1

I've recently read about the new game called Bloodhunt containing an Anti-Cheat, which had a bug, in which the anti-cheat service would stay installed even though the game is removed. The top Steam review called it out as Spyware and the review appears to be gone now which is kinda suspicous in my opinion.

It is well known that popular anti-cheats include kernel drivers, which recently got support for Linux as well.

On Reddit I read that the probably top 3 most popular anti-cheat software being EAC (Easy Anti-cheat), BattlEye and Bloodhunt's custom anti-cheat software supposedly touch the UEFI which sounds rather far-fetched. But if this is real I would say that the Bloodhunt's specially engineered anti-cheat might be a threat and abusing this. Tencent made it after all.

I tried googling more about this topic and I found nothing about it. If it actually does that I think it would a potential backdoor/vulnerability.

Some advice on how to test this for yourself would be appreciated. I guess I have to dump my UEFI firmware using Linux somehow? Or use this tool?: https://github.com/LongSoft/UEFITool/releases/tag/A59

After I dump the firmware I would check the checksum to check whether the firmware changed itself after installing that anti-cheat, are there any flaws in my logic?

Sir Muffington
  • 1,447
  • 2
  • 9
  • 22
  • If they were tampering with UEFI, the PC would get hardbricked and unable to boot again. – defalt Oct 28 '21 at 13:31
  • @defalt Only if they messed up with their tampering. – Joseph Sible-Reinstate Monica Oct 28 '21 at 13:58
  • 1
    @Joseph Sible-Reinstate Monica Writing to UEFI requires signed binary from the chipmaker. – defalt Oct 28 '21 at 14:16
  • @defalt Are you sure? If I understand the [UEFI specification](https://uefi.org/sites/default/files/resources/UEFI_Spec_2_9_2021_03_18.pdf) page 987 correctly, then a new UEFI image only gets authenticated if the new image says that it requires authentication. – Philipp Oct 28 '21 at 15:17
  • @Philipp In consumer PCs, this rule is not enforced. On boot time it verifies the firmware update and then only it updates UEFI. – defalt Oct 28 '21 at 16:44

0 Answers0