Much harder, I expect. I suspect, but don't know, that play integrity only accepts measurements with an endorsement key associated with a play protect certified manufacturer, so you can't just use a PC TPM with an SPI over USB adapter.
So now you have to find a phone (or at least TPM chip, to use over USB) from a certified manufacturer that has a TPM not in the SoC. I'm not sure such things exist, but even if they do, they're not going to have a simple reset jumper. You're going to end up doing some very delicate solder work.
Android typically uses a hardware root-of-trust inside the SoC, accessible to TrustZone but not to Android or anything in the "non-secure" world, for attestation. The bootloader informs TrustZone of whether it's unlocked before running any unsigned code, and that's included in subsequent attestation quotes. So there's no architectural weakness like this on most Android devices.
If you find a BootROM, early-boot, or TrustZone exploit that lets you run your own code in those contexts, it's often possible to extract the keys used for attestation and forge whatever Play Integrity state you want. I believe you could also use the forged attestations on other physical devices. But if you share them publicly, Google will likely revoke the key and you'll have to start over with a new device.
(I'm not an expert on Play Integrity, but I have done a lot of research on Widevine DRM which is another Google product with much the same goals.)
I suspect that they will end up only allowing fTPMs built into CPUs. Most CPUs already have that anyway (from what I can find, Intel has it since Skylake, which is 10 years old, and AMD since Zen 1). I don’t buy the argument that cheaters would avoid spending 20$ or so on an external TPM when they already spend more than that on cheating tools.
I also wouldn’t be surprised if they already enforce this kind of thing on Windows, especially considering Windows 11 requires a TPM (though it’s bypassable).
Each TPM needs a chain-of-certification for its key, so presumably you require that the chain is rooted in a CPU manufacturer key and not on-board chip manufacturer key.
I think exotic x86 CPU manufacturers don't pass the official performance requirements anyway…
From what I'm told by friends who work in the gaming industry, there are hardcore cheaters that hook into the HDMI and USB via an external computer. Assuming this hearsay is viable, I don't think you can really prevent dedicated cheaters while keeping the games playable.
from the minimial research I’ve done into this they usually use a direct memory access card over pcie that can inspect the memory of the game and then they can use an overlay box to layer a ui over the hdmi output. USB hid injection isn’t too bad either you just need a microcontroller with two usb interfaces. There was a project about a year ago that made a keyboard and mouse switcher so you could switch between two computers It had a built in feature to jiggle the mouse and was just built with two picos.
Apparently some of the more advanced anti cheats will try to detect DMA cards but often they will just clone a legitimate pcie card that has DMA such as a network interface.
An IOMMU (so, VT-d on x86) will stop the DMA based attacks. Injecting input is harder to detect, but in theory you could do heuristics on the USB devices.
There have been many attempts to do remote attestation, going back to the mid 2000's. Variations like NAC, SoH, trusted computing, etc. All of these attempts failed. Why?
Because you're asking a potentially compromised system if it's compromised. That can't end well.
TPMs help a bit, as you get at least the promise that a private key isn't being leaked. But so what? You don't have to crack that. You can just ask the people involved to compromise the systems on your behalf.
So it's been 20 years, and people are still trying to do the same thing which won't work.
I would guess that having to buy a cheat dongle will stop a fair chunk of potential cheaters, but obviously not the determined ones. Perhaps a large enough chunk to not ruin the game for everyone else, and instead just make the high score boards (or whatever games these days use for clout) useless?
I'm half wondering if the UI could be better/amended so we could tag "related stories" but not outright merge them. Basically not as vague as the same tag, but not as close as "3 people writing about the same thing in the span of one week".
Although this one is tricky. It's timely, and it's a direct response. I think the mods tend to merge those?
The simple and universal answer is: anticheat requires forcing the computer to act in a way that the user doesn't want, and Linux is very good at keeping the user in control.
accelbread | 20 hours ago
Awesome. I wonder if something similar could work for play integrity on Android.
mjec | 6 hours ago
Much harder, I expect. I suspect, but don't know, that play integrity only accepts measurements with an endorsement key associated with a play protect certified manufacturer, so you can't just use a PC TPM with an SPI over USB adapter.
So now you have to find a phone (or at least TPM chip, to use over USB) from a certified manufacturer that has a TPM not in the SoC. I'm not sure such things exist, but even if they do, they're not going to have a simple reset jumper. You're going to end up doing some very delicate solder work.
tchebb | 5 hours ago
Android typically uses a hardware root-of-trust inside the SoC, accessible to TrustZone but not to Android or anything in the "non-secure" world, for attestation. The bootloader informs TrustZone of whether it's unlocked before running any unsigned code, and that's included in subsequent attestation quotes. So there's no architectural weakness like this on most Android devices.
