Activision Unveils Ricochet, a Kernel-Level Anti-Cheat for Call of Duty

No one likes a cheater, especially in a multiplayer video game. And what a better example of that than in Call of Duty, one of the most popular multiplayer shooters of all time? Fortunately, efforts to stop cheaters have been made. Activision has announced a bespoke anti-cheating software system called Ricochet. But can it be trusted?

Ricochet Anti-Cheat is a low-level security system developed with Call of Duty: Vanguard and Warzone in mind. The official announcement page boasts a Kernel level driver system, which would (in theory) detect cheating software at even the deepest level.

Kernel-level drivers are given a high level of access to monitor and manage software and applications on a PC, such as your PCs graphics card driver. The driver element of the RICOCHET Anti-Cheat system will check the software and applications that attempt to interact and manipulate Call of Duty: Warzone, providing the overall security team more data to bolster security.

They also mention a Machine Learning system that will automatically watch for suspicious patterns and react accordingly.

Not everyone is excited about this announcement, however. Some might even say unhappy or distrusting. And its due to the kernel level access. For those unfamiliar, the kernel is the lowest level of control on a PC. Think of it as the absolute highest authority on a computer, meaning it can dictate, control, and access literally everything on your computer.

Kernel-level anti-cheat has been a controversial idea in the gaming world for a while now. The idea is that by having maximum clearance, then cheating software cant operate undiscovered. But this also means that the user has to trust the anti-cheat software with such a high level of access. The publishers could use that access to collect data, for example. Or even worse: if the anti-cheat system has a vulnerability and can itself be hacked, then the hackers would have access to the entirety of your PC, which is VERY dangerous. As such, most folks dont trust kernel-level anti-cheat systems.

And if that doesnt instill some justifiable doubt, then perhaps the confidence of Call of Duty hackers will. According to a report by Vice, popular Call of Duty hack developer Phantom Overlay isnt concerned about Ricochets reveal, thinking itll only hide the obvious users.

Hello Ricochet anti-cheat. Goodbye Warzone only competitors who copy & paste from UnknownCheats. Goodbye rage cheaters filling every lobby. Goodbye hacker vs. hacker. Hello Phantom Overlay. Hello kernel-mode. Hello legitimate looking cheating. Hello fun.

The hard part for the Ricochet team will be to be effective in kernel against us, which I do not believe they will be, especially at first, and even more so with a non-invasive approach.

Phantom Overlay (or at least an admin for them) expanded to say that the system will only weed out the lazier and intentionally obvious cheaters. And that by doing so, theyll actually cultivate a better hacker environment.

Quality cheat sellers hate a cheating problem just as much as non-cheating players do. It means more competition for us, including very low quality competition. The Warzone cheat market in particular has been saturated & plagued with a ridiculous amount of providers who mostly paste their source from public or semi-private places such as UnknownCheats or GuidedHacking. We very much want a challenge so that we can overcome it & watch as many of our annoying competitors exit scam their customers, who will then come to us.

We recognize that Warzone has a cheating problem. But all things considered, granting Activision kernel-level access to our computers doesnt exactly feel comforting, either. But since anti-cheats arent exactly optional, Warzone players are being given a tough choice: trust Ricochet or uninstall the game.

Meanwhile, console players are laughing away. Theyre not shooting very accurately, but the fights are fair, at least.