If we define the rootkit as a kernel module, it literally says so on the first FAQ bullet point that they do not utilize a kernel module for the anticheat:
Does EAC Linux v2 use a kernel driver?
No. EAC Linux v2 does not install or load an anti-cheat kernel module. It uses security features already provided by the Linux kernel, together with an anti-cheat systemd service and eBPF programs.
While it sucks that you need to disable some linux features, according to them, you can just create a separate bootloader entry that disables kexec, enables the lockdown thing amongst other things. Certainly a compromise of inconveniencing the user to reboot if they want to play fortnite as opposed to creating a kernel module blob. We'll have to see if this implementation actually works in the real world.
It seems like a really solid design to have a low-level anticheat on Linux, and much preferred over dealing with how windows does it. I already restart anyway either on windows and enabling the services, or from Linux to windows if I want to play the game, it isn't much a loss if you want to play these sorts of games.
Yeah it's probably the best that they can come up (for now) with without upsetting the community with a kernel module that will probably be more intrusive. I do wonder though, if somehow a cheat dev manages to sign their cheat with a "well-known" key? What happens then?
realistically they're introducing the same driver exploit cat and mouse game Windows had with things like winring0 and cheaters will be able to exploit drivers from root to get kernel access for the next decade without even worrying about having a signature
88
u/jdog320 16h ago
If we define the rootkit as a kernel module, it literally says so on the first FAQ bullet point that they do not utilize a kernel module for the anticheat:
Does EAC Linux v2 use a kernel driver?
No. EAC Linux v2 does not install or load an anti-cheat kernel module. It uses security features already provided by the Linux kernel, together with an anti-cheat systemd service and eBPF programs.
While it sucks that you need to disable some linux features, according to them, you can just create a separate bootloader entry that disables kexec, enables the lockdown thing amongst other things. Certainly a compromise of inconveniencing the user to reboot if they want to play fortnite as opposed to creating a kernel module blob. We'll have to see if this implementation actually works in the real world.