SteamOS leverages namespaces via pressure-vessel already. The problem exists exclusively on Windows. Paravirtualized drivers introduce API incompatibility issues and decades of cumulative engine infrastructure made for Windows using the Win32 API means nobody wants to swap over to using UWP and thus AppContainers are a non-starter (and that's without getting to sacrificing Wine/Proton compatibility).
The native isolation mechanisms like silos are things that require wrangling by professional sysadmins, I didn't even know they existed until I started writing this post. The real question to be asking is why is sandboxing so bad on Windows? Despite some searching, I still have no conclusive answer as to how to go about filesystem isolation in Win32-space, or if it's even possible.
Sandboxing is quite easy (user-wise), once you install the sandbox system. By default it allows only a single sandbox, and with small `.wsb` file you can drive what's visible from the host, whether the GPU should be active, etc. - https://learn.microsoft.com/en-us/windows/security/applicati...
It's great for testing, and Sandbox is just the tip of the iceberg of what Windows Containers support
- e.g. maybe someone can come up with "launcher" that goes through it (somehow).
They are? Games need pretty much all the performance they can possibly get. Can you sandbox them without having a performance impact?
Consider that people pay a $300 premium to get ~10% better performance (buying an RTX 5080 instead of a 5070 Ti).
Personally I know that sometimes closing the web browser in the background makes my game run better - that web browser doesn't even interact with the game! Would a sandbox have a smaller impact?
Buying a better GPU improves your graphics performance and that's basically unrelated to the area where a sandbox impacts performance.
Killing your web browser is probably just lowering memory pressure?
Sandboxes add overhead to syscalls. It's kind of similar to running under Wine, which also adds significant syscalls overhead. Wine also has a much more impactful DirectX translation layer, so your sandbox performance would be probably be much better than the Wine performance.
PC games tend to be the reverse: they demand control over the machine, in order to try to detect or prevent being run alongside various forms of cheating software.
They also need low-latency access to the GPU, which I suspect is a fertile vector for privilege escape exploits.
Only a relatively small (but popular) subset of games use anticheat. Most games -- including the one in this article -- could theoretically run in a sandbox.
Even games with strong anticheat could benefit from sandboxing, as the anticheat mechanisms that need access outside the sandbox represent a much smaller surface area for exploits than the entire game.
In theory, sandboxing mechanisms could even be used to improve anticheat.
What I always sort of assume the endgame could be for highly competitive Windows games is something akin to cartridge or bootable floppy games from the 8-bit era, where games would install into or be supplied as disk images containing locked-down Windows installations that only permit signed (and possibly whitelisted) drivers and whitelisted applications, which would include the game and a small number of other approved applications like Discord, MS Edge and possibly selected third-party browsers, and support software for hardware like GPUs and gaming input devices, which Windows would then boot to run the game, either on bare metal or in an isolated VM.
Proton is just emulation, and it will happily expose the underlying host system to the running game software. In particular the filesystem and some peripheral devices. However, Valve is moving towards sandboxing in Steam. You can already run the whole thing with a flatpak sandbox, and valve themselves are using ostree. With srvio is possible to run the whole thing in a throwaway windows vm while the graphics card is passed through
Anything that wants to traverse your filesystem could do so trivially from a wineprefix, but stuff like sniffing your browser extensions might be harder depending on the technique.
I've formally studied gamedev, but haven't done anything in over a decade, but even before you get to the thorny issue of anti-cheat sustems, games rely on running at a(n often very) low level and doing unconventional things. I imagine they're one of the hardest things there are to sandbox without causing massive levels of breakage. But someone more knowledgeable about either side of the equation (sandboxing and/or game development) might be able to shed more light.
I agree, although I've made exceptions for a very small number of games with Denuvo (actually, just Hogwarts Legacy, which in hindsight I'm glad I did even though it still hurts my soul a bit) and they can run on Linux (I have nothing else but Linux). It's mostly kernel-level anti-cheat that won't run from what I've read.
If it plays on Linux I don't personally care if its got Denuvo, its isolated by Proton, so not really a big deal. I do think its really pointless, because none of these tools ever truly stop game cheating.
Oh yeah completely agree. They don't even stop warez either as it only takes a little while for it to be broken. Mainly all it does is punish paying users, and cost them sales (from people like me) who don't want the potential headache.
