How Riot Games is fighting the war against video game hackers

For so long as there have been video video games, there have been individuals keen to seek out methods to cheat. Hobbyists have lengthy devoted themselves to discovering vulnerabilities in video games, typically with the aim of creating cheats that they might share or promote. However ever since on-line aggressive gaming turned a reputable career, that hobby-hacking has morphed into a whole business that goals to promote an unfair benefit to these keen to pay.

Growing and promoting online game cheats can be a lucrative business, and online game builders have lately needed to beef up their anti-cheat groups, whose mission is to ban cheaters, neutralize the software program they use, in addition to go after cheat builders. More companies are taking the somewhat controversial step of deploying anti-cheat programs that run on the kernel level, that means they’ve the best privileges within the working system and may doubtlessly monitor the whole lot that occurs on the machine the sport is run on.

One of the vital outstanding kernel-level anti-cheat programs is Vanguard, developed by Riot Video games, which makes popular titles equivalent to multiplayer on-line battle area sport League of Legends and on-line first-person shooter Valorant. 

Primarily, Vanguard “forces cheats to be seen,” mentioned Phillip Koskinas, the director and head of anti-cheat at Riot who describes himself as “an anti-cheat artisan” who was “placed on this earth for the one singular goal of banning cheaters from on-line video video games.”. 

Because of Vanguard and the anti-cheat crew led by Koskinas,  Riot bans hundreds of cheaters on Valorant every single day, based on a chart shared with TechCrunch. 

Riot’s efforts appear to be working. As of early 2025, the share of Valorant “ranked” video games — that means aggressive matches — which have cheaters is now lower than 1% globally, the company says.

In an interview with TechCrunch, Koskinas detailed the assorted methods that the anti-cheat crew at Riot makes use of to battle cheaters and cheat builders: leveraging the safety features within the Home windows working system, fingerprinting cheaters’ {hardware} to cease them from reoffending, infiltrating cheat communities, and enjoying psychological video games in an effort to discredit cheaters.

‘We are able to simply make them appear like fools’

A lot of Koskinas and his crew’s efforts stem from Vanguard having the deepest degree of entry to a gamer’s pc. To weed out cheaters, Vanguard takes benefit of a few of the safety features already constructed into Home windows. 

First, Koskinas defined, the anti-cheat software program “virtually universally” enforces a few of Home windows’ most necessary safety features, equivalent to Trusted Platform Module, a hardware-based safety element, and Secure Boot. These two applied sciences test if a pc has been modified or tampered with, equivalent to by malware or a cheat, and prevents it from booting if that’s the case. Then, Vanguard checks that the entire pc’s {hardware} drivers, which permit the working system to speak with the {hardware}, are updated to establish extra {hardware} that may allow dishonest. Lastly, Vanguard prevents cheats from loading and executing code within the kernel’s reminiscence. 

“Principally, all of the safety features that Microsoft and {hardware} producers have leveraged to guard the working system, we use or implement,” Koskinas informed TechCrunch. “We now have to have a playground the place we will play. We now have to implement a sure degree of safety.”

However preventing cheaters is not only about know-how; it’s additionally about understanding the cheaters themselves and the way they function.

Koskinas’s crew has a “reconnaissance arm,” he mentioned, whose major duty is to acquire and catalog threats, which typically entails buying cheats. The crew obtains cheats partly through the use of sock puppet identities which have infiltrated cheater and cheat developer communities for years, akin to undercover operations.

“We’ve even gone so far as giving anti-cheat data to ascertain credibility. We’ll masquerade as if it was one thing we [reverse engineered], and clarify how an anti-cheat method works to show that we all know stuff,” mentioned Koskinas. “After which leverage our method into one thing in improvement, after which sit there till it launches, permit it to amass customers after which ban all people.” 

Some cheat builders attempt to keep undetected by solely promoting to a couple clients, primarily advertising and marketing their product as high-end, or “premium” cheats, as Koskinas calls them. These premium cheats can price hundreds of {dollars}, and are bought to solely a handful of consumers, mentioned Koskinas.

Cheat makers use this technique to scale back the chance of promoting to a Riot undercover worker, but in addition to clients who shall be extra cautious about blatant dishonest and exposing the cheat.

These builders are primarily promoting “the fame of being undetected,” mentioned Koskinas. One in every of Riot’s anti-cheat crew’s “strongest weapons,” he mentioned, is discrediting cheat builders publicly by, for instance, banning all their gamers, or leaking screenshots exhibiting they’re inside their Discord channels. 

“We are able to simply make them appear like fools,” he mentioned.

Koskinas and his crew additionally should watch out to not come down too onerous. By letting somewhat dishonest occur, inside cause, Riot can decelerate avid gamers from getting higher cheats. “If we hit each participant each time, they’ll simply change cheats till they discover the one which isn’t detected,” he mentioned. 

“To maintain dishonest dumb, we ban slower,” he added.

