Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CD Projekt Red has been subject to a cyber attack and ransom demand

twitter.com

Post reply on HN
Print view View original

31–40 of 252 posts

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#31

Post by gambiting »

atoav wrote: post #6
uncledave wrote: post #2

Now the 2077 source is public, can we crowdsource the bug fixes?

I had one "I need to reload the game or else it won't work"-type of bug in 100 hours of gameplay. I have seen games that have been much much worse 4 years after the release than this game in it's current state.

So I was constantly advocating for this game non-stop since I played about 30 hours without any major bugs and it worked fine. Then I got to a mission that I couldn't finish because it was telling me to get into a car at the end, and the car was always exploded and upside down. I played that mission 4 times every time with the same effect. Then I tried another mission and a very similar thing happened, couldn't finish it because the objective was inaccessible. I gave up at that point, I might come back to it in 6 months once it's in working state.

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#33

Post by simiones »

dijit wrote: post #16

The note makes it seem like the attackers got access to their internal network; but the (admittedly little) information I have on the subject indicates that the perforce server was hosted on the internet with username/password access (not cert based authentication as is recommended by Helix these days). I suppose the IT team got overwhelmed with requests to open up the firewall for people working from home during the…

> I suppose the IT team got overwhelmed with requests to open up the firewall for people working from home during the pandemic and just opened it for the whole internet.

I would expect access to source code to be strictly from a VPN with controlled IPs, people shouldn't be accessing such sensitive information directly from their IPs, exactly because it makes it very hard to control access.

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#34

Post by wokwokwok »

valvar wrote: post #24
dijit wrote: post #16

The note makes it seem like the attackers got access to their internal network; but the (admittedly little) information I have on the subject indicates that the perforce server was hosted on the internet with username/password access (not cert based authentication as is recommended by Helix these days). I suppose the IT team got overwhelmed with requests to open up the firewall for people working from home during the…

This may be a stupid question, but isn't it standard practice to require that employees use VPN? Why would they expose servers to the internet?

Perhaps, but I’d say it’s quite hard to do this effectively when you’re using sass products. Even if you’re self hosting, and have dozens or hundreds of WFH employees, what’s the alternative?

No access for anyone while you scale your VPN? Just wait while everyone pulls and pushes gigs of data over the VPN to perforce, you didn’t need that video meeting after all?

You’ll get a big fat nope to that when you try to do it; this is a pretty tough challenge you’re trivialising here.

Google “zero trust” as an alternative; clearly they didn’t do that properly either, but I can at least understand why they didn’t just demand everyone use a VPN.

Trivial VPN use cases like people who d/l source code and have then occasional 5 person video meeting and this use case are not the same thing.

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#35

Post by frou_dh »

volta83 wrote: post #25
dijit wrote: post #16

The note makes it seem like the attackers got access to their internal network; but the (admittedly little) information I have on the subject indicates that the perforce server was hosted on the internet with username/password access (not cert based authentication as is recommended by Helix these days). I suppose the IT team got overwhelmed with requests to open up the firewall for people working from home during the…

Sorry. What year is it? Must be somewhere in the 1990s since you've mentioned perforce multiple times.

Someone showing ignorance and being smug about it at the same time? In 2021?

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#36

Post by skocznymroczny »

bspammer wrote: post #22

I know it’s unethical, but I’m kinda excited for the source release. When was the last time we saw the source for a AAA game?

Doom 3?

Unreal Tournament 4 was kind of developed in the open too as far as I know.

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#37

Post by rootw0rm »

ethbr0 wrote: post #15
phire wrote: post #5

Earlier quoted context omitted.

It's not a given that the hacker will even release the source code. With the ransom threat rebuffed publicly, they might not be bothered to actually distribute the files, or they might choose to keep them privately for bragging rights. And then it's entirely possible the source code might not be in a compilable state without lots of work. But the biggest problems are the copyright issues. CDPR will be well within the…

> publishing unofficial builds of the source code You could patch installed files and/or at runtime, no? With patches being wholly original work? I'm not actually sure how IP law works for something like that.

IANAL, but things are complicated. even if you're patching on the fly with original work, you could theoretically find yourself violating a user agreement against reverse engineering, etc. i think it's utter rubbish, but that seems to be the world we find ourselves in.

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#38

Post by eterm »

skocznymroczny wrote: post #36
bspammer wrote: post #22

I know it’s unethical, but I’m kinda excited for the source release. When was the last time we saw the source for a AAA game?

Doom 3? Unreal Tournament 4 was kind of developed in the open too as far as I know.

DOOM 3 is ancient, it was written closer to the time of DOOM than now.

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#39

Post by 2pEXgD0fZ5cF »

bspammer wrote: post #22

I know it’s unethical, but I’m kinda excited for the source release. When was the last time we saw the source for a AAA game?

A few months ago the source code of Counter Strike GO and Team Fortress 2 were leaked.

Re: CD Projekt Red has been subject to a cyber attack and ransom demand

#40

Post by dijit »

sitharus wrote: post #26
volta83 wrote: post #25

Earlier quoted context omitted.

Sorry. What year is it? Must be somewhere in the 1990s since you've mentioned perforce multiple times.

I've been told that a lot of game development uses Perforce as it handles large media assets quite well.

(tacking on here because I can't reply to the parent now)

I've worked for 2 game companies and they both used perforce quite extensively, and Google used perforce internally until they built a re-implementation based on those concepts but tailored for google's needs (called Piper).

For scripts, honestly, it's not my favourite, but it definitely has it's strengths and Git can't compete if you're in that niche.

Post reply on HN