Original Post — Direct link

Hi guys. I have played the game a little bit and it's fun! But there's one problem.

The kernel anticheat driver (vgk.sys) starts when you turn your computer on.

To turn it off, I had to change the name of the driver file so it wouldn't load on a restart.

I don't know if this is intended or not - I am TOTALLY fine with the anticheat itself, but I don't really care for it running when I don't even have the game open. So right now, I have got to change the sys file's name and back when I want to play, and restart my computer.

For comparison, BattlEye and EasyAntiCheat both load when you're opening the game, and unload when you've closed it. If you'd like to see for yourself, open cmd and type "sc query vgk"

Is this intended behavior? My first glance guess is that yes, it is intended, because you are required to restart your computer to play the game. I don't think it is a good approach though. Maybe that's just me.

External link →
almost 4 years ago - /u/RiotArkem - Direct link

TL;DR Yes we run a driver at system startup, it doesn't scan anything (unless the game is running), it's designed to take up as few system resources as possible and it doesn't communicate to our servers. You can remove it at anytime.

Vanguard contains a driver component called vgk.sys (similar to other anti-cheat systems), it's the reason why a reboot is required after installing. Vanguard doesn't consider the computer trusted unless the Vanguard driver is loaded at system startup (this part is less common for anti-cheat systems).

This is good for stopping cheaters because a common way to bypass anti-cheat systems is to load cheats before the anti-cheat system starts and either modify system components to contain the cheat or to have the cheat tamper with the anti-cheat system as it loads. Running the driver at system startup time makes this significantly more difficult.

We've tried to be very careful with the security of the driver. We've had multiple external security research teams review it for flaws (we don't want to accidentally decrease the security of the computer like other anti-cheat drivers have done in the past). We're also following a least-privilege approach to the driver where the driver component does as little as possible preferring to let the non-driver component do the majority of work (also the non-driver component doesn't run unless the game is running).

The Vanguard driver does not collect or send any information about your computer back to us. Any cheat detection scans will be run by the non-driver component only when the game is running.

The Vanguard driver can be uninstalled at any time (it'll be "Riot Vanguard" in Add/Remove programs) and the driver component does not collect any information from your computer or communicate over the network at all.

We think this is an important tool in our fight against cheaters but the important part is that we're here so that players can have a good experience with Valorant and if our security tools do more harm than good we will remove them (and try something else). For now we think a run-at-boot time driver is the right choice.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by DolphinWhacker

Yeah, just find "C:\Program Files\Riot Vanguard" and change "vgk.sys" to "vgk1.sys" or any other name, then restart your PC. You'll have to rename it back and reboot again when you want to play Valorant.

You can also remove Vanguard (including vgk.sys) by going to Add/Remove programs and uninstalling "Riot Vanguard"

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Venetax

Folks also quickly got some cheats running because e.g. their fog of war system is currently disabled in beta due to issues etc. Lets hope they get it sorted on full release.

This isn't true, the Fog of War system is running

Edit: you're right that we have more security improvements and anti-cheat tech in the works, just wanted to say that Fog of War is doing its thing on the server

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by 9eemu

Wait so is it bad if I browsed a cheating forum a couple times? I have never cheated even in csgo but I keep checking 1 site to see if they have already come up with cheats

Our anti-cheat system does not run any scans while the game is closed and we definitely don't record your browsing behaviors even when the game is running.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by KindOldRaven

Yeah that's not going to fly with me. I'll figure out some way to keep it off permanently until I launch the game. Otherwise some coder will find a way to do so.

Sorry to hear that. You can uninstall Riot Vanguard at any time from Add/Remove programs. You'll need to reinstall it and restart your computer if you want to play (the game patcher will reinstall it for you).

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by DolphinWhacker

"The Vanguard driver does not collect or send any information about your computer back to us."

"it doesn't scan anything (unless the game is running)"

Thank you for the clarification, this is mainly what I was looking for.

You're welcome! While there're details and specifics that I won't get into I'm trying to be as open as possible about what we're doing to fight cheaters.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Brenner14

Will you consider implementing an option to NOT run the driver at system startup by default, and prompt for a restart upon launching the game? I would feel much more comfortable compartmentalizing my play sessions in such a way that the driver is never running unless I am playing the game.

While it's not an official option you can do this yourself by uninstalling Vanguard once you're finished playing. You can find it as "Riot Vanguard" in Add/Remove programs.

When you want to play again the patcher/launcher will reinstall Vanguard automatically and you'll be asked to reboot your system.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by canary-

Interesting about using a least permissions approach. My knowledge on the technicalities of cheating is limited, but what about detecting cheats injected into protected memory?

We have the driver do as little work as possible. If an anti-cheat check can be run unprivileged then we will run it that way. Sometimes there may not be a way to perform an integrity check without extra permissions and only in those cases is the work done by the driver.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by wrapitupdomie

So why was this player able to see everyone through 20 walls?

The cheats so far have been drawing players at obsolete/incorrect positions because they haven't been able to tell whether or not the information on the client is up to date.

In some of the videos floating around you can see that the wallhack box takes a big jump just before the enemy comes around the corner, that's when the server sends a real update to the player and only then are their cheats showing the correct location.

I have an article that goes into more details on how Fog of War works, it should be coming out early next week. I even made a wallhack to demo things for everyone :)

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by airjairj

So much transparency... love you Riot, you're the best

<3

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Ketonax

So our PCs might be eventually exploited via your driver only when the game is running? Do we get that information upon installation or have I missed it?

I'm not sure what you mean by exploited here.

The driver runs at system startup but the rest of Vanguard (the more active components) only run while the game is running.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Vinzala

This is amazing! Such a clever way of preventing a system corruption! Im just curious, how do you come up with your ideas?

I don't have any unique idea generating skills, if anything it comes down to trying a lot of different things and working with a lot of smart people.

There's a team of us working on anti-cheat and we have experience from a lot of fields including information security, operating systems internals, anti-cheat development, game programming, data analysis and game hacking. We draw on our experiences in these fields as well as keep abreast of the latest research from the security and anti-cheat communities to come up with potential security techniques.

One of the best ways of coming up with new ideas is to closely monitor what hacking communities are doing to try and bypass other anti-cheat systems (including League of Legend's anti-cheat). We also welcome ideas for new security measures and reports of security weaknesses in our systems (even paying rewards in some cases) to help us improve them.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by airjairj

Oh and... sorry dumb question, can't you let me in?? All my friends are playing while i'm still watching streams on streams.

But, as i said, very dumb question

I understand that you want to shoot your shot :)

I can't give anyone beta access though!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Vinzala

God, that sounds really great. A group of great minds trying to find a solution to a problem that is as old as gaming :D What did you study/learn to come into such a team? I have always been interested in the topic hacking/protection, but wasnt able to find a job in this field because i didnt know what qualification i need.

