How Riot Games is fighting the war against video game hackers

For so long as there have been video video games, there have been individuals prepared to seek out methods to cheat. Hobbyists have lengthy devoted themselves to discovering vulnerabilities in video games, typically with the objective of growing cheats that they may share or promote. However ever since on-line aggressive gaming turned a official occupation, that hobby-hacking has morphed into a complete business that goals to promote an unfair benefit to these prepared to pay.

Growing and promoting online game cheats can be a lucrative business, and online game builders have lately needed to beef up their anti-cheat groups, whose mission is to ban cheaters, neutralize the software program they use, in addition to go after cheat builders. More companies are taking the somewhat controversial step of deploying anti-cheat methods that run on the kernel stage, which means they’ve the very best privileges within the working system and might doubtlessly monitor all the things that occurs on the machine the sport is run on.

One of the distinguished kernel-level anti-cheat methods is Vanguard, developed by Riot Video games, which makes popular titles similar to multiplayer on-line battle area sport League of Legends and on-line first-person shooter Valorant. 

Primarily, Vanguard “forces cheats to be visible,” mentioned Phillip Koskinas, the director and head of anti-cheat at Riot who describes himself as “an anti-cheat artisan” who was “put on this earth for the one singular purpose of banning cheaters from online video games.”. 

Because of Vanguard and the anti-cheat group led by Koskinas,  Riot bans hundreds of cheaters on Valorant day by day, based on a chart shared with TechCrunch. 

Riot’s efforts appear to be working. As of early 2025, the share of Valorant “ranked” video games — which means aggressive matches — which have cheaters is now lower than 1% globally, the company says.

In an interview with TechCrunch, Koskinas detailed the assorted methods that the anti-cheat group at Riot makes use of to struggle cheaters and cheat builders: leveraging the security measures within the Home windows working system, fingerprinting cheaters’ {hardware} to cease them from reoffending, infiltrating cheat communities, and enjoying psychological video games in an effort to discredit cheaters.

‘We can just make them look like fools’

A lot of Koskinas and his group’s efforts stem from Vanguard having the deepest stage of entry to a gamer’s pc. To weed out cheaters, Vanguard takes benefit of a few of the security measures already constructed into Home windows. 

First, Koskinas defined, the anti-cheat software program “almost universally” enforces a few of Home windows’ most vital security measures, similar to Trusted Platform Module, a hardware-based safety part, and Secure Boot. These two applied sciences examine if a pc has been modified or tampered with, similar to by malware or a cheat, and prevents it from booting if that’s the case. Then, Vanguard checks that the entire pc’s {hardware} drivers, which permit the working system to speak with the {hardware}, are updated to establish extra {hardware} that may allow dishonest. Lastly, Vanguard prevents cheats from loading and executing code within the kernel’s reminiscence. 

“Basically, all the security features that Microsoft and hardware manufacturers have leveraged to protect the operating system, we use or enforce,” Koskinas informed TechCrunch. “We have to have a playground where we can play. We have to enforce a certain level of security.”

However combating cheaters is not only about expertise; it’s additionally about understanding the cheaters themselves and the way they function.

Koskinas’s group has a “reconnaissance arm,” he mentioned, whose major accountability is to acquire and catalog threats, which generally entails buying cheats. The group obtains cheats partially by utilizing sock puppet identities which have infiltrated cheater and cheat developer communities for years, akin to undercover operations.

“We’ve even gone as far as giving anti-cheat information to establish credibility. We’ll masquerade as though it was something we [reverse engineered], and explain how an anti-cheat technique works to demonstrate that we know stuff,” mentioned Koskinas. “And then leverage our way into something in development, and then sit there until it launches, allow it to acquire users and then ban everybody.” 

Some cheat builders attempt to keep undetected by solely promoting to a couple prospects, basically advertising their product as high-end, or “premium” cheats, as Koskinas calls them. These premium cheats can price hundreds of {dollars}, and are bought to solely a handful of shoppers, mentioned Koskinas.

Cheat makers use this technique to scale back the danger of promoting to a Riot undercover worker, but in addition to prospects who will probably be extra cautious about blatant dishonest and exposing the cheat.

These builders are basically promoting “the reputation of being undetected,” mentioned Koskinas. One among Riot’s anti-cheat group’s “strongest weapons,” he mentioned, is discrediting cheat builders publicly by, for instance, banning all their gamers, or leaking screenshots exhibiting they’re inside their Discord channels. 

“We can just make them look like fools,” he mentioned.

Koskinas and his group additionally must watch out to not come down too exhausting. By letting a bit dishonest occur, inside cause, Riot can decelerate players from getting higher cheats. “If we hit every player every time, they will just change cheats until they find the one that isn’t detected,” he mentioned. 

“To keep cheating dumb, we ban slower,” he added.

