The odds of this happening are so low, but at the same inevitable.

Funny. Sucks for the buyer.

Wow, that sucks. I don’t even know if you could get your money back for the CPU in that case, as the seller could just claim it wasn’t him. Doesn’t sound like Riot is being that cooperative in such cases either.

HWID bans usually involve a much larger fingerprint of the system hardware. Riot would have to be really big assholes not to revert the ban, if they were to snapshot the rest of his system and see that only the CPU was part of the original ban.

Riot would have to be really big assholes not to revert the ban,

So, yeah, that’s not getting reverted.

Claim that it isn’t fully functional (which it isn’t, for the buyer’s use case), and therefore not as described?

Sounds like FUD… I want to see it confirmed by someone reputable with an explanation before believing it.

What about this story to you is in any way implausible?

They’ve been hardware finger printing for years now. They one hundred percent know if you’re a piss drinking titty fucker just from your chipset.

Pfft, like they need my chipset for that

Their fingerprinting is flawed if this story is true. If I take someone else’s CPU and drop it into what is otherwise different hardware then the fingerprint should absolutely change. If it doesn’t then their fingerprinting is broken and this is going to happen whether any particular CPU has been banned or not.

It seems far more plausible that someone got themselves banned and they’re lying to try to get out of it.

Fingerprinting that is that hyperspecific is the one that’s actually flawed. If you could circumvent a hardware ban by rearranging your RAM sticks, it wouldn’t be much good.

As it is, the CPU is the one most stable, expensive, and difficult piece to replace, so it makes sense to ban on that alone.

But, I do agree that cheaters are really slimy fuckers, so what you’re saying is certainly possible. I remember a kid that had his grandmother bring his computer into the shop to see we could evade his hw ban, talked his grandmother into agrreing to buy him a new GPU right in front of us before we turned him down flat.

In this case they even had a completely different install of Windows. There is simply no way at all that the fingerprint should match. If it did match, then their implementation sucks. Fuck them if they made it that bad intentionally. Better to have to catch and ban the same person 10 times than ban an innocent person even once.

I can’t verify that each CPU has a unique id, the way a network card does (MAC address), but it might be a trade secret, who knows.

As far as banning innocent people, if the math is that one cheater drives away 100 honest players, it’s better to ban up to 99 honest players to get to that 1 cheater.

A CPU serial number or other ID is more unique than a MAC address, as those can be spoofed, and are not guaranteed to be unique, either. I heard one case of someone tearing their hair out over a mystery network issue, eventually discovering two NICs with the same MAC. And also the case of someone buying a whole pallet of NICs, which turned out to all have the same MAC address.

But I don’t think that math checks out. A player driven away might return, but a banned player can’t.

That pallet of NIC’s: oof! I thought there were complicated methods in place to assure that didn’t happen.

As for the math, cheating is a problem because it drives players away. Whatever the math is, there is a number of innocent players that could get swept up in a ban that would be acceptable if enough cheaters were also kicked out. I’m not talking morally, just the viability of an online game.

You’re not heard of hardware banning?

not op but surely Riot isn’t only looking at CPUs for hardware bans? That leads to all kinda of funky stuff like… well, this. Usually fingerprinting via hardware is a more complete package no?

If they are banning on a single piece of hardware such as a single CPU, then they are morons.

I mean, they are morons.

Send it to me, I consider a processor incapable of playing Valorant to be a free upgrade

valorant is the facebook of games. only boomers blithly ok with human right violations linked to the socials they use would think it is a good idea to stick with it

Happened to a coworker with CoD 2019+ with a Facebook marketplace rig. Was also not being smart, and after he got his account banned and not realizing what was going on, he got his brother to log into his account as a sort of test, and also got that account banned.

Dog shit AI slop games anyway

back then there was no AI like these, but otherwise yeah

COD hasn’t been good since Black Ops 2

That’s a whole lot of bullshit just to start a game. Pass.

I would be very interested to know how they are able to identify a specific CPU. The article speculates but does not answer this question.

The fact that this is even possible is a security nightmare.

OK, I've done a bit more digging and pieced it together. Acknowledgement to @dual_sport_dork for prompting me to try (again) to find a command that might do it among other things.

IMO, this sort of information shouldn't be in processors in the first place, but apparently it is there and needs admin/root access to, well, access it.

... and the game in question requires kernel-level anti-cheat, so of course, it has the necessary access.

The command for Linux is sudo dmidecode -t processor, which dumps a lot of info including an ID field, which is supposedly the CPU's specific identifier. It can be grepped for or otherwise filtered out.

