Over the past few days, a controversy has been brewing in the nascent Valorant community. It all has to do with Vanguard, the game’s anti-cheat tech. Players in the closed beta discovered that the anti-cheat software kicks in as soon as you start your PC, and continues to run in the background even when you’re not playing Valorant. After initially raising concerns that this could affect the performance of other games, or cause unforeseen conflicts, players were alerted to a potentially bigger issue. It turns out, Vanguard has a kernel driver component designed to run in Ring 0 of the Windows kernel, the highest possible access level Windows offers. Software that runs in Ring 0 has unfettered, admin-level access that allows it to scan files and make changes without the user’s knowledge. In this case, Vanguard’s driver gains these privileges as soon as it loads up after a fresh boot, regardless of whether or not the game itself is running. Of course, if you’re no longer interested in playing Valorant, the anti-cheat tools can be uninstalled. The idea of such elevated access, however, gave many in the Valorant community pause. For one, even assuming no malice on the part of Riot’s, a breach could expose everyone who has that driver installed to risk, and they wouldn’t even know about it. In response, Riot’s Paul “RiotArkem” Chamberlain explained that a boot-level driver is necessary to counter cheats that rely on booting up before anti-cheats to avoid detection. He also revealed that the driver remains dormant - not scanning any files or sending anything back to Riot - unless the game is running.
“We’ve tried to be very careful with the security of the driver,” Chamberlain wrote. “We’ve had multiple external security research teams review it for flaws (we don’t want to accidentally decrease the security of the computer like other anti-cheat drivers have done in the past). We’re also following a least-privilege approach to the driver where the driver component does as little as possible preferring to let the non-driver component do the majority of work (also the non-driver component doesn’t run unless the game is running).” Chamberlain stressed that all the cheat scans are performed by the other component of Vanguard that isn’t the driver - which is only active when the game is running, adding that it is “an important tool in our fight against cheaters.” With that in mind, Chamberlain revealed that Riot’s intention isn’t for these tools to do more harm than good, and that they could be removed if that turns out to be the case. For now, however, Valorant’s anti-cheat will continue to boot alongside Windows.
