Players who install Valorant, the new first-person shooter from Riot, also add to their computer an anti-cheat system that activates whenever they boot up their computer. It’s practically always on, which caused quite a stir within the gaming community after being discovered yesterday.
A Riot rep tells Kotaku that their anti-cheat system, called Riot Vanguard, needs this depth of access to stop aggressive cheaters, but some players insist the program goes overboard with its coverage.
“You have a piece of software that can’t be turned off, that runs with elevated privileges non-stop on your system,” one of the Reddit users who first called attention to the issue wrote. “Let’s say the anti-cheat gets compromised tomorrow, you won’t know that your computer is exposed and it won’t update until you start the game.”
Riot’s anti-cheat lead Paul “RiotArkem” Chamberlain responded to these concerns on the Valorant subreddit, telling concerned players that Vanguard was functioning as intended. This is very different than common anti-cheat programs like Fortnite’s EasyAntiCheat, which is only active when the game is active. A common way to bypass such measures is to activate cheats before loading the anti-cheat program and even utilizing exploits that tamper with the anti-cheat directly as it turns on, Chamberlain said. Riot claims that having Vanguard boot up with players’ computers was the best way to prevent these tactics.
“The anti-cheat driver itself is only one small component of Vanguard,” Chamberlain told Kotaku via email, expanding on the answer he gave on the Valorant subreddit. “We’ve also built a new backend that allows us to be more specific with our anti-cheat checks, instead of running the same security scans on all computers, we can run checks in response to player reports, or other suspicious behavior which allows us to reduce the frequency and intensity of scans on the majority of players’ computers.”
Another sticking point players have with Vanguard is that it’s given administrator-level privileges on their machines, further opening the possibility for malicious attacks should a shady person or persons compromise the anti-cheat system. Chamberlain again said this wasn’t an issue since most computer programs, especially anti-cheat software, are given that level of access. One way to think of Vanguard, he continued, is as a “very specialized antivirus program that only protects Valorant.”
“All of Vanguard has been audited for security weaknesses by external audit firms as well as our internal security team, with a particular emphasis being placed on the kernel component,” Chamberlain explained. “We’ve built it on a principle of ‘least privilege,’ where the driver has as few features and does as few things as possible. For example, the driver does not communicate with the internet or collect any information. All functions that can be done outside of the driver context are done by non-driver components. This reduces the attack surface of the driver making it less likely that security vulnerabilities exist.”
That said, it’s hard to verify these claims about Vanguard from the outside looking in. Players are simply being asked to trust Riot. Vanguard will also prevent players from using any modifications, even innocent cosmetic changes. The official line from Riot is that they are open to changing their anti-cheat measures in the future should players continue to find issue with them.
“We invite players who are unsure to observe our actions and call us out if they don’t like what they see,” Chamberlain said. “We think most players will appreciate our efforts but if they don’t then we’ll change tactics and find another way to meet our player’s expectations.”