In some ways I was lucky because I got into the industry before there were a lot of formal qualifications necessary. I studied computer science and took all the networking courses I could on top of the required compsci stuff. After graduating I got a government job where I learned a lot of the more specific security related stuff.

If you want to get into it I recommend looking into security Capture the Flag puzzles, they're a great gamified way of learning some of the tech behind security. Here's a blog post about them: https://dev.to/atan/what-is-ctf-and-how-to-get-started-3f04 (I personally like the jeopardy style CTFs)

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by ImSkripted

id assume VGK loads at system start to prevent people using vulnerable drivers to either run their own code and or load unsigned drivers and will prevent the vulnerable driver from loading or prevent valorant from running after.

if this is the case i do see one hole in this form of security, you only know about publicly known vulnerable drivers. there are many other drivers that could be used other than what ill call "Driver C" because of, well the first letter. I know of one that is not only a very common driver but is also their latest version of that driver so I don't see how you could differentiate between someone using it to load cheats or is just wanting to use it for its intended purpose. not to mention the person who discovered it submitted a report in 2019 to the company and Microsoft, who both are still yet to acknowledge it, I've even gone as far as to contact my university to help him get the driver a CVE & fix but due to corna it seems that has been put on the back burner.

im not sure as to how much the advantages outweigh the disadvantages, especially to the trust of the game, would you care to explain what swayed the team's decision in favour of this?

You're not wrong, there are some difficulties with things like "Driver C"

When making calls like this one of the things we look at is the cost of cheat development. Even if a mitigation is imperfect we consider whether or not it increase the time/effort to develop cheats to be worth doing. There's also the cliche of "Defense in Depth" where several imperfect mitigations could work together to create a much stronger overall protection.

The theory goes that fewer people will make cheats if it's difficult and time consuming which will make it easier for us to detect them (or otherwise get them to desist).

So even when a mitigation is imperfect the additional burden on cheat developers can be worthwhile either to increase the cost of cheat development or just as one more part of an overall strategy.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by xTuna74x

Just dont turn it into a bitcoin miner like another company with this kind of anticheat.

I will do everything in my power to prevent this from happening.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by ReverseDead

If I could pick your brain for a moment. After I downloaded and played Valorant. Hence forth every time I boot up my computer for the first time that day. It will cause me to restart my pc as the anti-cheat system has not finished applying. When I go to restart my pc it takes about 7-10 min for it to actually boot up. But once I Shut my pc down it requires me to reinstall the anti cheat over and over again. I’ve tried deleting and reinstalling both Valorant and riot vanguard to no success. My pc on average took 10-15 sec to boot before I download Valorant this Tuesday.

I don't have any ideas off the top of my head sorry!

I recommend submitting a support ticket, they'll be able to run you through some troubleshooting steps and if they discover that it's a bug in Vanguard (or even just a previously unknown incompatibility) they'll make sure we get the diagnostic information we need from you.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by slammy02

Where would I submit vulnerabilities for compensation? I like money more than cheating

We run a bug bounty program on hackerone. I think it might be invite only but you can also email bug bounty reports to bugbounty@riotgames.com

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by xTuna74x

Lol I figured someone had to make the joke. You guys made/are making a hell of a game!

Thanks <3

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by InvalidZod

My opinion is still going to be a hard line in the sand of unacceptable. I closed LoL on the 7th and over the next 48 hours it dumped over 100GB of crash logs onto my C drive(where LoL was not installed). Thankfully I have the ability to pull my drive and delete the file from another device because my computer would not boot(Windows 10 needs more than 22MB to boot).

Sorry about that!

That was a pretty nasty bug, the patcher team rushed out a hotfix during the week. The log files would have been deleted in a few days (only the last few log files are kept around) but obviously it's unacceptable to pollute your hard drive like that!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by KindOldRaven

Hey there Arkem! I read your clarification. First of all: thanks for that, that was an immensely quick yet pretty detailed response to this topic! Secondly: I'm a bit of a control-freak when it comes to my PC. I'll monitor anything that activates on startup and usually turn most of it off, including non-essential Windows apps and files. I'll monitor Riot's Vanguard as I will any other 'new' component, but I will admit that if your take on anti-cheat proves effective and indeed causes no further issues (or proves to be a vulnerability of some sort)... well... I'll take anything over script kiddies who ruin (competitive) games for others.

tl;dr: thanks for explaining, that eased my mind quite a bit :)

You're welcome! We're trying to be as open as we can because we want people to feel confident in what we're doing. If you ever have any questions I'm happy to answer them.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by lennihein

Is there any updates on the blogpost about the technicalities?

I have a long article (it might be the longest article I've written since school!) about Fog of War coming out this week (Tuesday I think?). I'm also planning on writing shorter pieces about other anti-cheat topics but I haven't started them yet.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Ketonax

Well, I assume your driver runs in kernel mode, because it start with the system. You straight away render most user mode cheats useless, the basic ones at least, where they are flagged instantly. At the same time 'someone more skilled' can find a vulnerability in your code and run their code in kernel mode. There is no way you can guarantee this won't happen, even when You state that several security teams had a look at your code.
There were multiple examples over the years with kernel drivers being exploited in the wild, Razer Synapse, Capcom and I believe there are several ways to break FaceIt anticheat.
You also stated it's very simple part that runs in kernel mode, which worries me that it will be simple to disable / override and render useless. Secondly, do you inform us anywhere during installation about this technique? I have beta access, but of course I skip all the reading and honestly don't remember.

While I can't guarantee that we're perfect we have put a lot of effort into the security of the kernel driver. We've had multiple groups review it for security flaws (both external security consultancies and our own security teams).

We definitely don't want to put yet another vulnerable driver out into the world!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by smokeey

If it can just be uninstalled what's the point? Does the game still operate without that component of the cheat system gone?

The game won't operate if you've uninstalled Riot Vanguard

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by SirrLarrson

Ever since downloading the game my computer has had serious issues starting up (like 2 fps serious) I'm all for invasive anti-cheat but not at the cost of my system, i've also observed lag on other games like csgo that I've definitely not encountered before. These issues could definitely be something other then the anti-cheat but I've been doing a lot of troubleshooting nothing has worked. I might just permanently uninstall the game if it continues

Specs 2070 MSI gaming z i7 7700k 16gb trident Z 3200ghz ASRock fatal1ty 4 270 Kingston 500gb nvme sad Windows 10 pro

There could be a compatibility bug (maybe Vanguard isn't compatible with something running on your computer?). I recommend putting in a support ticket so they can help you collect diagnostic information and troubleshoot.

