The new Call of Duty: Warzone anti-cheat system, called Ricochet, will include a kernel-mode driver that gives Activision the ability to access any bit of memory on your PC. Reddit user t_hugs3 seemed to speak for a lot of Warzone players when they said that giving Activision that kind of power “doesn’t sit right” with them—and that they’ve been killed by so many cheaters that they could “honestly give a shit at this point.”
“I play Call of Duty to unwind, not get shit on by a child that spent $30 on an aimbot…” wrote another user. “If a kernel level driver prevents this, have at it.”
Riot Games might’ve hoped for a similar reception to its Vanguard anti-cheat system, which also uses a kernel-mode driver. When Vanguard was announced as the mandatory anti-cheat software for FPS Valorant in 2020, the discourse didn’t give it quite as much slack. Many viewed it as an invasive and dangerous overstep, and some said it was an ill portent for what was to come—the widespread use of kernel-mode drivers that we’re seeing now. Genshin Impact and Doom Eternal have had their own kernel controversies since then.
Why kernel-mode drivers are controversial
Using kernel-mode drivers in anti-cheat systems wasn’t new when Riot announced Vanguard in 2020. Easy Anti-Cheat also uses a kernel-mode driver, as just one example, but Vanguard sparked the first major controversy over the issue. In part, that’s because Riot publicized its use of a kernel-mode driver, introducing many players to a concept that’s hard not to find concerning.
Normal user-mode software is isolated from the rest of your PC and can’t send instructions directly to the CPU or mess with the memory used by Windows and other software. Kernel-mode drivers, on the other hand, can do whatever they want.
On top of that, Riot made it clear that Vanguard’s kernel-mode driver boots with Windows to ensure that cheats can’t launch ahead of it and hide themselves, giving it the rather sinister character of an all-seeing eye that never blinks. It also didn’t help that, early on, Vanguard became known for interfering with non-cheat software that it deemed insecure, such as certain CPU temperature monitors.
Anti-Chinese sentiment also contributed. Riot is owned by Chinese conglomerate Tencent, which also owns portions of Activision Blizzard and Epic Games, and theories about New Cold War spying got mixed in with threads about everyday PC security concerns. Riot has stated that Vanguard’s driver “does not collect or send any information.” It wouldn’t need a kernel-mode driver to do that anyway, but that didn’t stop internet posters from posting.
Riot added a taskbar icon that made it easier to quit out of or uninstall Vanguard, but stuck to its guns, saying that it had to fight cheat makers on their own turf. Plenty of people ultimately accepted the deal, and while Valorant isn’t completely cheater-free as a result of its aggressive anti-cheat tactics—no popular competitive game is—it certainly isn’t as plagued by cheaters as Call of Duty: Warzone.
The reception to Ricochet
Activision now has the benefit of walking a path that’s had the prickliest brush cleared away by Riot. Players are accustomed to the idea that kernel-mode drivers mean more effective anti-cheat, and it helps that Activision says that Ricochet will only run when a Call of Duty game is running. Practically, it probably doesn’t make much of a security difference, but it sounds better.
And Call of Duty: Warzone players are just so tired of cheaters that some of them would probably let Activision use their PCs to perform satanic summoning rituals if it meant fewer hackers. While there are still vocal opponents of kernel-mode anti-cheat—one popular comment says that Activision has “no business messing with the kernel”—I’m not seeing indications that the Warzone playerbase is revolting. The only Ricochet-related petition I can find on Change.org demands that Valve announce a sequel to the game Ricochet.
There is one complication involving a community of artists who rip Call of Duty assets to make custom 3D renders and videos. Ricochet may interfere with a tool they use called Greyhound. Ashley Wise, who handles Call of Duty influencer relations, says that she’s looking into the concerns, but can’t presently guarantee anything one way or another.
I’m aware of the concerns from the 3D artist community regarding RICOCHET ♥️ love our artists and editors, digging into itOctober 13, 2021
Otherwise, if Call of Duty players are on board, the big question is how well Ricochet will work. Just because it includes a kernel-level driver doesn’t mean software cheats won’t get by it, and there are other ways to cheat, such as by using a hardware controller emulator like the Cronus Zen, which can be programmed to give players an advantage with automated input.
Like Riot’s Vanguard, Ricochet is more than just its kernel-mode driver. Activision calls it “multi-faceted,” and says that it’s also using “new server-side tools which monitor analytics.” That may be the way to detect inhuman inputs, but as with the 3D render artists, catching controller emulation could affect non-cheaters in unintended ways, so that’s something to keep an eye on, too.
Ricochet’s anti-cheat kernel driver will come to Call of Duty: Warzone first, releasing with its new Pacific map sometime within the next few months. It will also come to Call of Duty: Vanguard at some point after it launches on November 5. (It makes things really confusing that the next Call of Duty has the same name as Riot’s anti-cheat system.)