Ricochet is the new Call of Duty: Warzone anti-cheat system. It includes a kernel-mode driver that allows Activision to access all of your computer’s memory. The Reddit user, t_hugs3, seemed to be speaking for many Warzone players when he said Activision’s power was “not right”. He also mentioned that they have been so cheated that they can’t give a damn at this point.
“I play Call of Duty because I want to unwind, and not get shitted by a child who spent $30 on an aimbot …” wrote another player. You can do it if a kernel-level driver blocks this.
Riot Games may have hoped for similar reactions to its Vanguard anti-cheat system. It also uses a kernel-mode driver. The discourse wasn’t as generous when Vanguard was made mandatory anti-cheat software in FPS Valorant 2020. Many saw it as an overstep and dangerous, while others thought it was a sign of what was to follow–the widespread adoption of kernel-mode drivers. Since then, Doom Eternal and Genshin Impact have experienced their kernel controversies.
Why kernel-mode drivers are controversial
Riot’s 2020 announcement of Vanguard was not the first time kernel-mode drivers were used in anti-cheat software. Easy Anti-Cheat, for example, also uses kernel-mode drivers. However, Vanguard was the catalyst for major controversy. Riot’s use of a kernel-mode driver was a big reason for this, as it introduced many players to the idea that is hard to ignore.
Normal user-mode software can be isolated from the rest. It cannot send instructions directly to your CPU or alter the memory used for Windows and other programs. Kernel-mode drivers can, however, do what they please.
Riot also made clear that Vanguard’s kernel-mode driver boots Windows to prevent cheats from launching ahead of it. This gives it the sinister appearance of an all-seeing, never blinking, eye. Vanguard was also known early on for interfering in non-cheat software it considered insecure such as certain CPU temperature monitors.
The anti-Chinese sentiment was also a contributing factor. Tencent, a Chinese conglomerate, owns Riot. It also owns parts of Activision Blizzard, Epic Games, and Activision Blizzard. This led to conspiracy theories about New Cold War spying mixed with concerns about PC security. Riot stated that Vanguard’s driver does not collect or transmit any information. Although it wouldn’t be necessary to use a kernel-mode driver, that didn’t stop internet users from posting.
Riot added a taskbar icon to make it easier to uninstall Vanguard or quit out of Vanguard. But Riot remained firm in its resolve to stop cheaters from gaining control on its turf. Many people accepted the deal. While Valorant may not be completely free from cheaters due to its aggressive anti-cheat strategies–a popular competitive game is-–it isn’t as plagued as Call of Duty: Warzone.
Activision has the advantage of being able to walk a path cleared by Riot. It is a common belief that kernel-mode drivers are more effective at anti-cheat. Activision states that Ricochet can only run while a Call of Duty title is running. It doesn’t make much difference in security, but it does sound better.
Call of Duty: Warzone gamers are so fed up with cheaters that they would allow Activision to use their PCs for satanic summoning rituals. There are still many people who oppose kernel-mode anti-cheat. One popular comment states that Activision has “no business messing around with the kernel”. However, I don’t see any indications that Warzone players are revolting. Change.org has the only Ricochet-related petition that demands that Valve announce a sequel.
One problem is a group of artists who use Call of Duty assets for custom 3D renders or videos. Ricochet could interfere with Greyhound, a tool they use. Ashley Wise is the Call of Duty influencer relations manager. She says she is looking into the issues, but cannot guarantee anything.
If Call of Duty players have joined, the main question is how Ricochet will perform. It doesn’t necessarily include a kernel-level driver, but that doesn’t mean that software cheats can’t use it. There are also other cheating methods, such as using a hardware controller emulator, like the Cronus ZEN, which can be programmed so players have an advantage with automatic input.
Ricochet, like Riot’s Vanguard is more than a kernel-mode driver. Activision describes it as “multi-faceted” and claims that it is also using “new server-side tools to monitor analytics.” This may help detect inhuman inputs. However, as with the 3D renderers, controller emulation could also affect non-cheaters unintendedly. That’s why it’s important to monitor.
Ricochet’s anti-cheat kernel driver for Call of Duty: Warzone will be available first. It will release its new Pacific map sometime in the next few months. After the launch of Call of Duty: Vanguard on November 5, it will also be available to Call of Duty: Vanguard. It is confusing that the next Call of Duty will have the same name and anti-cheat system as Riot.