You can also try uninstalling the anti-cheat (Add/Remove Programs and selecting "Riot Vanguard), if that fixes your problem then it's very likely that there's some kind of incompatibility and we'd definitely be interested in your help figuring it out.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Gettrolledsteve

Thank you for the hard work on the anti cheat! Game feels great! I had a question regarding this driver. Did you guys think about randomizing the name and location of the driver on boot up? Every vanguard update you could change the list of names to make it harder. I'm not sure if this is possible but I think it would annoy cheat makers as normally they have to inject into the driver to bypass it.

It's a good idea but there's a limitation that prevents us from doing this.

In modern versions of Windows all drivers need to be approved by Microsoft through a code signing process or they won't be loaded. This means that even if the name of the driver is changed there will still be some identifying features that would make it clear that the driver is Vanguard (since the authenticode signature would say "Riot Games").

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by bapplebo

Out of curiosity, if I use something like a PiHole to block outgoing DNS while the game isn't running, what are the consequences of that?

None it'll work fine, we don't have any network connectivity requirements unless the game is running.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Redztar

And this is one of - if not the most important part.

I was so sorry to hear that someone already beat the anti cheat somehow, or "almost".

Can you give some insight into what they did our what happened unless I missed a post or article?

Again thank you for your time and this lovely game! Also if you stumble over my "CB button" so smash it for me thx! :D

The TL;DR version is that we launched our anti-cheat in a more passive mode to begin with in the hopes of reducing the chance of launch week issues. It was also hoped that this soft start would let us observe how cheaters would attack the current system without us fully tipping our hands.

To be honest in hindsight I would have tried to take a different approach because cheaters made progress much more quickly than I expected. The week or two or ramp up time I was hoping for was actually only a few days and so if I could do it again I would have recommended going hard right out of the gate.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by IkeKap

This is probably a dumb question but are you planning to continue these security practices as the code is updated?

Definitely, security is a process, we can't just say "we did security and now we don't need to think about it anymore". As we make code changes we know that new risks could be introduced and our previous reviews become less applicable.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by MolestingSandwich

As much as I want to believe this line "The Vanguard driver does not collect or send any information about your computer back to us." it gets proven time and time again this is false. Doesn't exactly help your case being a Tencent company and all as well.

I get it, we'll have to earn your trust!

Feel free to monitor what we're doing and call us out if you see something fishy.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by GamerGypps

So effectively you need the driver running 24/7 if you want to play the game. Or uninstall and re-install plus reboot your PC every time you want to play ?

Yes, to play the game you need to have the anti-cheat system installed and initialized at boot. You can uninstall it anytime you like but you will need to reinstall it and reboot before playing.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by jronehfijfnlwpzkfnir

You should open source this driver for extra piece of mind on our part

I'd love to but we're worried that releasing the source code would make it easier to bypass. I know it sounds a little "security by obscurity" but when talking about client based anti-cheat efforts there're always some elements of that.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by [deleted]

[deleted]

We take our responsibility as software developers seriously and we'll try to give you as many assurances as we can that this software is safe and secure. We're not perfect but we're putting a lot of effort into to trying to keep players safe.

At some point each player needs to decide whether or not they want to trust any piece of software with their computer. If you don't trust Riot enough to install VALORANT and Vanguard on your computer I'll understand but I hope we can change your mind one day.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Gettrolledsteve

Then could you do that but create a bunch of decoy drivers whitelisted by riot and shuffles them every update? having the cheat makers going troughs a 1000 of fake drivers in order to find the working one? Btw thanks for the answer!

That's a fun idea, I'm not sure if Microsoft would appreciate us doing that though :)

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by [deleted]

[deleted]

We are confident that we're complying with European privacy regulations, we take our obligations to player's privacy seriously.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by striker890

Aren't cheats usually loading as an unsigned driver? Can't you make a unsigned version, that only loads if the ms checking is disabled?

Definitely! We try to detect when driver signing is disabled and prevent the game from running.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by danker

Correct. It’s Tuesday. :)

Thanks Danker! I'm pretty excited :)

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Aleriic

I don't like that it is that way. I have never cheated but I personally think there should be some option to turn it off. I am playing mutliple games and I still fear that the 20 thousand different anti cheat systems will interfere with each other and might get me banned somewhere else. Isn't it possible to implement a feature that it is turned off and if you wanna start the game, then you have to restart to turn it on AND you have a display somewhere that it's currently running? No one wants cheaters and I am all with you in the fight, I still don't want to get banned because let's say XIGNCODE3 from Black Desert Online detects Vanguard as Anti-cheat or vise versa. Cheating is a big issue especially in F2P games, I would even pay 15€ for a Premium Status that prioritizes matching me with other premium people (I think CS:GO had a similiar system).

We're trying to play as nicely with other software as possible, if we find incompatibilities fix them as soon as possible.

You can basically do what you're suggesting (except for the display part) by uninstalling Vanguard when you're not playing. You can uninstall it from Add/Remove programs.

For the display part there might be a quick script someone could write that displays a message on the screen if vgk.sys is loaded. Maybe someone could use something like RainMeter to make a custom desktop text label?

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by pvpproject

May I ask about accessibility software? I create custom AHK scripts for clients with limited use of their hands (such as RSI, missing fingers, etc), often times these scripts are paired with adaptive controllers.

Most of the scripts I make allow users to toggle things that the game often doesnt allow them too, or presses multiple buttons at once (sometime with a timings between them). For example in Valorant I've had a request to make a toggle run / walk key. All these scripts are aimed at making the users time spent playing more comfortable.

If it's a multiplayer PvP game I aim to get the go ahead from the devs before I start building things for people, and in the past there has been fair concern and pushback from some companies because of the "slippery slope" that these type of things can bring. On the other hand, some companies have even gone as far as to replicate the functionality of our accessibility software straight into their game, specifically ArenaNet built in a script that thousands of my users were using into Guild Wars 2.

I'm worried that such an in depth anti cheat will get my users suspended, but without it most of them are unable to play, or atleast cant play comfortably for very long. Is this something I need to be concerned about? Will these be judged on a case by case basis? Thankyou.

At the moment we are ok with people using programs like AHK, we can't provide support for them but we will also not actively block them or ban people for running it.

If AHK becomes something that is being abused we may need to restrict it, ideally feature by feature but possibly blocking the whole program. In that case we would make sure we announced the policy change ahead of taking any actions.

I'd hope we'd also be able to work with the community to find alternatives means to improve the game's accessibility. Long term it would be great if we had the needed tools in game for players but even absent that we'd try to provide some accomodation.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by liamlb663

Any comment on the cheating programs that have already popped up

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by [deleted]

[removed]

I'm sorry to hear that, I hope that over time we'll be able to earn your trust.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Der_Hausmeisterr

That's good to hear but what is your exact position in the company? Not to be rude but I hope you have some meaningfull say in the final decision.

