Riot Games solved the problem of why Valorant's anti-cheat software always runs in the background.
In the past few days, a controversy has been brewing Brave community. All this is related to the game's anti-cheat technology Vanguard.
Players in the beta version found that the anti-fraud software will start immediately after you start the PC, and you can continue to run in the background even if you do n’t play Valorant. After initially worrying that this might affect the performance of other games or cause unpredictable conflicts, players were warned that there might be a bigger problem.
It turns out that Vanguard has a kernel driver component designed to run in Ring 0 (the highest level of access provided by Windows) in the Windows kernel. The software running in Ring 0 has unrestricted administrator-level access, which allows it to scan files and make changes without the user ’s knowledge.
In this case, regardless of restarting the game, Vanguard's driver will receive these privileges as soon as it is restarted.
Of course, if you are no longer interested in playing Valorant, you can uninstall the anti-cheat tool. However, this idea of increasing access rights stopped many people in the Valorant community. On the one hand, even if it is assumed that Riot is not malicious, violations may expose everyone who installs the driver to risk, and they may not even know it.
In response, Paul "RiotArkem" Chamberlain of Riot explained that boot-level drivers are necessary to combat fraud that must be booted before cheating to avoid detection. He also revealed that the driver will remain dormant unless the game is running-it will not scan any files or send anything back to Riot.
Chamberlain wrote: "We have always been careful about driver safety."
"We already have multiple external security research teams to review it (we do n’t want to accidentally reduce the security of the computer like other anti-cheat drivers in the past). We also adopted a least-privileged approach to drivers, where Components perform as few operations as possible, and prefer to let non-driver components do most of the work (non-driver components will not run unless the game is running.)
Chamberlain emphasized that all cheating scans are performed by another part of Vanguard (not the driver). This component is only activated when the game is running, adding that this is "an important tool for us against fraudsters."
With this in mind, Chamberlain revealed that Riot ’s intention was not to make these tools do more harm than good, and if it turned out that they could indeed be deleted. However, at present, Valorant's anti-cheat technology will continue to start with Windows.
