme intrusion is the only way to stop modern cheats. But stuffing unnecessary software into the kernel is a massive cyber security risk.
Remember the CrowdStrike fiasco in 2024? A tiny bug in a kernel-level security driver blue-screened millions of Windows PCs worldwide, taking out airlines and banks. If a complex anti-cheat driver has a coding error, it takes your entire system down with it.
But it gets much darker. Threat actors have already figured out how to use these gaming drivers for cyber attacks. The most famous case involved mhyprot2.sys, the kernel driver for Genshin Impact. Ransomware gangs realised this driver was digitally signed and trusted by Windows. They started dropping this driver onto corporate networks—computers that never even had the game installed—and used its kernel privileges to terminate the companies' antivirus software before encrypting everything.
This is exactly why Linux rejects these systems. The open-source nature of Linux means you can't just forcefully inject a closed-source, proprietary rootkit into the kernel and expect the community to be okay with it. You own your PC, not the game publisher.
Valve Doing the Heavy Lifting
The only reason Linux gaming is thriving today is Valve. Through Proton, the compatibility layer powering the Steam Deck, Valve has performed miracles.
They sat down with the developers of Easy Anti-Cheat (EAC) and BattlEye and helped them build Ring 3 (user-mode) versions of their software that work perfectly on Linux. Enabling it is literally a few clicks in a developer portal. Games like Elden Ring run flawlessly because of this. But when companies like EA or Rockstar refuse to tick that box, it's a political choice, not a technical hurdle.
Valve is also pushing the Linux kernel forward. Windows games rely on specific sync tools that Linux doesn't have. For years, we relied on clever hacks like Esync. But recently, a driver called NTSYNC, written by CodeWeavers engineer Elizabeth Figura, was merged directly into the official Linux 6.14 kernel. This translates Windows sync calls natively inside the Linux kernel, boosting frame rates massively without compromising security.
AI: The Real Solution
Forcing gamers to install rootkits is a lazy, dangerous band-aid. The future of anti-cheat lies on the server, not the client.
Instead of scanning your RAM to find cheat files, developers are leaning into machine learning to analyse player behaviour. Systems like Valve's VACnet 3.0 run entirely server-side. AI models crunch the telemetry of how you play. It looks at your mouse movements, reaction times, and crosshair placement.
If a cheater uses a hardware-based cheat (like a DMA card) that is completely invisible to a kernel anti-cheat, the server-side AI will still catch them. It will flag that their crosshair movements are physically impossible for a human hand. The beauty of this? It detects cheats perfectly without needing to spy on your local files.
Final Thoughts
The war between Linux and kernel anti-cheats is a battle over digital ownership. Is playing a few rounds of a free game worth sacrificing the security and privacy of your entire operating system?
Linux will not compromise its core security principles. As the Steam Deck continues to grab market share, publishers will eventually have to adapt. Whether that means server-side AI or new hardware checks like TPM 2.0, the industry needs to move away from rootkits. Until then, stay safe, and support the games that respect your system.
Comments
Post a Comment