Well, Riot Games just today (!) admitted to hard-bricking cheating hardware [1]. This kind of stuff definitely is malware, and your comment aged like milk.
anti-cheat is not perfect. they will brick a legitimate user's pc. that is the opposite of "good for their players".
and even if someone is cheating on a riot game, bricking their pc is obviously fucked, and will end up biting riot in the ass (i.e. not good for riot, either).
the one we're talking about, where riot tweeted "congrats on your $6k paperweights".
>The Riot example above specifically targets DMA cards (cheating hardware) which no legitimate user will have.
you can play league/valorant legitimately, be using dma for whatever else, and apparently riot will still gladly brick your pc.
you apparently don't even need the games currently installed! if you have vanguard leftover from months ago when you did play, remove all the games, and then decide to tinker around with dma for fun/learning/who cares, riot will still come after you, despite not even playing their games.
even if that seems unlikely, refer back to sentence #2 of my comment: "and even if someone is cheating on a riot game, bricking their pc is obviously fucked, and will end up biting riot in the ass (i.e. not good for riot, either)."
Where does it say Riot bricked anything? They referred to the cards as paperweights but they don't need to be bricked to be a paperweight, being useless to the cheater due to Vanguard protections is enough. They definitely didn't brick anyone's PC.
> you can play league/valorant legitimately, be using dma for whatever else
I don't think there's a way to check what memory a DMA card is accessing. I also don't see why legitimate users would have a DMA card. I think it's fair for them to assume a connection is there and react.
DMA cards are not $6k, so it is obvious that riot is not talking about the DMA card specifically. they are ~$300 - ~$700. the image they tweeted alongside was that of broken computers, not of broken DMA cards.
i am not sure why riot would admit to bricking $6k PCs if they werent. that would also be exceptionally stupid.
admittedly, the more i look into it, it appears the reports are soft-bricking (i.e., requiring a complete wipe and reinstallation of the OS, not hard-bricking). which is less awful, but still really awful.
>I also don't see why legitimate users would have a DMA card.
doesn't matter at all. if its not being used to interact with riot games, its none of riot's business and not on riot to determine the legitimacy of owning one.
>I think it's fair for them to assume a connection is there and react.
i think this is a wild take. this is effectively giving ownership of your software and hardware to riot.
if the reaction was simply to ban you from riot servers and games, sure, i could be convinced that's acceptable. but the reaction is beyond that.
> reports are soft-bricking (i.e., requiring a complete wipe and reinstallation of the OS, not hard-bricking)
I still don't think anything is actually bricked. They are just enabling and enforcing IOMMU, HVCI, etc. which prevents them from using their DMA card to cheat. I'm sure they could restore functionality by removing Riot's games and anticheat, disabling IOMMU and HVCI, etc.
> What’s interesting is that while the game itself often crashed during launch, the malicious software continued running quietly in the background.
Wonder how much longer it could have remain undetected if it actually fired up a shovelware game that could run properly, things like crashing probably gave it away way faster than it could've.
> However, someone reportedly hijacked the developer’s Steam account and quickly transformed it into Beyond The Dark – changing its name, screenshots, and other store details. As Steam does not fully verify every patch made to a game, the modified version was reportedly able to go live without raising immediate red flags.
It is interesting that it seems to easier to take over a legit game than trying to create a new one. I have seen this with youtube channels, inactive during a long period of time and suddenly showing mostly scams. Or the original owner became a criminal, or more probably were taken over criminals.
> The malware allegedly searched for cryptocurrency wallet browser extensions, including MetaMask, before connecting to external servers and downloading additional tools. These tools were reportedly capable of stealing browser information, passwords, and cryptocurrency wallet data.
Cryptocurrencies are the most insecure currency that we have even invented. It is paradoxical that is being marketed as actually safe.
The best place to put malware is wherever people don't think they need to be suspicious of the software they run. Free games, paid games, supply chain - it doesn't really matter so long as they think they can trust it blindly.
I remember, ~20 years ago, there was some free Christmas elf game (Flash?) that went viral and everyone was playing it. Struck me as a perfect vector for malware, I was a little surprised that didn’t happen.
This is bound to become more and more pervasive, with supply chain attacks happening extremely frequently now. My cooleagues and me almost got caught in the latest Shai-Hulud attack due to some tanstack packages. Noone is safe now.
Not for nothing but have we all forgotten the sony rootkit? Actually, that would be a perfect front. Start a game company backed by a nation state, put in rootkit anti-cheat, profit.
Games are an almost perfect type of software to be run in a sandbox. The question is, why aren't they already run in a sandbox?
