'

Valorant's anti-cheat software runs at system startup

'The Vanguard driver does not collect or send any information' - Claims Riot

Valorant's anti-cheat software runs at system startup - should you be worried?

Valorant's anti-cheat software runs at system startup - should you be worried?

Over the weekend, Valorant's early PC players have discovered that the game runs a kernel anti-cheat driver called vgs.sys whenever the player's computer is turned on, not when Valorant itself if booted. 

This means that Valorant players are expected to be running Riot's anti-cheating tool, even when they aren't playing Valorant, raising concerns regarding that vgs.sys does, and whether or not the tool sends data to Riot if Valorant isn't being played. 

Anti-Chinese sentiments have also been running wild, as Riot, the games studio behind Valorant, is wholly owned by Tencent, a high profile Chinese game publisher. It has been alleged that vgs.sys could be used to wrongfully access system data and offload unnecessary information to Riot/Tencent. Thankfully, Riot has commented on this issue to set the record straight. 

On the Valorant subreddit, Riot's RiotArkem has vgk.sys is running as intended, allowing Riot to prevent cheaters from getting into its game by enabling its anti-cheat technology at system startup. Cheaters often work around existing anti-cheating measures by activating, and hiding, their cheats before anti-cheating software can be enabled. Valorant's tools activate when the player's PC boots, preventing this method of attack. 

Riot has confirmed that Valorant's Vanguard driver can be uninstalled by selecting "Riot Vanguard" in "add/remove programs" through Windows and that the tool "does not collect any information from your computer or communicate over the network at all".  Even so, we can see some PC gamers being unhappy that this tool is always running, despite Riot's response to this issue. 

Valorant's Riot Vanguard driver has been reviewed by several external security teams to ensure that the tool introduces no flaws into the systems that it is installed on. Below is what Riot's RiotArkem had to say regarding Valorant's vgs.sys anti-cheat tool.  

 

    TL;DR Yes we run a driver at system startup, it doesn't scan anything (unless the game is running), it's designed to take up as few system resources as possible and it doesn't communicate to our servers. You can remove it at anytime.

Vanguard contains a driver component called vgk.sys (similar to other anti-cheat systems), it's the reason why a reboot is required after installing. Vanguard doesn't consider the computer trusted unless the Vanguard driver is loaded at system startup (this part is less common for anti-cheat systems).

This is good for stopping cheaters because a common way to bypass anti-cheat systems is to load cheats before the anti-cheat system starts and either modify system components to contain the cheat or to have the cheat tamper with the anti-cheat system as it loads. Running the driver at system startup time makes this significantly more difficult.

We've tried to be very careful with the security of the driver. We've had multiple external security research teams review it for flaws (we don't want to accidentally decrease the security of the computer like other anti-cheat drivers have done in the past). We're also following a least-privilege approach to the driver where the driver component does as little as possible preferring to let the non-driver component do the majority of work (also the non-driver component doesn't run unless the game is running).

The Vanguard driver does not collect or send any information about your computer back to us. Any cheat detection scans will be run by the non-driver component only when the game is running.

The Vanguard driver can be uninstalled at any time (it'll be "Riot Vanguard" in Add/Remove programs) and the driver component does not collect any information from your computer or communicate over the network at all.

We think this is an important tool in our fight against cheaters but the important part is that we're here so that players can have a good experience with Valorant and if our security tools do more harm than good we will remove them (and try something else). For now we think a run-at-boot time driver is the right choice.

Valorant's anti-cheat software runs at system startup - should you be worried?  

You can join the discussion on Valorant's anti-cheat software running at system startup on the OC3D Forums

«Prev 1 Next»

Most Recent Comments

14-04-2020, 01:51:09

looz
Interesting how they mention external audits but with no mention of the companies involved, so we essentially have to take Riot's and only Riot's word for it.
That's not how it works, at least when you value your customers.
In addition it should be mentioned that Riot is owned by Tencent, which has close ties to the Chinese government.
That being said, I'll probably still play this a fair bit, but I'm getting a bit anxious about all the separate privileged anti cheats at this rate and might move back to only using Windows for gaming.Quote

14-04-2020, 02:40:34

Dicehunter
Quote:
Originally Posted by looz View Post
Interesting how they mention external audits but with no mention of the companies involved, so we essentially have to take Riot's and only Riot's word for it.
That's not how it works, at least when you value your customers.
In addition it should be mentioned that Riot is owned by Tencent, which has close ties to the Chinese government.
That being said, I'll probably still play this a fair bit, but I'm getting a bit anxious about all the separate privileged anti cheats at this rate and might move back to only using Windows for gaming.

Going to be giving this game a hard miss then Quote

14-04-2020, 02:48:17

ImprovizoR
Call me a silly sausage, but I tend to avoid installing rootkits on my PC. That's just me though.Quote

14-04-2020, 04:57:29

Avet
I am 100% on Linux now (I will be making a post about it soon) so I don't care. I will be making a dual boot Windows and use it just for games like you would use a console. I will probably suspend all purchases through Windows clients and do them via the browser on Linux. They can spy on my Steam library as much as they want.Quote
Reply
x

Register for the OC3D Newsletter

Subscribing to the OC3D newsletter will keep you up-to-date on the latest technology reviews, competitions and goings-on at Overclock3D. We won't share your email address with ANYONE, and we will only email you with updates on site news, reviews, and competitions and you can unsubscribe easily at any time.

Simply enter your name and email address into the box below and be sure to click on the links in the confirmation emails that will arrive in your e-mail shortly after to complete the registration.

If you run into any problems, just drop us a message on the forums.