To cease repeat offenders, Vanguard can “fingerprint” the {hardware} {that a} cheater makes use of — successfully uniquely figuring out their system — to make it tougher for that participant to acquire a brand new cheat and proceed dishonest.
In a extra psychological technique, Koskinas and his colleagues additionally troll cheaters publicly by calling them, amongst different issues, “a brainless pathogen,” who’ve an “inability to get good at this video game.”

The cheater’s toolbox

Because of all these strategies and techniques, most cheaters can now be roughly divided into two classes. The primary, representing nearly all of cheaters, is made up by those that are “rage cheating” by utilizing low cost instruments which are simple to detect. Riot staff sarcastically name these cheats “download-a-ban,” based on Koskinas. 

“A lot of cheaters, if you think about it, they’re kind of young,” he mentioned. “A lot of them haven’t grown up yet. The way they engage with games is by cheating, and a lot of that behavior is like the power you feel when you do it.”

“They’re going to come back, they’re going to get banned, and they’re just going to do that every weekend for the next two to three years… And then, eventually they’ll hit puberty, and that’ll hopefully do,” Koskinas mentioned, smiling.

The second class contains these few who use premium cheats which are tougher to detect. These instruments are referred to as “external” cheats, Koskinas explains, as a result of they depend upon utilizing precise {hardware}, not simply software program.

One sort of exterior cheat depends on a direct reminiscence entry (DMA) assault. DMA cheats require gamers to make use of specialised {hardware} — assume high-speed PCI Express cards — that exfiltrates all of Valorant‘s reminiscence to a separate pc that may scrutinize the sport on devoted {hardware}, outdoors of the purview of Vanguard. 

By doing this, the cheater’s separate pc can be utilized to establish different gamers; in-game objects like partitions, ammunition and weapons; and establish exactly the place gamers and objects are within the map. This will additionally embody objects that aren’t seen to players. Then, utilizing the firmware put in on the playing cards, the cheat creates a radar on a second display screen that they will have a look at to identify rival gamers — even when they’re hidden — to achieve an unfair benefit.

A extra superior model of any such cheat, based on Koskinas, depends on HDMI fusers, which overlay what’s learn by the separate pc again on the cheater’s foremost display screen. This fashion, the cheater doesn’t must look between pc shows to see the place their opponents are, letting them deal with the show they’re enjoying the sport with. 

These strategies enable the cheater to see by means of partitions — referred to as “wallhacks” — and grant what’s known as “extra-sensory perception,” basically superpowers inside the sport. 

“I think we detect the majority of it today, but it’s kind of iterative,” mentioned Koskinas.

Then there are display screen reader cheats, the place a pc’s HDMI output is distributed to a second pc that detects and classifies what’s on the sport’s show, similar to the top of an opponent participant. The second pc then sends again an instruction to an Arduino mini-computer for controlling robotics, for instance, which is linked to the cheater’s mouse and lets the participant mechanically goal at different gamers — a kind of cheat referred to as an “aimbot.” As Koskinas put it, “basically the mouse, for all intents and purposes, is being governed by a machine.”

If the cheat performs effectively, it may be exhausting to detect, however Koskinas mentioned that in the long term, the cheater “doesn’t look like a human player” due to how correct they’re aiming and capturing at their rivals.

“You have to humanize [the cheat] to a degree where the advantage is imperceptible from what a human can do,” mentioned Koskinas. “And once you’re there, you’re not really cheating enough to make it worth it for most users.”

Even then, this system is well-liked, Koskinas concedes. The draw back is that it requires a doubtlessly costly second PC with a quick graphics processor to shortly classify what’s taking place on the display screen and ship the directions again.

The way forward for dishonest

Koskinas says he typically worries about using AI for display screen classification, to be taught what human inputs seem like, and reproduce them. 

“That’s already here,” he mentioned. “Especially in Valorant with those bright outlines, you can almost do it with just an algorithm […] You could just actually discreetly say if the percentage of this box is enough purple, press the fire key.” For context, characters in Valorant have distinct and vivid color schemes.

Regardless of the safety and privateness dangers related to anti-cheat expertise having kernel-level entry, Riot has no plans to maneuver away from its method for its anti-cheat engine, at the very least for Valorant. In any other case, it might make it too simple for cheaters to make use of kernel exploits, based on Koskinas. 

Basically, Koskinas is attempting to be extra clear about Riot’s anti-cheat efforts, together with publishing several blog posts on how the corporate goes after cheaters, in addition to speaking to journalists. The concept, he mentioned, is that as a result of Riot has “the most invasive anti-cheat by asking people to have a service running at all times,” gamers need to understand how the corporate is utilizing that privilege.

“The best thing I feel like we can do in asking for that level of access and being around like that, is being as transparent about the opacity as we can,” mentioned Koskinas. 

“We’re not telling you what’s under the hood, but we’ll tell you almost anything else,” he mentioned.