If you find a BootROM, early-boot, or TrustZone exploit that lets you run your own code in those contexts, it's often possible to extract the keys used for attestation and forge whatever Play Integrity state you want. I believe you could also use the forged attestations on other physical devices. But if you share them publicly, Google will likely revoke the key and you'll have to start over with a new device.
(I'm not an expert on Play Integrity, but I have done a lot of research on Widevine DRM which is another Google product with much the same goals.)
pta2002 | 15 hours ago
I suspect that they will end up only allowing fTPMs built into CPUs. Most CPUs already have that anyway (from what I can find, Intel has it since Skylake, which is 10 years old, and AMD since Zen 1). I don’t buy the argument that cheaters would avoid spending 20$ or so on an external TPM when they already spend more than that on cheating tools.
I also wouldn’t be surprised if they already enforce this kind of thing on Windows, especially considering Windows 11 requires a TPM (though it’s bypassable).
WilhelmVonWeiner | 15 hours ago
Is there a way to identify if a TPM is external or fTPM?
k749gtnc9l3w | 14 hours ago
Each TPM needs a chain-of-certification for its key, so presumably you require that the chain is rooted in a CPU manufacturer key and not on-board chip manufacturer key.
I think exotic x86 CPU manufacturers don't pass the official performance requirements anyway…
pta2002 | 13 hours ago
Same way you validate that you're using an actual TPM and not some random private key you came up with, you whitelist the vendor's Endorsement Key.
orib | 10 hours ago
From what I'm told by friends who work in the gaming industry, there are hardcore cheaters that hook into the HDMI and USB via an external computer. Assuming this hearsay is viable, I don't think you can really prevent dedicated cheaters while keeping the games playable.
taciturnaxolotl | 9 hours ago
from the minimial research I’ve done into this they usually use a direct memory access card over pcie that can inspect the memory of the game and then they can use an overlay box to layer a ui over the hdmi output. USB hid injection isn’t too bad either you just need a microcontroller with two usb interfaces. There was a project about a year ago that made a keyboard and mouse switcher so you could switch between two computers It had a built in feature to jiggle the mouse and was just built with two picos.
Apparently some of the more advanced anti cheats will try to detect DMA cards but often they will just clone a legitimate pcie card that has DMA such as a network interface.
[OP] calvin | 8 hours ago
An IOMMU (so, VT-d on x86) will stop the DMA based attacks. Injecting input is harder to detect, but in theory you could do heuristics on the USB devices.
riking | 2 hours ago
Note that "a second computer processing the video feed" is also what a Twitch stream looks like on a technical level
alandekok | 14 hours ago
There have been many attempts to do remote attestation, going back to the mid 2000's. Variations like NAC, SoH, trusted computing, etc. All of these attempts failed. Why?
Because you're asking a potentially compromised system if it's compromised. That can't end well.
TPMs help a bit, as you get at least the promise that a private key isn't being leaked. But so what? You don't have to crack that. You can just ask the people involved to compromise the systems on your behalf.
So it's been 20 years, and people are still trying to do the same thing which won't work.
m_eiman | 16 hours ago
I would guess that having to buy a cheat dongle will stop a fair chunk of potential cheaters, but obviously not the determined ones. Perhaps a large enough chunk to not ruin the game for everyone else, and instead just make the high score boards (or whatever games these days use for clout) useless?
[OP] calvin | 23 hours ago
Mods: Merge into x9fqa4
olliej | 16 hours ago
I'm not sure that's correct? There's a significant difference between announcing a new product, and describing how that product is likely ineffective
wink | 10 hours ago
I'm half wondering if the UI could be better/amended so we could tag "related stories" but not outright merge them. Basically not as vague as the same tag, but not as close as "3 people writing about the same thing in the span of one week".
Although this one is tricky. It's timely, and it's a direct response. I think the mods tend to merge those?
WilhelmVonWeiner | 18 hours ago
I spent a long while looking at why anti-cheat was a difficult problem on Linux and this is one of the conclusions I came to too (not an expert).
max-headroom | 4 hours ago
The simple and universal answer is: anticheat requires forcing the computer to act in a way that the user doesn't want, and Linux is very good at keeping the user in control.
matthiasportzel | 10 hours ago
“Install a custom kernel and short the reset pin to ground” feels pretty sophisticated for an anti-cheat bypass.
Is it possible to package all of this into a virtual machine that emulates the relevant hardware?
puffnfresh | 2 hours ago
No, a virtual TPM wouldn't be trusted. Physical TPMs include trusted keys: AMD has the Secure Processor, Intel has the On-Die Certificate Authority.
Going back a few years, the TPM used to be on the motherboard - not the CPU. Keys from those vendors are usually trusted too.