I'm definitely not the CEO or anything but I'm well placed to make a promise about no cryptocurrency mining in our game.

Currently I'm the anti-cheat lead for VALORANT. On behalf of Joe and Anna (the game leads) I oversee the product and tech decisions relating to security issues for the game. Previously I was the tech lead for the company's central anti-cheat technology team (the Vanguard team basically).

I've been at Riot for more than 6 years now so I'm fairly well integrated into the technical organization, I'm confident that no official decision to add a cryptominer or any similar tech to the game would be possible without me hearing about it and having a chance to stop it. Not that I ever think it'd come to that!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by xRobert1016x

Hey Arkem, could you possibly add support for shadow pc? Some of my friends have bad computers but the anti cheat detects the computer as a virtual machine and they are forced to play on their bad computer.

Sorry, we have no plans to support streaming services like Shadow at this time. We might reconsider in the future if we can find a way to do so without weakening our anti-cheat systems.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by chazragg

i take it this will be the same anti-cheat that is planned to be implanted to the league client in the near future ?

League of Legends might one day adopt Riot Vanguard as its anti-cheat system but there's no timeline for it.

The article about it was a little confusing because we posted it on the League website (because there was no Valorant website yet) and we didn't want to suggest that Valorant was about to release.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by BLlZER

TL;DR Yes we run a driver at system startup, it doesn't scan anything (unless the game is running), it's designed to take up as few system resources as possible and it doesn't communicate to our servers. You can remove it at anytime.

Yeah guys lets all trust a company to have a program on our PC's turned on all the time. We all know companies always do whats best for us and not their shareholders. Never in the history of mankind we consumers were f**ked by companies. Yeah guys it's fine let them have acess to your computer ALL THE TIME even when the game IS NOT running...

What could go wrong? I want to thank you Arkem for clarifying this, and convince me and hopeful others to not install this spyware of a game.

I'm sorry to hear that we haven't earned your trust. Maybe our actions will convince you in the future.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Warskull

The driver has a lot of privileges. Someone finds a bug in the driver that lets them do arbitrary code execution. They can now use the driver to take control of your system and install viruses.

Street Fighter 5 tried to do anti-cheat this way and it ended up being a gigantic security hole.

It's true, that's why we put a lot of effort into security auditing. Our internal security team as well as multiple external consultants have done reviews of our driver to try and identify privilege escalation issues.

I can't guarantee that we're perfect but we've invested a lot to avoid putting a vulnerable driver out into the world.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by MikeZack

If you played Black Ops 4 "fog of war" was one of the most hated things about the game. Basically the game mechanic would ping a guy on the mini map behind a wall that you otherwise wouldve never seen or known was there. I find it ironically funny that you guys are using that term to prevent wall hacks.

Yeah I can see why that would be funny :)

We call it Fog of War because it's analogous to the Fog of War system in League of Legends (some of the technical concepts overlap too).

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by illestjar

have you guys considered doing a “PRIME” version of valorant where players pay for more secure anti-cheat servers like CS:GO?

We hope that we can bring a secure experience to all players but we're not going to rule anything out!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by GlockWan

Are you not worried about releasing too much information on how the anti cheat works? I suppose surface level stuff about fog of war isn’t too much of an issue and everyone already knows about it

It's a delicate balance. There are a lot of topics that we go too deep into but where possible I want to be open with everyone about our efforts.

I think Fog of War is a good one to talk about because its effectiveness isn't harmed by details being released. Also it's one of the few security things out there that can be shown in illustrations and clips.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by FormUp

The follow up question would be, "Okay, but what about the rest of the anti-cheat software?"

The driver is the only component that runs while the game is closed. The rest of the anti-cheat system is only active while the game is active.

The anti-cheat system does communicate with our servers both to verify that the system is running on your computer and to receive instructions of what cheat detections to run.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by MikeZack

I gotta say I haven't played many before riot made games before valorant except for league and maybe only 20 matches on it but I love the transparency the team at riot is showing. Seems like many game companies hide from there communities(Infinity ward.. cough cough) and you guys are jumping right in talking with us on reddit, the interviews with twitch streamers and just the overall openness about your product and why certain decisions are made. Its truly appreciated and I think its what users want from Devs.

Thanks for the kind words!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Daysofreckoning

Did you work on the anti cheat in LoL. Cause I must say it is amazing that in the past 3 years I havent seen so much as one scripter.

Thank you! I didn't personally have much to do with it (I've been on Valorant most of that time) but the team worked hard on protecting LoL and I'll make sure I pass on your praise.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by nthackerguy

Why do you guys run such a PR game like this. As someone who also works in a similar role, it all seems like bull.

Firstly you have this fog of war thing you keep parroting. I genuinely applaud you if you have someone who solved this. But anyone who did solve this is in the wrong role. This is very much a math/CS theory PhD type of problem. Like literally very knee deep distributed system stuff, with all their fancy mutli valued logics. Why would someone in Systems/malware, literally the CS section for the kids who sucked at math, design this?

Anyways, from what we’ve seen analyzed so far, it seems like that’s a lie as well. Sure you can limit it and try, but there’s literally 0 way for that data to not exist on the computer for people in at least a small bound.

Secondly, why even go Kernel. You can’t hook syscalls with the ssdt, or patch functions anymore without some insane hacks. But then you have a team of SVA’s looking for it to get it patched.

It’s good PR I guess, and it stops little timmy from being hackerman. But literally everything you could do is easily bypassed by any actor that understands the executive. I don’t work in anticheats, but I genuinely have to wonder how many people will be stopped by an anticheat like this, that wouldn’t be solely by user mode.

I do like how you mentioned loading there. Since that’s the only thing this anticheat will do. But I don’t know about any riot games specifically. But using the discord overlay, or any common library that has to many versions to realistically check against would still get past it. And even then, a client to receive the cheat code and then executed via abuse of the JS compiler in these webbrowsers a lot of overlays have is more than enough.

So as I said, I just don’t understand why you take such a PR approach. And why the anticheat team is taking credit for the math behind network requests. Which is literally an entire field in distributed systems.

For Fog of War I've got an article about it coming out on Tuesday on our tech blog. Maybe it'll answer your questions. I'm no CS PhD but I did spend a fair amount of time working in Unreal Engine's networking systems to build it.

Would you like to participate in our bug bounty? I'd love to get your impressions after you've had some more hands on time with our tech. We pay bounties for information leading to improvements in our security and it sounds like you have a lot to contribute.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by xWangan

This is good for stopping cheaters because a common way to bypass anti-cheat systems is to load cheats before the anti-cheat system starts and either modify system components to contain the cheat or to have the cheat tamper with the anti-cheat system as it loads. Running the driver at system startup time makes this significantly more difficult.

