275
Steam store pages are now required to disclose kernel-level anti-cheat [2024-10-30]
(steamcommunity.com)
Steam store pages received a new Anti-cheat field. Disclosure is mandatory for kernel-level anti-cheat solutions. And recommended for other anti-cheat solutions (like server-side or non-kernel-level client-side).
The field discloses the anti-cheat product, whether it is a kernel-level installation, and whether it uninstalls with the product or requires manual removal to remove.
Source
Source for what in specific?
That stopping processes is a kernel action? Go ahead. Open powershell and ask it to close some other system process... The UAP prompt (if you're on windows, linux will just fail silently most of the time unless you sudo or are root) that shows up is the kernel validating that you even have permissions to do that. The kernel handles ALL task scheduling/management. When you close something you're asking the kernel to do it. The kernel also handles ALL file management and driver management (drivers being extensions of the kernel). So the fact that it can read other active DLLs and such hooked into other processes (say your graphics drivers) is literally proof.
That industry agrees that it's malware? Depends on which part of industry I suppose. But if it's able to do all these actions at the kernel level, and attached itself it to other software to install, often doesn't uninstall when you remove the game it was attached to, AND gets flagged by anti-viruses that don't have it whitelisted yet... It's definitionally malware. Go search for "Is malware". Very few people will argue that they're not.
Hell it's possible for anti-cheats to write to UEFI if they really wanted to. There's no legitimate reason for that level of access, 0, none.
I'm a programmer I understand what they are. I understand why they suck.
Stopping processes is actually a user space action. You can do it without admin rights btw. Even if it popped the admin screen that's still not a kernel level action.
Asking the kernel to do something is basically all operations and not the same as kernel level access.
Yeah that it's considered malware. I did Google it and there's nothing saying that.
the kernel level part of that specific thing is preventing process startup after it was killed