Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Team Fortress 2 source code has leaked

techradar.com

Post reply on HN
Print view View original

11–20 of 167 posts

Re: Team Fortress 2 source code has leaked

#11

Post by wolfd »

runawaybottle wrote: post #4

Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...

I doubt it, due to how the leak is purportedly from 2017/2018 code, and according to the tweet from SteamDB is the version that is included to Source engine licensees.

The original hl2 code leak was a fan from Germany that hacked into Valve's network and stole a version. https://arstechnica.com/gaming/2016/06/what-drove-one-half-l...

There are YouTube channels like VNN that rely on Valve leaks, but most of it seems like running `strings` on their update files. He does claim to have some inside sources, but they mostly seem to provide social commentary on Valve internal politics.

Re: Team Fortress 2 source code has leaked

#12

Post by papermachete »

trufas wrote: post #9

The fact that the servers didn't immediately get shut down is pretty irresponsible. There's tens of thousands of people logged in to tf2 who are at risk of having their computers pwned because the tf2 servers are still up.

There was (is?) also remote code execution on counter-strike 1.6 servers valve didn't act upon for 10+ years.

Re: Team Fortress 2 source code has leaked

#13

Post by Cyph0n »

wolfd wrote: post #11
runawaybottle wrote: post #4

Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...

I doubt it, due to how the leak is purportedly from 2017/2018 code, and according to the tweet from SteamDB is the version that is included to Source engine licensees. The original hl2 code leak was a fan from Germany that hacked into Valve's network and stole a version. https://arstechnica.com/gaming/2016/06/what-drove-one-half-l... There are YouTube channels like VNN that rely on Valve leaks, but most of it seems l…

It was actually leaked to VNN by a Valve employee. VNN then gave it to a small group of friends, one of which went crazy and leaked it.

Refer to this r/Games thread for more details: https://reddit.com/r/Games/comments/g61v4x/_/fo6r9ef/?contex...

Re: Team Fortress 2 source code has leaked

#17

Post by notaplumber »

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software.

Bizarre.

Re: Team Fortress 2 source code has leaked

#18

Post by MisterTea »

misnome wrote: post #7
runawaybottle wrote: post #4

Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...

That was 2004, so not a very busy agent... I’m slightly shocked with the phrasing in that post “It is definitely possible that someone could install a virus on your machine by just being in the same server.” That.... seems like a pretty shocking security hole, unless they are talking about unknown possibilities, in which case the term “definitely” is a bad choice. If this can be done with the source, it could have be…

Servers can distribute custom maps and assets to players so there's a mechanism to download files to a users computer.

As for uploads, players used to be able to set custom models in quake 2 which were distributed to other players on the server. Though I am not sure if that was done by server admins in special cases for clan payers or members or if there was an actual upload mechanism in the game engine.

Re: Team Fortress 2 source code has leaked

#19

Post by ocdtrekkie »

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

Re: Team Fortress 2 source code has leaked

#20

Post by MayeulC »

misnome wrote: post #7
runawaybottle wrote: post #4

Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...

That was 2004, so not a very busy agent... I’m slightly shocked with the phrasing in that post “It is definitely possible that someone could install a virus on your machine by just being in the same server.” That.... seems like a pretty shocking security hole, unless they are talking about unknown possibilities, in which case the term “definitely” is a bad choice. If this can be done with the source, it could have be…

That sounds pretty reasonable to assume for any game, even those that are singleplayer, if they access the network.

Game code is particularly known to be "spaghetti", "code cowoy"-style, where the result is more important than the form or correctness. I mean, that's art, after all, so that seems obvious.

And do you think a lot of companies update their games after they are out? Most often, the code is definitive, refactors are out of the question, etc. I've never seen a bug that fixes a security issue (CVE), let alone for old titles.

And that's when RCE is not by design. It is in Garry's mod, but that's for client-side mode scripted with lua, so theoretically sandboxed. Unreal Tournament 99 though, has plenty of servers that put some dlls for "anti-cheat" software on your computer before you join. That one probably sn't sandboxed.

While we talk about anti-cheat software, can we think a moment about everything that could go wrong with a piece of software that has a very deep access to the system, is sometimes in-house, and not necessarily audited, and whose functionality often includes:

* downloading challenges from servers, patch them into RAM and see what happens

* scan the RAM of the whole system, plus the filesystem, for known exploits

* upload parts of that RAM and filesystem to random servers for analysis

* take screenshots, log keypresses, monitor the system and upload all of this.

Takeaway: sandbox your games. There's a reason I run Steam in a flatpak, on Wayland... Convenience is part of it, but that's not the main one.

Post reply on HN