You say this, yet later on you state that it doesn't actually scan anything etc. unless the game is running, so wouldn't your statement here be false? It's either scanning my PC and thanks to this fact it could help with the issue u raised, or it doesn't, and then it's useless to load it at boot.

So, which is it?

Since the driver doesn't send any information to our servers and it's not trying to identify cheats or ban anyone I say that it's not scanning.

Instead it exists to protect the game client and it can better do that if it loads at system startup time. Think of it as a protection mechanism rather than an anti-cheat system itself.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by jjrv360

Out of curiosity why is this method used for valorant but not for league?

I don't want to speak definitively for League but here's how I see it.

Different games see different cheating threats. League of Legends is in a good spot currently with its existing system. Moving over to Vanguard could help but it would require a fair amount of effort so until it looks like that effort will be needed it's going to be a low priority task.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by nationwide13

You're doing your best, but are you going to refund me for time and money spent in other games if your software causes me to get banned?

As a team (imo) you should be WAY more transparent and offer more options when it comes to this driver that is running 24/7. I'm pretty positive you guys broke a lot of trust by the fact that this is being pointed out by a user, and your only answers to people who are worried about their security and safety (right after breaking that trust) is "we're trying our best"

Edit: someone linked an article from 2 months ago that appears to talk about the driver, so you did let people know, apologize for being wrong there.

I still think overall it's weird, and reading replies it looks like you continually dodge questions regarding how/where this appears in the ToS/other legal stuff.

If you get unfairly banned we're happy to investigate it, it's rare that we make mistakes but it has happened and we're willing to own up to them.

We're pretty confident that our ToS and privacy policies cover everything we're doing with Vanguard. If you think there's a gap let us know so we can talk to our policy experts about fixing it.

At the end of the day each individual has to make a call about what software they're willing to run on their computers. We're hoping that we can provide enough information about our software that people will be confident running VALORANT and Vanguard on their computers.

If you don't want to run our software on your computer that's ok we understand, maybe we can change your mind one day.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by nationwide13

You only state it doesn't collect any information about the computer, does it collect any information at all?

The Vanguard driver exists to protect the game and anti-cheat processes. It doesn't collect information because its job is protection rather than detection.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by sinex93

Is this stuff running in the background gonna get me a vac ban?

We work with other anti-cheat providers whenever we suspect a conflict so that we can avoid problems. If you ever think you've got a problem with two anti-cheats fighting let me know and I'll investigate.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by LDKtv

Awesome Arkem! I have one question regarding the AC. Will it be a possibility for neural deep-learning hub for busting cheaters as well?

Similar to VACNET from Valve.

Yes! Our game server saves aim vector data and we using it in machine learning experiments to detect aimbots. It's still a research project for now but so far the results are encouraging!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Blizzxx

Did you work on league of legends security and if so, was Valorant harder or easier to setup? I would imagine league was easier as so many things are server side.

I worked on early League of Legends anti-cheat and we definitely had some things going for us. League of Legends was built in a way that was fairly cheat resistant to begin with (much of the game being server side) and due to the moba gameplay the maximum effectiveness of your basic cheat was lower than your average shooter.

We still had to build a bunch of protections for the game and I'm really proud of the work me and the rest of the team did. Especially in recent years where the anti-cheat got upgraded again (after I'd move on to Valorant).

I think the threat to Valorant is higher due to the nature of competitive shooters and that's why we've taken a different approach to security with Riot Vanguard.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by UltraInstinks

May I ask? Will this ever be available for usage in other UE4 games?

Right now, BattlEye needs to be dethroned. They offer extremely unfair pricing.

For fellow game devs, you should really consider creating a product that plugs into UE4 games and provides such amazing level of AC.

Thoughts? I'm a game Dev myself and I'm making an FPS. Having Riot level of amazing experience would be spectacular. Please consider it!!!

We're focusing on VALORANT first but Vanguard was designed to be able to included with multiple games. We were thinking other Riot games but maybe one day we can work with other game studios too.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by HWKQ

so if I were to use cheatengine for a singleplayer game for example would it have any effect?

You shouldn't have a problem as long as Valorant isn't running

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Daysofreckoning

I'm sure you guys are doing a great job too. Normally an anti cheat using these practices would give me pause but I know the great work you guys do over there so I am not bothered.

Thanks for the kind words!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by BillDino

Does it work with Shadow Streaming service? I've heard you guys ban people playing with Shadow

We don't support game streaming services right now

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Mesong0

I'm not sure if this is because of that driver, but I tabbed out of game and closed it from the windows screen, PC essentially took a shit, couldnt shutdown via start menu, had to turn it off via power button and got stuck in a boot loop, couldn't even get to automatic repair, it'd just black screen, never happened before, only thing I could think of was the Valorant anti-cheat, after about 30 restarts it just sorted itself out. But still, thought I'd mention it.

My guess is this is a graphics problem, we've got some window manager improvements coming in one of our updates that I hope will fix issues like this.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by EvilKnievel38

I love how open you are about it. I come from csgo where the cheating is out of control so I love hearing how you fight that. Your talk about how the anti-cheat works is one of the main reasons I am so excited about this game. Keep up the fight!

I appreciate it, thanks!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Venetax

Okay sorry for misleading info. I gathered this info from multiple cheat forums where people said that fog of war is not a thing yet, I havent checked myself. I guess they were wrong then :)

No worries, check out my article on Tuesday that'll have a lot more info on how Fog of War works :)

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Impul5

Ok, so, question: if we can simply uninstall the driver at any point the game's not running, and it not being active all the time is what allows for some additional cheats to get through, then what's stopping people from taking advantage of that potential vulnerability anyways by just uninstalling it, pre-loading their cheats, and then reinstalling the driver again? From what you've described, it sounds like this is going to affect the average user who can't be assed to do this every time, more than cheaters who are already exploiting every vulnerability they can.

And additionally, if it only does cheat detection when the game is running, then how does it always being active help prevent cheaters?

In the situation that you describe the game will show an error screen asking you to reboot your computer.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by _Cava_

This sadly doesn't seem to work on every pc, for me I have to go through the console command route and reboot computer. Really quite a hastle if this is the only way to disable Vanguard after playing valorant.

I'll look into it, if the uninstall is working cleanly for you we'll need to fix it.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by kartios

This has nothing to do with "earning trust," and in fact rolling this out as secretively as it was is a huge violation of trust. Even looking it up now, I can only find a single article on it an this single reddit post. This news should be the only thing we hear about this game at this point. This is an extreme violation of privacy, especially when you consider that Riot is owned by Tencent. Not sure how this decision made it to an actual release. I was excited to get a beta key but if this isn't removed there is no way I can play this game.

I'm sorry you feel that way.