My own Ryzen gives 8 hexadecimal pairs, so it's a 64-bit value.

I would not know that that was unique to my specific individual processor if I had not been told, but I'll assume that at least part of it is not unique between Ryzens of the same calibre. (I won't be posting any of it for comparison, for obvious reasons.)

So the upshot is, if you don't want to be identified right down to your CPU, don't run programs as root if there's any chance of them phoning home.

You can extract the chip’s serial number in software trivially. In Windows, from a commandline:

wmic cpu get pricessorid

I’m positive you can do the same with some Linux command, and failing that certainly with basically every vaguely modern benchmarking tool. Same deal with hard drives and probably also video cards. My BIOS/UEFI even enumerates all my connected hard drive serial numbers on screen if I interrupt its graphical boot screen.

Given that the anti-cheat schemes these competitive games are literal rootkits, I don’t think gathering the user’s hardware serial numbers in order to attempt identify them is much of a stretch.

You at least could in the past, I haven’t had to do it in a while. Seems like the command would just be “dmidecode”, with grep if you’re looking to automate it

I wonder if Riot would provide any info on the ban status of a certain component when given its ID…

They would not.

Anyone doing anti-cheat stuff tries to keep it as secret as possible, so that the cheaters have a more difficult time working around it.

It sounds like at least one cheater already figured it out. Just swap the chips. Then sell the old one used and pass the problem onto someone else.

From the article, it tracks and blacklists other major system components too, so you would essentially have to replace most of your system. Probably the entire thing, since a single leftover bad component would lead to your entire new system being added to the blacklist.

That actually explains why they do not want linux users,I could just modify my OS to not give the right IDs Welp, Unless they made their thingy from scratch instead of using a system component which at that point idk how you would approach it

This has been a thing for decades

Either I knew and forgot, or misunderstood it as CPU family identification whenever I've come across it. Denial is also a possibility. We'll see if I remember this in a month or two.

Running proprietary programs as root is my definition of hell, especially when it’s something frivolous like a game

This is not running it as root (i.e. privileged userland, still ring 3), this is running it as ring 0 (i.e. the level that the kernel runs at, with no restrictions on access to memory and hardware at all). A tiny bug in ring 0 code can take down the system or open security vulnerabilities, where the kernel can provide more hardening to protect applications to an extent.

You could say this is the inner circle of hell.

Question is, what happens if you don’t have dmidecode installed? Even more interesting, what happens if you’ve replaced it with a fake that spews back values of your choosing? If they’re bundling it, given that it appears to be GPL2, they’re opening themselves to a lawsuit unless they provide source upon request.

(Somehow, I don’t think they’re actually using dmidecode.)

dmidecode is a tool for reading loads of platform registers, it is obviously not the only way to do it, or even the intended way really. Riot has almost certainly implemented the functionality from scratch in their anticheat, it’s a relatively trivial thing to do.

What I've read just now is what I'd deliberately not gone looking for up to this point in case I found this out.

Linux and Windows happen to require that the executables that access that information be run with root privileges, but it looks like that's merely an affectation.

It seems that any old piece of software, without root or other privileges, can independently run the CPUID instruction that obtains a processor's serial number.

I do not like this one bit.

Why not? Is that information considered sensitive? Personally I tend to avoid running untrustworthy programs outside of a sandbox or VM.

Are you a believer in the idea "They who have nothing to hide have nothing to fear"? Hint: You shouldn't be.

And do you know for certain that your sandboxes and VMs don't simply pass through the CPUID instruction? And if they don't, do they rotate their fake CPUIDs? And how often does that happen?

Personally I tend to avoid running untrustworthy programs outside of a sandbox or VM.

what does that mean? are you not running any programs at all? you cannot know just by looking at the name if a program reads such sensitive info. and its not unlikely that some developer figured it would be a good idea to include it in automatic crash reports

yes, this is sensitive information. its like your fingerprint, you cannot change it. I think its quite obvious. web browsers firefox is fighting to hide more and more that even indirectly could lead to identification. websites can’t read this ID, this is just a comparison.

you cannot know just by looking at the name if a program reads such sensitive info.

I can know from the code ;P

have you ever used Gentoo? if you do, you know how long it takes to build updated software from source code.

vetting all that, even just the changes would take a lot more time. and it’s a constant effort.

Never used gentoo but i do build the software i use often

vetting all that, even just the changes would take a lot more time. and it’s a constant effort.