To cease repeat offenders, Vanguard can “fingerprint” the {hardware} {that a} cheater makes use of — successfully uniquely figuring out their gadget — to make it tougher for that participant to acquire a brand new cheat and proceed dishonest.
In a extra psychological technique, Koskinas and his colleagues additionally troll cheaters publicly by calling them, amongst different issues, “a brainless pathogen,” who’ve an “lack of ability to get good at this online game.”

The cheater’s toolbox

Because of all these methods and methods, most cheaters can now be roughly divided into two classes. The primary, representing nearly all of cheaters, is made up by those that are “rage dishonest” through the use of low-cost instruments which might be simple to detect. Riot staff sarcastically name these cheats “download-a-ban,” based on Koskinas. 

“A variety of cheaters, if you consider it, they’re form of younger,” he mentioned. “A variety of them haven’t grown up but. The best way they have interaction with video games is by dishonest, and a whole lot of that habits is like the facility you’re feeling while you do it.”

“They’re going to return again, they’re going to get banned, and so they’re simply going to do this each weekend for the following two to 3 years… After which, finally they’ll hit puberty, and that’ll hopefully do,” Koskinas mentioned, smiling.

The second class includes these few who use premium cheats which might be tougher to detect. These instruments are referred to as “exterior” cheats, Koskinas explains, as a result of they rely on utilizing precise {hardware}, not simply software program.

One sort of exterior cheat depends on a direct reminiscence entry (DMA) assault. DMA cheats require gamers to make use of specialised {hardware} — suppose high-speed PCI Express cards — that exfiltrates all of Valorant‘s reminiscence to a separate pc that may scrutinize the sport on devoted {hardware}, outdoors of the purview of Vanguard. 

By doing this, the cheater’s separate pc can be utilized to establish different gamers; in-game objects like partitions, ammunition and weapons; and establish exactly the place gamers and objects are within the map. This could additionally embody objects that aren’t seen to avid gamers. Then, utilizing the firmware put in on the playing cards, the cheat creates a radar on a second display that they’ll take a look at to identify rival gamers — even when they’re hidden — to achieve an unfair benefit.

A extra superior model of this sort of cheat, based on Koskinas, depends on HDMI fusers, which overlay what’s learn by the separate pc again on the cheater’s foremost display. This fashion, the cheater doesn’t should look between pc shows to see the place their opponents are, letting them give attention to the show they’re enjoying the sport with. 

These methods permit the cheater to see by way of partitions — referred to as “wallhacks” — and grant what’s known as “extra-sensory perception,” primarily superpowers throughout the sport. 

“I believe we detect nearly all of it at the moment, nevertheless it’s form of iterative,” mentioned Koskinas.

Then there are display reader cheats, the place a pc’s HDMI output is distributed to a second pc that detects and classifies what’s on the sport’s show, equivalent to the top of an opponent participant. The second pc then sends again an instruction to an Arduino mini-computer for controlling robotics, for instance, which is linked to the cheater’s mouse and lets the participant mechanically intention at different gamers — a kind of cheat referred to as an “aimbot.” As Koskinas put it, “principally the mouse, for all intents and functions, is being ruled by a machine.”

If the cheat performs effectively, it may be onerous to detect, however Koskinas mentioned that in the long term, the cheater “doesn’t appear like a human participant” due to how correct they’re aiming and capturing at their rivals.

“You need to humanize [the cheat] to a level the place the benefit is imperceptible from what a human can do,” mentioned Koskinas. “And when you’re there, you’re probably not dishonest sufficient to make it value it for many customers.”

Even then, this method is common, Koskinas concedes. The draw back is that it requires a doubtlessly costly second PC with a quick graphics processor to rapidly classify what’s taking place on the display and ship the directions again.

The way forward for dishonest

Koskinas says he typically worries about using AI for display classification, to be taught what human inputs appear like, and tips on how to reproduce them. 

“That’s already right here,” he mentioned. “Particularly in Valorant with these vibrant outlines, you possibly can virtually do it with simply an algorithm […] You could possibly simply truly discreetly say if the share of this field is sufficient purple, press the hearth key.” For context, characters in Valorant have distinct and vivid color schemes.

Regardless of the safety and privateness dangers related to anti-cheat know-how having kernel-level entry, Riot has no plans to maneuver away from its strategy for its anti-cheat engine, at the least for Valorant. In any other case, it could make it too simple for cheaters to make use of kernel exploits, based on Koskinas. 

Generally, Koskinas is attempting to be extra clear about Riot’s anti-cheat efforts, together with publishing several blog posts on how the corporate goes after cheaters, in addition to speaking to journalists. The thought, he mentioned, is that as a result of Riot has “essentially the most invasive anti-cheat by asking individuals to have a service working always,” gamers should know the way the corporate is utilizing that privilege.

“The very best factor I really feel like we will do in asking for that degree of entry and being round like that, is being as clear in regards to the opacity as we will,” mentioned Koskinas. 

“We’re not telling you what’s beneath the hood, however we’ll let you know virtually the rest,” he mentioned.