Here's an article from 2 months ago where we talk about the kernel component: https://na.leagueoflegends.com/en-us/news/dev/dev-null-anti-cheat-kernel-driver/

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by hornytwat12

Any update on the cheater situation? And the fog or war system already been contested if I’m right in saying so or is the fog of war system still not implemented?

The Fog of War system is working, I think there's just some confusion (especially among cheat developers) on what it does. Check out my article coming Tuesday that will go into details on how we built it.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by nyulzsiraf

You should add a toggle option. We could turn if off, and when we turn back it on it would need a PC restart. I don't like the fact it is running everytime.

You can effectively toggle it off by going to Add/Remove programs an uninstalling Riot Vanguard. The game launcher will reinstall (and ask you to reboot) next time you want to play.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Jimster480

So I am commenting on this as a Cheat developer.... a long time well known developer. I have basically bypassed every single anticheat ever created. This is what I do for a living and sometimes it works out well.
I was alerted to this thread about Valorant as many people in the recent days have been asking me to take a look at this game and its anticheat. While I still haven't decided if this game is worth my time (no offense to anyone developing the game but games are dime a dozen these days and most shooters die in a few months) or not. I don't even have an account for this game and while I do have a league account... I never made cheats for LoL either and actually don't cheat while playing games myself.

After reading through this thread extensively.... the presence of a boot-time driver is a useless and invasive technique. Many people give it pause because of what can be added to that driver in the future and because of the corruption that has happened in the anticheat world in the last years. Everything from password theft, to account theft to bitcoin miners to corporate espionage.... anti-cheats are not cast in any better light than cheats themselves are.

Any boot time driver will be defeated, and by creating a huge wall that prevents cheats; the only thing you serve to do is push up the price of cheats. You also just result in more people (players) getting scammed by fake cheat developers or by cheats that get their accounts banned (although this doesn't stop cheating as people who want to cheat just obtain more accounts, and for any game that is cheap or free this is an even bigger problem).

I have thought for many years about developing my own anticheat to show all these "anticheat devs" how to actually build an anticheat. The goal of any anticheat should be to prevent game-disruption level cheats and to make the playing field as fair as possible. However when you look at clients like EAC, BattleEye, ESEA, Esportal, and others they are all inherent failures. Even FaceIT client is a failure in that regard (despite their big money contracts and specialized privileges for windows through MS partnerships) there are still cheats and ways to cheat on FaceIT.
It seems so far in reading this that the goal of Valorant is to "prevent" cheaters. By creating a secure wall for the game and its user-mode/runtime client to detect cheats. However that is only following what the rest of these failure clients have done. Let me elaborate on what I mean by that:

You will never defeat all cheats, and you will never make it impossible to cheat. You will only increase the cost of entry to cheat. Allowing those with the deepest pockets to win everything with the most complex of cheats while everyone else will lose. Those who rise to the top will be exempt from these rules (just as it is in other esports games like CS) and as such nothing will change.

In my observation; only FaceIT SERVERSIDE client has been close to what I would consider a "success" by anticheat standards. This is a heavily modified version of SMAC for CSGO with some AI aimbot detections and a few other timer based detections.
The reason I consider this "serverside" anticheat such a success is because it blocks most all cheats while also blocking no cheat at all. This is such an effective method because it effectively creates an "even" playing field for all players. Nobody is able to do anything outrageous no matter what kind of cheat they have so everyone (even cheaters) have to play by the rules. With this being said; certain types of cheats do give people an edge... and that is not something you will ever be able to prevent. However the edge given is much smaller and while taking this approach would mean that there are plenty of "cheats available" for the game the cheats won't do very much and many people won't bother. Infact cheaters in these scenarios often get bored of using the cheats because of their lack of any real advantage.... those who need a little bit of an edge but are generally worse players will play at the same level as better players who are legit.

So how do you achieve such a thing? You prevent the fundamentals of cheats at a server level. Measuring reaction time for corner peaking (prevents aggressive triggerbots, which are highly disruptive), measuring angles for invalid angles (preventing spinbots and 3d perfect-accuracy aimbots), using PVS (possible visible scenario) technology to prevent the sending of data to players clients before they should be able to start to see a player (might be similar to this fog of war I see you talk about), and measuring player input speeds for preventing things like perfect bhop and perfect autoshoot. If you measure the angles of players aiming also; you will prevent auto headshot aimbots that aim at the centers of your players hitboxes or bones (there are ways around this, but randomizing where you aim makes the aimbot in general much less effective especially at a distance). You also want to monitor the movements of players on the map and account for lag but measure player travel speeds to prevent any type of speedhacks. Lastly you want to monitor the order in which commands are sent and what is possible through interpolation to prevent rewind hacks like "backtrack" which exist in CSGO. Combine the above techniques with a final skill based matchmaking system like "FairFight" and you will essentially pit the "cheaters" with other "cheaters" and people who have the same skill to play with those cheaters and avoid any game-disrupting scenarios that cause people to quit.

If you truly care about cheating in the game then you would want to implement what I wrote above and ignore this boot-driver garbage that will just be bypassed by cheat devs with private cheats sold to the highest bidders. Even combining the above technique with your boot driver technique is less effective.... this is because the smaller edges that cheats give are more valuable in a game where cheats are blocked for "the masses". Instead if people who "want to cheat" and "can afford it" just purchase these "legit cheats" that will pop up on the market... you only have to deal with cheats that get very popular (through some type of in-game / runtime anti-cheat that deals with signatures and the such). VAC had quite a bit of success with this throughout the years as cheaters were very discouraged after getting banned, despite having a "cheating streak" before that. Delayed bans are definitely useful in this regard.

I remember years ago playing planetside 2 which had an "aggressive anticheat" that used some sort of a driver (I never bothered to look at it) and after dealing with players who teleported through the map stabbing everyone in the back a few times I just simply quit the game. My entire group of friends also quit the game due to these game-disrupting cheats and this is essentially what people are fed up with in CSGO. I saw the same thing in League of Legends years ago with these "crit hacks" that I was on the receiving end of and combined with people botting; ultimately made me and my friends quit LoL also.

VACNet and VAC in general (combined with casual SMAC anticheats) have curbed cheating to some extent that cheaters are often matched with cheaters and people who disrupt games have to go through a great deal of hoops to get back into the game. Forcing them to change their ways or keep purchasing hardware.

So in summary, its best to "allow" some form of cheats to be sold to the public by various developers but curb what is possible with cheats from the get-go. By having a range of "accessable" cheats on the market, it makes for a much easier crack down on popular cheats that may get out of hand. It also saves tons of money on the anti-cheat side because you don't get into this never ending cat-mouse war that has been going on for decades now.