SteamOS leverages namespaces via pressure-vessel already. The problem exists exclusively on Windows. Paravirtualized drivers introduce API incompatibility issues and decades of cumulative engine infrastructure made for Windows using the Win32 API means nobody wants to swap over to using UWP and thus AppContainers are a non-starter (and that's without getting to sacrificing Wine/Proton compatibility).
The native isolation mechanisms like silos are things that require wrangling by professional sysadmins, I didn't even know they existed until I started writing this post. The real question to be asking is why is sandboxing so bad on Windows? Despite some searching, I still have no conclusive answer as to how to go about filesystem isolation in Win32-space, or if it's even possible.
Sandboxing is quite easy (user-wise), once you install the sandbox system. By default it allows only a single sandbox, and with small `.wsb` file you can drive what's visible from the host, whether the GPU should be active, etc. - https://learn.microsoft.com/en-us/windows/security/applicati...
It's great for testing, and Sandbox is just the tip of the iceberg of what Windows Containers support
- e.g. maybe someone can come up with "launcher" that goes through it (somehow).
They are? Games need pretty much all the performance they can possibly get. Can you sandbox them without having a performance impact?
Consider that people pay a $300 premium to get ~10% better performance (buying an RTX 5080 instead of a 5070 Ti).
Personally I know that sometimes closing the web browser in the background makes my game run better - that web browser doesn't even interact with the game! Would a sandbox have a smaller impact?
It certainly could.
Buying a better GPU improves your graphics performance and that's basically unrelated to the area where a sandbox impacts performance.
Killing your web browser is probably just lowering memory pressure?
Sandboxes add overhead to syscalls. It's kind of similar to running under Wine, which also adds significant syscalls overhead. Wine also has a much more impactful DirectX translation layer, so your sandbox performance would be probably be much better than the Wine performance.
> your sandbox performance would be probably be much better than the Wine performance.
That’s hard to believe, given that many games run better under WINE than native Windows.
AIUI, this is relatively rare, and is because of DXVK on games that use old DirectX APIs.
Most of the sandboxing you need for a game is less full sandbox and more a whitelist on file access and local network communication.
PC games tend to be the reverse: they demand control over the machine, in order to try to detect or prevent being run alongside various forms of cheating software.
They also need low-latency access to the GPU, which I suspect is a fertile vector for privilege escape exploits.
Only a relatively small (but popular) subset of games use anticheat. Most games -- including the one in this article -- could theoretically run in a sandbox.
Even games with strong anticheat could benefit from sandboxing, as the anticheat mechanisms that need access outside the sandbox represent a much smaller surface area for exploits than the entire game.
In theory, sandboxing mechanisms could even be used to improve anticheat.
What I always sort of assume the endgame could be for highly competitive Windows games is something akin to cartridge or bootable floppy games from the 8-bit era, where games would install into or be supplied as disk images containing locked-down Windows installations that only permit signed (and possibly whitelisted) drivers and whitelisted applications, which would include the game and a small number of other approved applications like Discord, MS Edge and possibly selected third-party browsers, and support software for hardware like GPUs and gaming input devices, which Windows would then boot to run the game, either on bare metal or in an isolated VM.
Every Xbox game runs in a HyperV container, maybe it's not a crazy idea for PC
Running games on Linux via Proton provides some isolation. It’s not technically a proper sandbox though.
Proton is just emulation, and it will happily expose the underlying host system to the running game software. In particular the filesystem and some peripheral devices. However, Valve is moving towards sandboxing in Steam. You can already run the whole thing with a flatpak sandbox, and valve themselves are using ostree. With srvio is possible to run the whole thing in a throwaway windows vm while the graphics card is passed through
This is why it was foolish to give a new name to it. It was originally called Wine Is Not an Emulator.
It's not a new name. Proton is Valve's fork of wine. They also contribute patches to wine.
I think their point is proton is not an emulator.
You can just use Linux syscalls from an .exe executed by Wine. There is no sandboxing.
https://gist.github.com/q3k/e5952111283ea59ee78a7699919a055b
Anything that wants to traverse your filesystem could do so trivially from a wineprefix, but stuff like sniffing your browser extensions might be harder depending on the technique.
They often are on macOS now. https://developer.apple.com/documentation/security/accessing...
I run Proton in Steam flatpak, as well as itch.io from flatpak. That is reasonable enough isolation for my use case.
Is this not just an artifact of windows not sandboxing anything meaningfully and that itself is an artifact of punch cards?
Some anti piracy is already a sandbox.
