Vanguard, the controversial anti-cheat software initially attached to Valorant, is now also coming to League of Legends.
Summary:
The article discusses Riot Games’ requirement for players to install their Vanguard anti-cheat software, which runs at the kernel level, in order to play their games such as League of Legends and Valorant. The software aims to combat cheating by scanning for known vulnerabilities and blocking them, as well as monitoring for suspicious activity while the game is being played. However, the use of kernel-level software raises concerns about privacy and security, as it grants the company complete access to users’ devices.
The article highlights that Riot Games is owned by Tencent, a Chinese tech giant that has been involved in censorship and surveillance activities in China. This raises concerns that Vanguard could potentially be used for similar purposes, such as monitoring players’ activity and restricting free speech in-game.
Ultimately, the decision to install Vanguard rests with players, but the article urges caution and encourages players to consider the potential risks and implications before doing so.
I’m wondering if there’s a way we can even know they’re installing it. Windows just gives that generic admin prompt, I imagine? Tells you nothing of what’s happening.
Well if you get asked for sudo, then that’s a risk.
Installing almost anything* on Windows requires the equivalent of sudo, same as Linux.
Determining if it’s a normal install or adding a kernel driver wouldn’t be feasible just by watching the installation. (On either OS if they are not showing terminal output)
EDIT:
My context here (which I should have been explicit about sooner) is: “ordinary user is installing a closed source commercial large game” (with its own installer) and doesn’t know if they are also getting a free rootkit.
They are going to just click Next without changing defaults, and are not going to extract and inspect anything.
You can list all the current loaded drivers. You can examine the system event log for service start operations. You can run with a kernel debugger attached and examine any loaded driver. The driver itself is likely correctly signed and will not require additional user acknowledgement beyond what was given when the game was installed.
Unfortunately all of those just tell you it’s already installed, not that it’s about to install it. If you didn’t know, who’s going to be constantly checking for new drivers after every software install?
It would probably show up in Autoruns. Maybe even with a background service.
Kernel level drivers would not be in auto run.
What, why not?
Ask Microsoft