Activision unveiled its new secret weapon against Call of Duty cheaters earlier this week, a kernel level anti-cheat called Ricochet that will finally (hopefully) do something about the plague of hackers in Warzone and future Call of Duty games. But then yesterday, disaster appeared to strike when Anti-Cheat Police Department, a Twitter group dedicated to “gathering intelligence on cheats to detect and disrupt cheating vendors,” claimed that the driver had leaked.
“P2C [pay to cheat] devs are already reverse engineering it, this is already very bad,” the group said. Fan site Modern Warzone also claimed to have seen “proof of the source code being scrubbed through.”
According to Vice, however, it wasn’t a leak at all. Activision had said Ricochet would initially roll out with Call of Duty: Warzone’s Pacific update, which is scheduled for early December, but two sources told the site that the system had already been released for some players for testing purposes, and the inevitable happened. Activision later confirmed that Ricochet is in the wild, but didn’t seem too bothered.
“Ricochet Anti-Cheat is in controlled live testing,” the Call of Duty account tweeted. “Before putting it on your PC, we’re testing the hell out of it. Testing includes providing a pre-release version of the driver to selected 3rd parties [and] readying server-side upgrades for launch.”
RICOCHET Anti-Cheat response has been wild this week. So yeah, all good 💥October 15, 2021
That it’s a pre-release version of the driver is important, according to Epic Games technical director Paul Chamberlain, who was previously product head for game security on Riot’s competitive FPS Valorant. Speaking to Vice, Chamberlain said that Activision probably didn’t want the early driver in the hands of cheat makers, but it’s almost impossible to avoid with public testing, and probably worth the headaches in the long run.
“So as long as they weren’t testing with a non-release ready version (for example a non-obfuscated version or a version with debug symbols available) the only impact is that the cheat devs get a small head start,” Chamberlain said. “Running a public test is likely to be more valuable to Activision than the extra secrecy.”
Phantom Overlay administrator Zebleer said the original report of a Ricochet leak was technically accurate because it wasn’t meant to be in the hands of non-testers just yet, but acknowledged that it’s not really a big deal because, as Chamberlain said, they’ll have access to it soon enough anyway. “The only difference that the leak makes is that we have a head start, before implementation, to begin reversing & analyzing now.”
Call of Duty’s new backend anti-cheat features will go live with the launch of Call of Duty: Vanguard on November 5. The kernel level driver will roll out later this year with the Pacific update for Call of Duty: Warzone.