I've formally studied gamedev, but haven't done anything in over a decade, but even before you get to the thorny issue of anti-cheat sustems, games rely on running at a(n often very) low level and doing unconventional things. I imagine they're one of the hardest things there are to sandbox without causing massive levels of breakage. But someone more knowledgeable about either side of the equation (sandboxing and/or game development) might be able to shed more light.
What about all the other games with malware, like Denuvo and similar?
I recommend installing Linux. If it wont play on Linux even with Proton, you shouldn't give them a single penny.
I agree, although I've made exceptions for a very small number of games with Denuvo (actually, just Hogwarts Legacy, which in hindsight I'm glad I did even though it still hurts my soul a bit) and they can run on Linux (I have nothing else but Linux). It's mostly kernel-level anti-cheat that won't run from what I've read.
If it plays on Linux I don't personally care if its got Denuvo, its isolated by Proton, so not really a big deal. I do think its really pointless, because none of these tools ever truly stop game cheating.
Oh yeah completely agree. They don't even stop warez either as it only takes a little while for it to be broken. Mainly all it does is punish paying users, and cost them sales (from people like me) who don't want the potential headache.
Gog.com only sells games without DRM.
Most games on itch.io are not DRMed.
"drm is malware" is so 2005.
"We have to stop the nazis" is so 1940s.
"Congress is engaged in a witch hunt" is so 1950s.
"Civil rights should be applied to everyone" is so 1960s.
"Fossil Fuels are destroying the plant" is so 1970s.
"Unregulated free trade is dangerous" is so 1980s.
"The police are out of control and unduly target minorities" is so 1990s.
Something being old doesn't make it less relevant or important.
It means we need to say it louder, because for some reason the point hasn't been made clearly enough yet.
Get the help you need, 4ChanDaily.
:-*
Every day there are new people coming online and/or of age who weren't aware or even alive in 2005. They too need to know that DRM is malware.
"rootkits are malware" is in fact eternal.
Usually when people complain about Denuvo, they're talking about Denuvo Anti-Tamper, which (perhaps surprisingly) is not a rootkit.
When people complain about denuvo rootkits they are complaining about denuvo anti-cheat, which is a rootkit.
A saying being old doesn’t make it invalid anyway. What’s your point?
My point is that this saying is the tritest of the trite, and therefore not worth being posted.
Well, Riot Games just today (!) admitted to hard-bricking cheating hardware [1]. This kind of stuff definitely is malware, and your comment aged like milk.
[1] https://videocardz.com/newz/riot-games-on-valorant-dma-cheat...
It's not a hard-brick. Reinstalling Windows fixes it.
Having to reinstall Windows isn't what it was like back in 2007.
You are confusing drm with anti cheats.
In any case, good for Riot, and good especially for their players!
anti-cheat is not perfect. they will brick a legitimate user's pc. that is the opposite of "good for their players".
and even if someone is cheating on a riot game, bricking their pc is obviously fucked, and will end up biting riot in the ass (i.e. not good for riot, either).
Which anti-cheat has bricked users' PCs? The Riot example above specifically targets DMA cards (cheating hardware) which no legitimate user will have.
>Which anti-cheat has bricked users' PCs?
the one we're talking about, where riot tweeted "congrats on your $6k paperweights".
>The Riot example above specifically targets DMA cards (cheating hardware) which no legitimate user will have.
you can play league/valorant legitimately, be using dma for whatever else, and apparently riot will still gladly brick your pc.
you apparently don't even need the games currently installed! if you have vanguard leftover from months ago when you did play, remove all the games, and then decide to tinker around with dma for fun/learning/who cares, riot will still come after you, despite not even playing their games.
even if that seems unlikely, refer back to sentence #2 of my comment: "and even if someone is cheating on a riot game, bricking their pc is obviously fucked, and will end up biting riot in the ass (i.e. not good for riot, either)."
Where does it say Riot bricked anything? They referred to the cards as paperweights but they don't need to be bricked to be a paperweight, being useless to the cheater due to Vanguard protections is enough. They definitely didn't brick anyone's PC.
> you can play league/valorant legitimately, be using dma for whatever else
I don't think there's a way to check what memory a DMA card is accessing. I also don't see why legitimate users would have a DMA card. I think it's fair for them to assume a connection is there and react.
>They referred to the cards as paperweights
DMA cards are not $6k, so it is obvious that riot is not talking about the DMA card specifically. they are ~$300 - ~$700. the image they tweeted alongside was that of broken computers, not of broken DMA cards.
i am not sure why riot would admit to bricking $6k PCs if they werent. that would also be exceptionally stupid.
admittedly, the more i look into it, it appears the reports are soft-bricking (i.e., requiring a complete wipe and reinstallation of the OS, not hard-bricking). which is less awful, but still really awful.
