Epic's new Linux anti-cheat looks beatable with a $20 adapter

Epic has announced version 2 of its Linux implementation of Easy Anti-Cheat. At its heart is the eBPF security module watching what the system is doing, surrounded by machinery meant to keep that watchdog from being bypassed. The scheme rests on three pillars: mandatory Secure Boot (so a modified kernel can't run), measured boot (to confirm Secure Boot is on and the right keys are in use), and remote attestation — the TPM signs a snapshot of the boot measurements, and a server checks that it came from a genuine TPM with the correct keys before letting you into the game.

The whole thing rests on one assumption: that the measurements presented are real. Proving that, as Matthew Garrett shows, is much harder than it sounds.

Resetting the TPM at runtime

Forging a quote with your own key won't work: every TPM has an Endorsement Key with a certificate signed by its vendor, and a list of trusted vendors lets the server tell a real chip from a homemade one. So the measurements have to come from a real TPM. But on many desktop boards the TPM sits on a pluggable module with a standard pinout — including a reset pin. Short it to ground briefly and the chip returns to its initial state, after which userland can write whatever values it likes. Boot a modified kernel that lies to the eBPF code, replay the expected log from an honest boot into the TPM, and it will happily hand over a perfectly legitimate set of measurements.

Someone else's TPM over USB

And if the chip is soldered to the board or buried in the CPU? Trickier, but not by much. The quote has to come from a TPM — just not necessarily the one in your machine. Modern TPMs connect over the SPI bus, and Microchip makes a USB-to-SPI bridge with a Linux driver. Wire up an ordinary pluggable TPM module through it, tell the kernel to ignore the onboard chip, point /dev/tpmrm0 at the USB device loaded with pre-written "trusted" measurements, and once again everything looks fine.

Why this happens

Remote attestation on PCs works poorly wherever you can't tie a specific TPM to a specific system — which is nearly everywhere outside the enterprise. Maybe that doesn't matter in practice: few cheaters may want to spend the twenty-odd dollars such a rig costs, and a server that trips its detector can simply block that one TPM, forcing the cheater to buy another. That friction might be enough to put people off. But technically, Garrett concludes, this is not great.

Source: Lobsters