Anti-cheat runs at root level and always launches at boot until uninstalled.
If video game cheaters had an enemies list, number one would probably be…well Epic Games for actually taking cheaters to court. But in a close second you would find Riot Games for their heavy anti-cheat measures.
Riot’s latest title Valorant is in closed beta and you know what that means; cheaters are already starting to build the programs they will sell to salty manchildren to pay $40/month to cheat at a free to play game. But Valorant has deep anti-cheating measures, one that installs itself at root level and can not be turned off or superceded by cheats (for now).
A Riot employee has commented on the situation on Reddit, noting that the program does not collect information, does not send any information, and the majority of the work is handled by the non-driver component which does not run unless the game is running.
Still the driver does have some worried about the potential for malicious parties to take advantage of the driver’s root level access in order to distribute malware. If the driver becomes the epicenter for a security incident, it is a PR time bomb waiting to explode. It also can’t be ignored that Riot Games is wholly owned by Chinese publisher Tencent which is bound to generate conspiracies and distrust in sectors of the gaming community.
MMO Fallout recommends (and I’m sure Riot does too) that if you have serious security concerns over such anti-cheat programs, that you simply do not install Valorant. The entire statement has been republished below for your convenience.
Source: Reddit
TL;DR Yes we run a driver at system startup, it doesn’t scan anything (unless the game is running), it’s designed to take up as few system resources as possible and it doesn’t communicate to our servers. You can remove it at anytime.
Vanguard contains a driver component called vgk.sys (similar to other anti-cheat systems), it’s the reason why a reboot is required after installing. Vanguard doesn’t consider the computer trusted unless the Vanguard driver is loaded at system startup (this part is less common for anti-cheat systems).
This is good for stopping cheaters because a common way to bypass anti-cheat systems is to load cheats before the anti-cheat system starts and either modify system components to contain the cheat or to have the cheat tamper with the anti-cheat system as it loads. Running the driver at system startup time makes this significantly more difficult.
We’ve tried to be very careful with the security of the driver. We’ve had multiple external security research teams review it for flaws (we don’t want to accidentally decrease the security of the computer like other anti-cheat drivers have done in the past). We’re also following a least-privilege approach to the driver where the driver component does as little as possible preferring to let the non-driver component do the majority of work (also the non-driver component doesn’t run unless the game is running).
The Vanguard driver does not collect or send any information about your computer back to us. Any cheat detection scans will be run by the non-driver component only when the game is running.
The Vanguard driver can be uninstalled at any time (it’ll be “Riot Vanguard” in Add/Remove programs) and the driver component does not collect any information from your computer or communicate over the network at all.
We think this is an important tool in our fight against cheaters but the important part is that we’re here so that players can have a good experience with Valorant and if our security tools do more harm than good we will remove them (and try something else). For now we think a run-at-boot time driver is the right choice.
MMO Fallout 