You can choose to listen to me and re-think your strategy or you can choose to go down the route you have already chosen. Just understand that I have more experience in this industry than almost anyone else at this point and I have seen both sides arguments forever. There is no way to "win" as an anticheat dev, just as there is no way to "win" as a cheat developer. Both sides are paid for their respective jobs and honestly cheaters are typically pretty content playing with other cheaters, and regular players are also content with playing with cheaters that they don't know are cheating. The main thing that makes a game "fun" is competitiveness / competition. When you are winning too easily or losing too harshly you tend to get bored and move on.

If you would like to contact me directly you can add me on Telegram or something as my details are pretty public on the internet. I would be more than glad to help to guide you in understanding what the best path to take is to make this game truly a long standing successful game that everyone enjoys playing.

Would you be interested in participating in our bug bounty program?

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by JayQB1

The Vanguard driver can be uninstalled at any time

For now we think a run-at-boot time driver is the right choice.

So... Your anti-cheat is a choice? So cheaters can just uninstall it?

It seems like you're saying two different things throughout your post.

You can uninstall Riot Vanguard any time you like but you won't be able to play the game while it's uninstalled.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by AngryElPresidente

This may or may not be related, but is there any issue of the anti-cheat being triggered in a virtual machine with PCIe card passthorugh'd? My main machine is a server/workstation hybrid.

Sorry, currently we don't support playing the game inside a virtual machine.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by HurtfulThings

I was not aware of this and am not OK with it. I have installed Valorant (not impressed BTW, but whatever). Will uninstalling the game remove the driver and the anticheat software? How can I confirm this driver, and the rest of whatever you have decided to place on my PC outside of the allocated software install, is completely removed? Please provide instructions or a support link. Thx.

P.S. Anti-cheat shouldn't work like malware. FFS you already have cheaters just days into your beta, so whatever you did didn't even work. Get yo shit together.

You can uninstall Riot Vanguard at any time by going to Add/Remove programs.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Xaos_Xaos

Hi, could you confirm whether this driver is removed from a user's device when the game itself is uninstalled. Thanks in advance.

You can uninstall the driver at any time from Add/Remove programs (it's listed as "Riot Vanguard")

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by jaime10super

Something to say about why it is not remove when you delete the game?

You can uninstall the driver at any time from Add/Remove programs (it's listed as "Riot Vanguard"). Technically Riot Vanguard is a separate product to Valorant and can be used by multiple games.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by kkshinichi

As we can't guarantee that it's perfect, maybe one approach on taking on such is a bug bounty program for Vanguard?

Vanguard is in scope for our bug bounty program. You can see the details here: https://hackerone.com/riot or you can email reports to bugbounty@riotgames.com

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by PixelWave

Is it possible to have an option so it behaves as follows: have it not load automatically on start but then if you want to play valorant you have to restart your computer?

For people who would play valorant maybe once a week or similar I think this could be fairly useful, but im not sure how viable it would be.

We don't have an official option like this yet but you can uninstall Vanguard from Add/Remove programs (look for "Riot Vanguard") and it'll work basically how you're suggesting

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by WALKERUU

The fog of War is a very good feature but it can still be improved. Right now a wallhack can still give an advantage because the server don't hold the information as long as it should when an enemy is going around a corner and it don't hold the info at all if the enemy is behind a small wall.

Also the time between the moment a cheat is detected and the cheater is banned has to be reduce.

Yeah these are good points.

The fog of war system could be improved that way, we've erred on the side of not having any gameplay artifacts but we hope that we can tighten this up over time as we have more information about the real world performance of the system.

We're always hoping to reduce the time to ban for cheaters we think we're not doing a great job here yet and will looking to improve it soon.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Germanspartan15

Please provide an official writeup on how to totally remove both the game and the anti-cheat for players who wish to do so. Nobody should have to use an outside resource to figure out how to get rid of software that comes with the game and runs behind the scenes without knowing.

Please also include this information SOMEWHERE in the installation or on the official website, because it’s RIDICULOUS that I only found out about this several days after originally playing.

This all seems incredibly shady, and the fact that there is no official response other than a comment strikes me as odd, especially for an established company like Riot.

Here's our official write up on our Player Support site (from March 6th): https://support-valorant.riotgames.com/hc/en-us/articles/360044648213-Uninstalling-Riot-Vanguard

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Marleysan

For those concerned having basically a rootkit running on kernel level of my laptop all the time like me, can we have a "bandage" solution like a toggle option on the launcher of valorant?

By that I mean having the vanguard anticheat turned off by default on windows startup, and when, only when I decide that it is time to play valorant I fire up my valorant launcher that tells me "hey look the vanguard anticheat system is off you need a system restart to turn it on JUST FOR THIS NEXT STARTUP". So I restart my computer knowing that this time the vanguard anticheat WILL actually start on boot and I play my couple of games and I'm all good (not really but still). Afterwards when I'm finished I close off valorant, and I reboot my pc knowing that during the following startup the anticheat will not be starting again.

I know I will still have a backdoor open on my computer during all the time I'm playing valorant and when the pc remains on after playing but at least I'm in control of WHEN I will be vulnerable. At least I'm not vulnerable all the time...

Edit: this video summarizes well my concerns: https://www.youtube.com/watch?v=_dOCtaBObg4

We don't have a toggle like that available right now but we will consider adding one.

You can effectively implement something like this yourself by uninstalling Vanguard once you're done playing. The game launcher will reinstall it for you next time you'd like to play (it's a small download so it shouldn't take more than a few seconds).

To uninstall Vanguard you can go to Add/Remove Programs and select "Riot Vanguard" or for a more thorough description of the process you can check this article: https://support-valorant.riotgames.com/hc/en-us/articles/360044648213-Uninstalling-Riot-Vanguard

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by NippleSnipplez

Riot Arkem, a lot of people have been saying that this driver on startup should be toggleable for when the game is not running. How do you feel about this? Is it possible we could get this?

We'll look into it, we might be able to make a toggle.

In the mean time you can toggle it manually via the uninstall process. You can uninstall Vanguard separately from the game and reinstall it when you'd like to play again.

Details on how to uninstall Vanguard are here: https://support-valorant.riotgames.com/hc/en-us/articles/360044648213-Uninstalling-Riot-Vanguard

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by BucePla

for some reason I am unable to uninstall this Vanguard program. I went through all the steps given on the support page, and nothing has removed this program. I am given a message to terminate the program, but it never goes away. Wtf ... is this

What happens when you type:

"sc delete vgc" and "sc delete vgk"

into an administrator command prompt?

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by WarpathII

Any word on a fix for the reports about negative performance in other games? I experienced this quite a bit myself over the weekend after installing and it's flat our ruining other games for me. I can't see people keeping this installed if these issued don't get addressed pretty quickly

If you submit a support ticket we can try and troubleshoot it for you and if we find an issue your help will make it much more likely we can fix it for everyone.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Germanspartan15

Great, I appreciate the quick support.