>I also don't see why legitimate users would have a DMA card.
doesn't matter at all. if its not being used to interact with riot games, its none of riot's business and not on riot to determine the legitimacy of owning one.
>I think it's fair for them to assume a connection is there and react.
i think this is a wild take. this is effectively giving ownership of your software and hardware to riot.
if the reaction was simply to ban you from riot servers and games, sure, i could be convinced that's acceptable. but the reaction is beyond that.
> the image they tweeted alongside was that of broken computers, not of broken DMA cards.
Actually, the image they tweeted shows a ton of PCIe cards.
> DMA cards are not $6k
The ones shown in the image they tweeted are! ($5,800 USD -> https://www.heinodma.com/)
> reports are soft-bricking (i.e., requiring a complete wipe and reinstallation of the OS, not hard-bricking)
I still don't think anything is actually bricked. They are just enabling and enforcing IOMMU, HVCI, etc. which prevents them from using their DMA card to cheat. I'm sure they could restore functionality by removing Riot's games and anticheat, disabling IOMMU and HVCI, etc.
No confusion at all. Same unacceptable "we own your machine now" nonsense.
There is a game - Beyond The Darkness - released few weeks before the name change
"Beyond the Darkness" was released on Nov 14 2024 - https://store.steampowered.com/app/1728610/Beyond_The_Darkne...
"Beyond the Dark" (the malware) was released (ahem, renamed) on Dec 28 2024
> What’s interesting is that while the game itself often crashed during launch, the malicious software continued running quietly in the background.
Wonder how much longer it could have remain undetected if it actually fired up a shovelware game that could run properly, things like crashing probably gave it away way faster than it could've.
> However, someone reportedly hijacked the developer’s Steam account and quickly transformed it into Beyond The Dark – changing its name, screenshots, and other store details. As Steam does not fully verify every patch made to a game, the modified version was reportedly able to go live without raising immediate red flags.
It is interesting that it seems to easier to take over a legit game than trying to create a new one. I have seen this with youtube channels, inactive during a long period of time and suddenly showing mostly scams. Or the original owner became a criminal, or more probably were taken over criminals.
> The malware allegedly searched for cryptocurrency wallet browser extensions, including MetaMask, before connecting to external servers and downloading additional tools. These tools were reportedly capable of stealing browser information, passwords, and cryptocurrency wallet data.
Cryptocurrencies are the most insecure currency that we have even invented. It is paradoxical that is being marketed as actually safe.
Huh. There is the occasional paid game on steam that has a 100% off deal. Guess it's time to start being suspicion of those as well.
I'm thinking of the scenario where the original devs sell the game rights off since sales are bottomed out.
The best place to put malware is wherever people don't think they need to be suspicious of the software they run. Free games, paid games, supply chain - it doesn't really matter so long as they think they can trust it blindly.
Surprised this or malicious games and updates hasn't happened sooner.
It has. For example, PirateFi back in 2025: https://www.bitdefender.com/en-us/blog/hotforsecurity/pirate...
The FBI were seeking victims for ~8 "games" earlier this year: https://forms.fbi.gov/victims/Steam_Malware/view
I remember, ~20 years ago, there was some free Christmas elf game (Flash?) that went viral and everyone was playing it. Struck me as a perfect vector for malware, I was a little surprised that didn’t happen.
This is bound to become more and more pervasive, with supply chain attacks happening extremely frequently now. My cooleagues and me almost got caught in the latest Shai-Hulud attack due to some tanstack packages. Noone is safe now.
Not sure if it was a typo or not but "colleagues" is a great word, I'm going to start using it.
I am starting to think that perhaps their fee is not entirely justified.
And yet games like Subnautica 2 do similar things and nobody stops them because it’s in the EULA.
What does Subnautica 2 have?
i assume they are referring to denuvo.
and, while denuvo and other drm for games is indeed awful, i find it silly to equate it with cryptocurrency stealing malware.
Exactly because it's known - malware is only considered malware if you install it without knowing about it.
But if you know about it you have a choice not to buy / install it, like with games like Subnautica 2.
Next up in Kim's ChatGPT History: "How to buy sockpuppets?"
Not for nothing but have we all forgotten the sony rootkit? Actually, that would be a perfect front. Start a game company backed by a nation state, put in rootkit anti-cheat, profit.