You must log in or register to comment.
I would be very interested to know how they are able to identify a specific CPU. The article speculates but does not answer this question.
The fact that this is even possible is a security nightmare.
OK, I’ve done a bit more digging and pieced it together. Acknowledgement to @dual_sport_dork@lemmy.world for prompting me to try (again) to find a command that might do it among other things.
IMO, this sort of information shouldn’t be in processors in the first place, but apparently it is there and needs admin/root access to, well, access it.
… and the game in question requires kernel-level anti-cheat, so of course, it has the necessary access.
The command for Linux is
sudo dmidecode -t processor, which dumps a lot of info including an ID field, which is supposedly the CPU’s specific identifier. It can begrepped for or otherwise filtered out.My own Ryzen gives 8 hexadecimal pairs, so it’s a 64-bit value.
I would not know that that was unique to my specific individual processor if I had not been told, but I’ll assume that at least part of it is not unique between Ryzens of the same calibre. (I won’t be posting any of it for comparison, for obvious reasons.)
So the upshot is, if you don’t want to be identified right down to your CPU, don’t run programs as root if there’s any chance of them phoning home.
I wonder if Riot would provide any info on the ban status of a certain component when given its ID…
They would not.
Anyone doing anti-cheat stuff tries to keep it as secret as possible, so that the cheaters have a more difficult time working around it.
Question is, what happens if you don’t have dmidecode installed? Even more interesting, what happens if you’ve replaced it with a fake that spews back values of your choosing? If they’re bundling it, given that it appears to be GPL2, they’re opening themselves to a lawsuit unless they provide source upon request.
(Somehow, I don’t think they’re actually using dmidecode.)
What I’ve read just now is what I’d deliberately not gone looking for up to this point in case I found this out.
Linux and Windows happen to require that the executables that access that information be run with root privileges, but it looks like that’s merely an affectation.
It seems that any old piece of software, without root or other privileges, can independently run the CPUID instruction that obtains a processor’s serial number.
I do not like this one bit.
Why not? Is that information considered sensitive? Personally I tend to avoid running untrustworthy programs outside of a sandbox or VM.
Sounds like FUD… I want to see it confirmed by someone reputable with an explanation before believing it.
What about this story to you is in any way implausible?
Their fingerprinting is flawed if this story is true. If I take someone else’s CPU and drop it into what is otherwise different hardware then the fingerprint should absolutely change. If it doesn’t then their fingerprinting is broken and this is going to happen whether any particular CPU has been banned or not.
It seems far more plausible that someone got themselves banned and they’re lying to try to get out of it.
Fingerprinting that is that hyperspecific is the one that’s actually flawed. If you could circumvent a hardware ban by rearranging your RAM sticks, it wouldn’t be much good.
As it is, the CPU is the one most stable, expensive, and difficult piece to replace, so it makes sense to ban on that alone.
But, I do agree that cheaters are really slimy fuckers, so what you’re saying is certainly possible. I remember a kid that had his grandmother bring his computer into the shop to see we could evade his hw ban, talked his grandmother into agrreing to buy him a new GPU right in front of us before we turned him down flat.
In this case they even had a completely different install of Windows. There is simply no way at all that the fingerprint should match. If it did match, then their implementation sucks. Fuck them if they made it that bad intentionally. Better to have to catch and ban the same person 10 times than ban an innocent person even once.
I can’t verify that each CPU has a unique id, the way a network card does (MAC address), but it might be a trade secret, who knows.
As far as banning innocent people, if the math is that one cheater drives away 100 honest players, it’s better to ban up to 99 honest players to get to that 1 cheater.
A CPU serial number or other ID is more unique than a MAC address, as those can be spoofed, and are not guaranteed to be unique, either. I heard one case of someone tearing their hair out over a mystery network issue, eventually discovering two NICs with the same MAC. And also the case of someone buying a whole pallet of NICs, which turned out to all have the same MAC address.
But I don’t think that math checks out. A player driven away might return, but a banned player can’t.
