Now that players are getting stuck into the closed beta for Valorant, Riot Games’ upcoming multiplayer shooter, some have been taking a closer look at how its anti-cheat system works – and raising some questions about why it seemingly loads as your PC starts, rather than when the game launches. However, Riot’s now explained how and why the system works like this – and it’s primarily to do with preventing players loading cheats before the anti-cheat system kicks in.
Programmer and anti-cheat lead for Valorant, Paul ‘Riot Arkem Chamberlain has replied to a post on this topic on Reddit, confirming: “Yes we run a driver at system startup”, but explaining it “doesn’t scan anything (unless the game is running)”. It’s “designed to take up as few system resources as possible and it doesn’t communicate to our servers,” he adds. “You can remove it at anytime.”
Vanguard, the FPS game’s anti-cheat system, “contains a driver component called vgk.sys (similar to other anti-cheat systems),” the dev explains, which is “the reason why a reboot is required after installing”. Basically, the system doesn’t trust a PC unless the Vanguard driver “is loaded at system startup”, a part which he adds is “less common for anti-cheat systems”.
This is a good way of “stopping cheaters”, the post continues, “because a common way to bypass anti-cheat systems is to load cheats before the anti-cheat system starts and either modify system components to contain the cheat or to have the cheat tamper with the anti-cheat system as it loads. Running the driver at system startup time makes this significantly more difficult.”
Riot has “tried to be very careful with the security of the driver”, according to the post, bringing in “multiple external security research teams” to take a good look at it for any flaws that could cause problems, such as “accidentally decreas[ing] the security of the computer”. The studio has also taken a “least-privilege approach” towards the anti-cheat system’s driver, which means the non-driver does “the majority of work” and doesn’t actually run unless Valorant itself is running.
Well it sucks, but today we had to ban our first cheater (and it looks like more bans are on the horizon).
I was hoping for a little more time before this fight kicked off but we're in it now and we're ready.
— Paul Chamberlain (@arkem) April 9, 2020
“The Vanguard driver does not collect or send any information about your computer back to us. Any cheat detection scans will be run by the non-driver component only when the game is running,” Chamberlain explains, adding the Vanguard driver can be uninstalled from your PC “at any time”.
At this time, Riot says it believes this is “an important tool in our fight against cheaters” but positive player experience is also a key consideration. The studio explains that if its “security tools do more harm than good, we will remove them (and try something else). For now we think a run-at-boot time driver is the right choice.”
