How Riot Games is preventing the battle towards online game hackers

For so long as there have been video video games, there have been folks prepared to seek out methods to cheat. Hobbyists have lengthy devoted themselves to discovering vulnerabilities in video games, typically with the purpose of creating cheats that they may share or promote. But ever since on-line aggressive gaming turned a respectable career, that hobby-hacking has morphed into a complete trade that goals to promote an unfair benefit to these prepared to pay.

Developing and promoting online game cheats is usually a profitable enterprise, and online game builders have lately needed to beef up their anti-cheat groups, whose mission is to ban cheaters, neutralize the software program they use, in addition to go after cheat builders. More firms are taking the considerably controversial step of deploying anti-cheat methods that run on the kernel degree, which means they’ve the very best privileges within the working system and may probably monitor every part that occurs on the machine the sport is run on.

One of essentially the most outstanding kernel-level anti-cheat methods is Vanguard, developed by Riot Games, which makes common titles reminiscent of multiplayer on-line battle area recreation League of Legends and on-line first-person shooter Valorant. 

Essentially, Vanguard “forces cheats to be seen,” mentioned Phillip Koskinas, the director and head of anti-cheat at Riot who describes himself as “an anti-cheat artisan” who was “placed on this earth for the one singular goal of banning cheaters from on-line video video games.”. 

Thanks to Vanguard and the anti-cheat crew led by Koskinas,  Riot bans 1000’s of cheaters on Valorant daily, based on a chart shared with TechCrunch. 

Riot’s efforts appear to be working. As of early 2025, the proportion of Valorant “ranked” video games — which means aggressive matches — which have cheaters is now lower than 1% globally, the corporate says.

In an interview with TechCrunch, Koskinas detailed the varied methods that the anti-cheat crew at Riot makes use of to struggle cheaters and cheat builders: leveraging the security measures within the Windows working system, fingerprinting cheaters’ {hardware} to cease them from reoffending, infiltrating cheat communities, and taking part in psychological video games in an effort to discredit cheaters.

‘We can simply make them seem like fools’

Much of Koskinas and his crew’s efforts stem from Vanguard having the deepest degree of entry to a gamer’s pc. To weed out cheaters, Vanguard takes benefit of a number of the security measures already constructed into Windows. 

First, Koskinas defined, the anti-cheat software program “nearly universally” enforces a few of Windows’ most essential security measures, reminiscent of Trusted Platform Module, a hardware-based safety part, and Secure Boot. These two applied sciences examine if a pc has been modified or tampered with, reminiscent of by malware or a cheat, and prevents it from booting if that’s the case. Then, Vanguard checks that all the pc’s {hardware} drivers, which permit the working system to speak with the {hardware}, are updated to determine extra {hardware} that may allow dishonest. Finally, Vanguard prevents cheats from loading and executing code within the kernel’s reminiscence. 

“Basically, all of the security measures that Microsoft and {hardware} producers have leveraged to guard the working system, we use or implement,” Koskinas informed TechCrunch. “We must have a playground the place we will play. We must implement a sure degree of safety.”

But preventing cheaters isn’t just about expertise; it’s additionally about understanding the cheaters themselves and the way they function.

Koskinas’s crew has a “reconnaissance arm,” he mentioned, whose major duty is to acquire and catalog threats, which typically includes buying cheats. The crew obtains cheats partially by utilizing sock puppet identities which have infiltrated cheater and cheat developer communities for years, akin to undercover operations.

“We’ve even gone so far as giving anti-cheat info to ascertain credibility. We’ll masquerade as if it was one thing we [reverse engineered], and clarify how an anti-cheat method works to exhibit that we all know stuff,” mentioned Koskinas. “And then leverage our manner into one thing in improvement, after which sit there till it launches, enable it to accumulate customers after which ban everyone.” 

Some cheat builders attempt to keep undetected by solely promoting to a couple prospects, basically advertising their product as high-end, or “premium” cheats, as Koskinas calls them. These premium cheats can value 1000’s of {dollars}, and are bought to solely a handful of consumers, mentioned Koskinas.

Cheat makers use this technique to scale back the danger of promoting to a Riot undercover worker, but in addition to prospects who will probably be extra cautious about blatant dishonest and exposing the cheat.

These builders are basically promoting “the fame of being undetected,” mentioned Koskinas. One of Riot’s anti-cheat crew’s “strongest weapons,” he mentioned, is discrediting cheat builders publicly by, for instance, banning all their gamers, or leaking screenshots displaying they’re inside their Discord channels. 

“We can simply make them seem like fools,” he mentioned.

Koskinas and his crew additionally must watch out to not come down too onerous. By letting a bit dishonest occur, inside motive, Riot can decelerate players from getting higher cheats. “If we hit each participant each time, they’ll simply change cheats till they discover the one which isn’t detected,” he mentioned. 

“To preserve dishonest dumb, we ban slower,” he added.