First of all, I am, like you and everyone else not alone in this, and for changes it’s sooo easy thanks to Git

yes, git is a godsend. but who will you trust that they checked the new code, and found nothing bad? different people have different expectations too.

Idk about other peoples, i usually do this with friends so idk

Supposedly only the pentium III returns serial info with CPUID though, and even then it can be disabled in the bios.

What’s wrong with this website. I don’t see the button “reject”. I’m not gonna accept whatever that is just to read this.

I finally found it, it’s like 300 pages of individual rejections you need to go. Hard pass.

uBlock is your friend.

I have uBlock origin, it blocked 5 resources on load but it didn’t prevent the “With our Pur subscription you can use heise.de without tracking, external banner and video advertising for €4.95 / month” popup.

You can use uBlock to snap the banner out of existence (it has a mode to delete elements from a website)

I just tried blocking elements one by one this way, and after 3-4 containers it’s done, but there is no way to scroll the page. It’s not that different from using devtools inspector, but when hacking sites that way, I usually can get scroll working. Either way, it’s too much effort to read an article you’re not even sure is really that valuable.

Usually there is just one element on the trasparent background you can delete

This is so dumb. as if there was no reasonable way to detect cheating without these super invasive anti-cheat monstrocities.

Meanwhile I play(ed) on a VM and would frequently have to fight with support over: no, fuck you - unban me. Virtual hardware isn’t a valid reason to ban every few months. It worked. It was bothersome - so I quit playing. Ample free time for games that weren’t user hostile.

I’m surprised the kernel anticheat didn’t autoban you right away starting the game

Slightly different time and I was using some methods that made it more difficult to determine it waa a VM. Purely guessing - but based on timing it seemed like I wasnt over a threshold - so manual review was used and that wasn’t as fast or frequent.

Ah classic Riot games, investing all the money in anti-cheat while their launcher lacks basic functions like “download throttling”.

No idea how Steam keeps winning…

I just quit gaming. I refuse to be a beta. I don’t give a fuck no more. After Holocaust 2.0 these types of things bring me no joy. Grow up

Holocaust 2.0?

Also, I use one criteria for defining an adult:

“An adult is a person who understands when it is apropriate to be childish”

Just telling others to “Grow up” means that you have a lot of growing up to do yourself.

This is why kernel level anti cheat and every variant of it include the tpm ones should be discouraged. Performance Hits are huge too in case of denuvo

Those things are completely unrelated to this.

I would think that pulling hardware ID values would be an administration level task, requiring root or kernel level access. So yes they are related or at least should be.

The article says because he installed the chip and launched Valorant, his other PC components such as his motherboard are not also blocked.

He can’t play a Riot game unless he buys an entirely new computer.

It says the ban is only 4 months

not a big cookie eater so no thx

Phillip Koskinas, Riot’s Head of Anti-Cheat, writes on X that hardware bans last for a maximum of four months and apply exclusively to the game in which a cheater was caught.

Now we have a name. He probably thinks he is doing the Lord’s work with kernel-level anticheat, and we should all be grateful for his awesome contributions to gaming 🤣

Oh, something about a game that doesn’t work on Linux. What are the most direct competitors to Valorant that work on Linux? I’m gonna go play those out of spite.

CS2, if you don’t mind the kind of people that play online its a fun game.

The latest big CS2 update broke the shader caching on my Arch box. It’s been almost unplayable for the last couple of weeks.

To be honest I’ve never found the mechanics in Counter-Strike games enjoyable. Not trying to hate, I’m sure it’s great for those who like it, I just don’t think it’s for me.

I think the two pvp fps games I’ve found to have the closest to ideal mechanics is Doom 2016, and Red Eclipse 2. In Doom I liked that it had some of the more Call of Duty-esque features like loadouts, and a multiplayer progression system. And I especially liked how the actual combat preserved that classic arena shooter feel in kind of an brilliant way. They made it so right click had that iron sights feature, but which also applied a secondary fire ability - but crucially it was entirely optional for basically every weapon. Like in classic arena shooters you could be in constant motion and shoot from the hip without any penalties to your aiming.

Red Eclipse does this too (plus has crazy parkour features), but last I checked lacks any kind of progression system for better and worse.

Titanfall 2 is pretty fun as well, but I am really bad at that game in multiplayer.

Even if I’d ever switched back to Windows, no kernel anti-cheat would ever be allowed without some kind of isolation. It is just another data theft tool that happens to also include half-broken anti-cheat. I’m sure gaming companies have already started selling data for profit.