This kind of info needs to be in the installer or on the download page. Crazy that I had to put in so much effort to get this information.

I’m sure a lot of players would feel more comfortable with an official response on this matter. Please consider it.

Thanks!

We have articles about it on our support site and briefly mention it on the game download page but we're also adding a notification during the patching process to make it clearer (I think this notification will come out today but I'm not 100%) eventually the notification will also link to our support articles.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by HappyBunchaTrees

"I'm sorry you feel that way"

What a cop-out, I'd rather deal with the odd cheater inside a reactionary based anti-cheat than this horseshit right here. Are you trying to tell me all Riot employees have this installed on their work PCs? I bet there's an employee version of Vanguard that doesn't open your machine so you guys can protect your assets while putting the rest of us at risk.

Of course not, every computer that's currently playing VALORANT has Vanguard installed including Riot employees' personal and work computers.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Pelt0n

If you want to help build trust, explain how the anti-cheat works more clearly. All I get on install is a text box that says an anti-cheat is installing. Nothing about the fact that it's an always-on anti-cheat.

In the next patcher update (probably next week) we'll be changing that notification to include a link to an article with more details on how the system works. Thanks for the feedback!

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by rookie-mistake

  1. How would I check to make sure even uninstalling vanguard has not left any marks on my system?

this is my exact question too. /u/RiotArkem any help? i wanna play but this makes me nervous

All Vanguard related files are in C:\Program Files\Riot Vanguard here's a guide to how to uninstall it (including a manual removal guide): https://support-valorant.riotgames.com/hc/en-us/articles/360044648213-Uninstalling-Riot-Vanguard

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by JHatter

You've likely already answered this but does Vanguard remain if Valorant is uninstalled? If so, why does it remain and continue to run?

Here's a guide on how to uninstall Vanguard: https://support-valorant.riotgames.com/hc/en-us/articles/360044648213-Uninstalling-Riot-Vanguard

We didn't automatically uninstall Vanguard when Valorant is uninstalled because they are separate products and Vanguard can be used by multiple games.

In hindsight this was a mistake and we're looking into changing this behavior so that Vanguard is uninstalled when Valorant is uninstalled.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by Bonfirey

but can you please clarify in short, crisp and clear english why on earth it is necessary to have this thing run all the time? There's a reason why (almost) noone else has a anti cheat system like this.

At the risk of making you dismiss me as a "lost customer", this is the primary reason why I won't be playing this game (even though I'd love to try it!).

If the driver component loads as the game starts the computer's environment could already be in a compromised state. If a cheat was launched before the game was launched it could have already made changes to the system that would make it easy to bypass our cheat detection scans.

The driver component exists so that when the rest of the anti-cheat system starts up we can have some guarantee that the results it returns are correct and that cheats have not already gained the permissions they need to tamper with the game.

(In regards to your other comment, the game will refuse to initialize if the Vanguard driver wasn't started at boot. So you can remove Vanguard whenever you like but until it's reinstalled the game won't work)

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by amunak

Not the other commenter, but please, don't have a "our anticheat is always right" attitude with your product.

I understand that it's difficult with so many cheaters around to try to judge individual cases, and trust that your system is flawless, but some of us were badly burned by an anticheat that detected a false positive, and for an avid gamer that's one of the worst things that can happen to them. It's unjust, there is no recourse, you have no way to fix it and usually you don't even why specifically you were banned; perhaps what software got you flagged so that you can avoid it in the future.

We're definitely not perfect and we're willing to review punishments we give out to look for false positives. We're happy to overturn bans if we have made a mistake.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by ray29x

could you please really reconsider the 24/7 on startup part of the AC?
it's been negatively impacting other games i play, and having to restart my pc just for a game makes me not want to play it.
also if you wanna be safer when it comes to competitive play why not request to connect a phone number for it like you guys did with league's Clash?

Would you be willing to work with me to troubleshoot? There's some logs you could send me that might help us get to the bottom of your issues. If so please send me a DM.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by DangerousIntern

Can you provide even striped versions of those audits and third party names that did them?

One reason we haven't done something like this is that we paid those firms for their expertise and not their reputations.

When we engaged them we didn't think we'd ever mention them or the services they provided us. These kinds of reviews are a routine part of releasing a new product and not at all something we were expecting to talk about.

Since there's been a lot of interest (and concern) over the security of Vanguard I thought it'd be reassuring to mention the reviews to show that we understand the risks and have a process that includes responsible steps for improving the security of our products. Maybe it was a mistake to mention them at all? I don't know.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by hornytwat12

when is your article coming out? last you told me it was tuesday?

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by ItsMeChad99

I use AHK a lot for work. Will it instantly ban or tell you to close AHK?

Right now we don't ban for just using AHK, if we decided that AHK isn't allowed we would likely tell you to close it rather than ban your account.

almost 4 years ago - /u/riotaredherring - Direct link

Originally posted by brynjolf

Is this compliant with GDPR? What data are you collecting and how are you storing it? What is the main way you store it? Where are you storing it and why? Does it leave the borders of Europe while transferring? How long are you storing data? Can I see and remove the data somewhere? /u/RiotArkem ?

The baseline standard for all privacy across Riot is GDPR as a minimum. In other words, every time we develop something, we make sure it is compliant with GDPR (thanks to the so-called "Berlin Effect").

So, yes, it's GDPR compliant.

I can't answer the questions you have in this thread as I don't know them off the top of my head. You can currently send a GDPR request for League on the league support website; You can try sending that in and mention you want info on VALORANT too (this is likely because the league website, until very recently, was the only 'official' support site). We'll have RTK requests available for VALORANT on their support site very soon.

You can also send an email to our legal department for this info too (please consult with an attorney before doing this).

If you can find evidence of Vanguard not being compliant with GDPR I would recommend you take it up with your local data controller or state equivalent and/or to an attorney that specializes in GDPR.

You can find answers to your specific questions in our privacy policy.

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by TheUberMoose

You may not want to be honest but A GDPR request will force you to hand over everything it collects.

The way your handling this is scummy and honestly I’ve 100% lost interest in the game over this.

I'm sorry to hear that, you might be interested in our latest article about the security and privacy of Vanguard: https://www.riotgames.com/en/news/a-message-about-vanguard-from-our-security-privacy-teams

almost 4 years ago - /u/RiotArkem - Direct link

Originally posted by adamacuo

Is the driver uninstalled when the game in uninstalled?

Here are some instructions on how to uninstall Vanguard: https://support-valorant.riotgames.com/hc/en-us/articles/360044648213-Uninstalling-Riot-Vanguard

The TL;DR is that it's Riot Vanguard in Add/Remove programs but in the future we will automatically uninstall it when the game is uninstalled.