Multiplayer games on PC faced significant challenges back in 2020. Developers struggled to combat rampant cheating as gaming surged during COVID-19 lockdowns. Popular titles like Call of Duty: Warzone, PUBG, and Destiny 2 were infested with users employing aimbots and wallhacks to gain an unfair advantage.
Riot Games’ Valorant distinguished itself with its controversial yet effective anti-cheat system, Vanguard, which has proven to be a formidable barrier against cheaters. Four years later, Vanguard stands out as a leader in the fight against PC cheating.
“We don’t see as many of the cheats that try to function on the machine and get access,” Phillip Koskinas, director of anti-cheat for Valorant, said in an interview with The Verge. “That has just become too much of a chore for cheat developers.”
Vanguard’s approach has significantly complicated the use of cheats like aimbots and wallhacks. This is largely attributed to a kernel-level driver that remains active after system boot. Nick “Everdox” Peterson, a key developer at Riot, created mechanisms within Vanguard that detect unauthorized cheat engine accesses. “He came up with a fairly novel way to know that something has been mapped into kernel memory that isn’t supposed to be there,” Koskinas noted. “The method is so clever that I can’t share the details because it might allow cheaters to adapt too quickly.”
The detection method reportedly resembles how hardware manufacturers void warranties when devices are modified, signaling that something unauthorized has occurred. “Once that’s done, we know that something happened and then we just wait to see something occur on Valorant that confirms you’re using it for cheating,” Koskinas explained.
This effectiveness has driven cheaters to develop more sophisticated hardware solutions. A common method now involves direct memory access (DMA) using specialized hardware to bypass traditional anti-cheat systems. “You’re basically using a PCIe card to request reads of physical memory,” Koskinas described. “Techniques have evolved with these cards, the most prevalent being Squirrel, which conducts traditional memory scanning externally.”
This process entails utilizing a secondary PC that scans the memory of Valorant, allowing cheaters to access player locations through an external radar display. This form of cheating is particularly damaging in Valorant, where strategic positioning and stealth are crucial to gameplay.
Riot has developed effective methods to counter this new generation of hardware-level DMA cheating. Peterson’s innovations block access attempts by suspicious devices to internal memory. For instance, there was a recent incident where Vanguard blocked my network card when I launched Valorant, highlighting how rigorously Vanguard protects the game. The issue was resolved quickly, demonstrating its proactive measures.
Currently, the majority of cheats in Valorant consist of triggerbots, which use screen readers for automatic firing when enemies are detected within a player’s crosshair, accounting for “about 80 percent” of current cheat types.
Moreover, the integration of Vanguard into League of Legends has also significantly decreased scripting cheats, with over 175,000 accounts banned due to cheating since Vanguard’s launch.
While these developments are promising for Valorant and League, the outlook is less favorable for developers relying on their anti-cheat systems. A recent study from the University of Birmingham found that cheats for Call of Duty: Warzone are still both accessible and cost-effective, pointing to challenges faced by Activision’s Ricochet anti-cheat system in combating sophisticated cheats.
“Ricochet has talented individuals on the team, but they clearly do not have enough funding or freedom,” stated zebleer, a developer associated with one of the popular cheat engines for games like Call of Duty and Overwatch 2. “Call of Duty is overrun with cheaters. They are implementing quick fixes rather than addressing the root issues, likely due to limitations set by Activision.”
Zebleer believes that Vanguard’s success is attributable to Riot’s substantial investment in their anti-cheat team, capable of hiring experienced engineers—including individuals with prior experience developing cheat technologies, like Koskinas.
Unsurprisingly, researchers at the University of Birmingham have concluded that Valorant boasts the most effective anti-cheat system, followed by Fortnite, while games like Counter-Strike 2 and Battlefield 1 underperform in this area.
Additionally, the study pointed out vulnerabilities in Windows protections that allow cheat software to infiltrate the kernel, posing substantial security risks. In light of recent cybersecurity incidents, discussions around Windows kernel access are becoming increasingly relevant as Microsoft seeks to fortify protections.
“Microsoft has become more proactive about revoking certificates for malicious drivers,” Koskinas remarked. “We aim to align with Windows’ security measures, so if they mandate enhancements like virtualization-based security or hypervisor code integrity, we will utilize those features to offer enhanced protection.”
In an upcoming shift, Vanguard will only activate when the game launches, contingent on users having the latest Windows 11 security features, addressing privacy concerns tied to the driver being always active.
For now, Riot’s anti-cheat focus remains on Windows, with no plans for launching support on Linux for Valorant or League of Legends, stemming from the inherent kernel manipulation capabilities in Linux systems that complicate cheating prevention.
“You could easily create a Linux distribution tailored for cheating, and we would struggle to combat it,” Koskinas emphasized.
This sentiment is echoed by other developers; Respawn has ceased support for Apex Legends for similar reasons, while Epic Games opts out of Fortnite on platforms like Steam Deck due to a limited user base.
As Riot successfully addresses traditional cheating, rising concerns revolve around AI-powered cheats. Innovations like MSI’s gaming monitors have emerged, assisting players in gaining advantages during gameplay. “Image reading technology poses a significant threat moving forward,” Koskinas cautioned. “We’ve invested in understanding human input but are wary of the direction AI advancements are taking.”
A potential future could see a continuous battle between AI-based cheating technologies and detection methods, leading to a complex back-and-forth in this ongoing struggle for fairness in competitive gaming. “Currently, Valorant is ahead in this war, but the disparity presented by AI could alter the landscape significantly,” Koskinas concluded.
Of Legends. However, Koskinas has acknowledged the growing demand for cross-platform functionality, indicating that Riot is actively evaluating its options for the future.
As cheating in competitive online games continues to evolve, proactive measures like Riot’s Vanguard serve as a case study for others in the industry. Ensuring fair play not only enhances user experience but also builds trust within game communities, which is crucial for long-term success.
Moving forward, constant adaptation is necessary for anti-cheat systems to keep pace with new cheating techniques. The collaboration between developers and security experts will be vital in fortifying defenses and safeguarding the integrity of online gaming.
Ultimately, as game developers like Riot Games showcase effective countermeasures, remaining diligent against evolving cheating methods will define the future landscape of competitive gaming.