To cease repeat offenders, Vanguard can “fingerprint” the {hardware} {that a} cheater makes use of — successfully uniquely figuring out their system — to make it more durable for that participant to acquire a brand new cheat and proceed dishonest.
In a extra psychological technique, Koskinas and his colleagues additionally troll cheaters publicly by calling them, amongst different issues, “a brainless pathogen,” who’ve an “lack of ability to get good at this online game.”

The cheater’s toolbox

Thanks to all these methods and techniques, most cheaters can now be roughly divided into two classes. The first, representing the vast majority of cheaters, is made up by those that are “rage dishonest” by utilizing low cost instruments which might be straightforward to detect. Riot workers sarcastically name these cheats “download-a-ban,” based on Koskinas. 

“A variety of cheaters, if you concentrate on it, they’re sort of younger,” he mentioned. “A variety of them haven’t grown up but. The manner they interact with video games is by dishonest, and quite a lot of that habits is like the facility you are feeling once you do it.”

“They’re going to return again, they’re going to get banned, they usually’re simply going to try this each weekend for the subsequent two to a few years… And then, ultimately they’ll hit puberty, and that’ll hopefully do,” Koskinas mentioned, smiling.

The second class includes these few who use premium cheats which might be more durable to detect. These instruments are generally known as “exterior” cheats, Koskinas explains, as a result of they depend upon utilizing precise {hardware}, not simply software program.

One kind of exterior cheat depends on a direct reminiscence entry (DMA) assault. DMA cheats require gamers to make use of specialised {hardware} — assume high-speed PCI Express playing cards — that exfiltrates all of Valorant‘s reminiscence to a separate pc that may scrutinize the sport on devoted {hardware}, exterior of the purview of Vanguard. 

By doing this, the cheater’s separate pc can be utilized to determine different gamers; in-game objects like partitions, ammunition and weapons; and determine exactly the place gamers and objects are within the map. This can even embrace objects that aren’t seen to players. Then, utilizing the firmware put in on the playing cards, the cheat creates a radar on a second display screen that they will take a look at to identify rival gamers — even when they’re hidden — to realize an unfair benefit.

A extra superior model of this sort of cheat, based on Koskinas, depends on HDMI fusers, which overlay what’s learn by the separate pc again on the cheater’s most important display screen. This manner, the cheater doesn’t must look between pc shows to see the place their opponents are, letting them concentrate on the show they’re taking part in the sport with. 

These methods enable the cheater to see via partitions — generally known as “wallhacks” — and grant what’s known as “extra-sensory notion,” basically superpowers throughout the recreation. 

“I feel we detect the vast majority of it at this time, but it surely’s sort of iterative,” mentioned Koskinas.

Then there are display screen reader cheats, the place a pc’s HDMI output is distributed to a second pc that detects and classifies what’s on the sport’s show, reminiscent of the pinnacle of an opponent participant. The second pc then sends again an instruction to an Arduino mini-computer for controlling robotics, for instance, which is linked to the cheater’s mouse and lets the participant mechanically purpose at different gamers — a sort of cheat generally known as an “aimbot.” As Koskinas put it, “principally the mouse, for all intents and functions, is being ruled by a machine.”

If the cheat performs nicely, it may be onerous to detect, however Koskinas mentioned that in the long term, the cheater “doesn’t seem like a human participant” due to how correct they’re aiming and capturing at their rivals.

“You must humanize [the cheat] to a level the place the benefit is imperceptible from what a human can do,” mentioned Koskinas. “And when you’re there, you’re probably not dishonest sufficient to make it value it for many customers.”

Even then, this system is common, Koskinas concedes. The draw back is that it requires a probably costly second PC with a quick graphics processor to shortly classify what’s occurring on the display screen and ship the directions again.

The way forward for dishonest

Koskinas says he typically worries about using AI for display screen classification, to be taught what human inputs seem like, and the best way to reproduce them. 

“That’s already right here,” he mentioned. “Especially in Valorant with these shiny outlines, you’ll be able to nearly do it with simply an algorithm […] You might simply truly discreetly say if the proportion of this field is sufficient purple, press the hearth key.” For context, characters in Valorant have distinct and vivid colour schemes.

Despite the safety and privateness dangers related to anti-cheat expertise having kernel-level entry, Riot has no plans to maneuver away from its strategy for its anti-cheat engine, at the least for Valorant. Otherwise, it could make it too straightforward for cheaters to make use of kernel exploits, based on Koskinas. 

In common, Koskinas is making an attempt to be extra clear about Riot’s anti-cheat efforts, together with publishing a number of weblog posts on how the corporate goes after cheaters, in addition to speaking to journalists. The thought, he mentioned, is that as a result of Riot has “essentially the most invasive anti-cheat by asking folks to have a service working always,” gamers need to understand how the corporate is utilizing that privilege.

“The smartest thing I really feel like we will do in asking for that degree of entry and being round like that, is being as clear in regards to the opacity as we will,” mentioned Koskinas. 

“We’re not telling you what’s beneath the hood, however we’ll let you know nearly the rest,” he mentioned.