{
  "id": 14838477,
  "title": "Epic's EAC2 v2 seems fairly easily bypassable",
  "url": "https://urgent.news/2026/10/15/epics-eac2-v2-seems-fairly-easily-bypassable",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-15T22:48:19.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://codon.org.uk/~mjg59/blog/p/epics-eac2-v2-seems-fairly-easily-bypassable/"
  },
  "original_language": "en",
  "account": "Epic has unveiled version 2 of their Linux-based Easy Anti-Cheat (EAC2 v2), which employs Linux's eBPF security module, coupled with additional infrastructure to thwart potential bypasses. Crucial components include the requirement for secure boot activation, and the use of measured boot to validate secure boot's activation and the relevant keys utilized (preventing the creation of one's own modified kernel). Moreover, remote attestation is incorporated, enabling the TPM to generate a signed boot measurements copy and transmit it to a server for verification. This intricate process hinges on the TPM's capability to attest to the system's integrity, an aspect that poses significant challenges.\n\nThe EAC2 v2 implementation necessitates proving the authenticity of measurements provided by the TPM. To accomplish this, one must possess a list of legitimate TPM vendors and their certificate authority (CA) keys. However, this process can be circumvented as every TPM is assigned a unique Endorsement Key (EK) and associated certificate, which is signed by the TPM vendor. One can verify the measurements' origin from a genuine TPM by cross-referencing the list of authorized vendors and their corresponding CA keys.\n\nWhen it comes to accessing the TPM's measurements at runtime, the TPM is located on a small plugin module with a standard pinout, containing a reset pin. By shorting this pin to ground momentarily, the TPM returns to its initial state, enabling userland to input arbitrary measurements. Furthermore, a modified kernel can replicate the expected log values from a secure boot-enabled and trusted kernel boot, causing the TPM to generate an accurate set of measurements, thereby meeting the checker's criteria.\n\nAlthough a TPM mounted directly on the motherboard or embedded within the CPU/chipset may present challenges, a USB-to-SPI bridge coupled with a Linux driver can facilitate the connection of a TPM module intended for motherboard installation. By configuring the kernel to disregard the motherboard TPM and designate the USB TPM as the trusted source, one can program the USB TPM with a set of trusted measurements. This approach allows the eBPF code to be deceived, ensuring seamless operation.\n\nHowever, the effectiveness of remote attestation on PCs is questionable, particularly when associating a specific TPM with a particular system proves difficult. This limitation is prevalent in most environments except for enterprises. Consequently, an alternative solution might be to discourage cheaters by requiring them to invest in a TPM, a seemingly insignificant investment. In the event that a cheat detection server flags a specific TPM, blocking it would compel cheaters to acquire a new TPM, potentially deterring their efforts. Despite these considerations, the technical viability of EAC2 v2 remains questionable.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}