Team Fortress 2 source code has leaked • Hacker News Board

Re: Team Fortress 2 source code has leaked

#21

Post by 3fe9a03ccd14ca5 » Wed, Apr 22, 2020, 8:32 PM UTC

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

I’m wondering the same thing. Is there any evidence of an RCE bug out in the wild? Or was it just wild speculation because the source code is now available?

Unless they specifically hardcoded a back door into the game, I’m dubious a leak would result in an RCE so quickly, if ever.

Re: Team Fortress 2 source code has leaked

#22

Post by whymauri » Wed, Apr 22, 2020, 8:33 PM UTC

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

I've been hearing that an RCE for TF2 is confirmed but not for CS:GO or the other leaked code/clients.

Re: Team Fortress 2 source code has leaked

#23

Post by plopz » Wed, Apr 22, 2020, 8:33 PM UTC

gbrown wrote: post #14

Maybe they should just embrace it and open source the code (without giving away the trademarks). The community is pretty engaged, so I bet it would be a boon for both security and modding.

I don't know what this contains, but many times games cannot be open sourced because they use libraries that would have to be removed before they could open source it.

Re: Team Fortress 2 source code has leaked

#24

Post by whymauri » Wed, Apr 22, 2020, 8:34 PM UTC

3fe9a03ccd14ca5 wrote: post #21

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

I’m wondering the same thing. Is there any evidence of an RCE bug out in the wild? Or was it just wild speculation because the source code is now available? Unless they specifically hardcoded a back door into the game, I’m dubious a leak would result in an RCE so quickly, if ever.

>Unless they specifically hardcoded a back door into the game, I’m dubious a leak would result in an RCE so quickly, if ever.

AFAIK, parts of the source code have already been leaked since 2018 amongst certain circles outside Valve. It's only been in the past few days that this is now common knowledge.

Re: Team Fortress 2 source code has leaked

#25

Post by 3fe9a03ccd14ca5 » Wed, Apr 22, 2020, 8:34 PM UTC

ocdtrekkie wrote: post #19

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

Every statement you just made is speculation and not backed up by any meaningful data. While it’s obviously “easier” to find bugs when you can view the source code, making it one or the other doesn’t bestow any magical protections on the software.

Re: Team Fortress 2 source code has leaked

#26

Post by seabird » Wed, Apr 22, 2020, 8:34 PM UTC

trufas wrote: post #9

The fact that the servers didn't immediately get shut down is pretty irresponsible. There's tens of thousands of people logged in to tf2 who are at risk of having their computers pwned because the tf2 servers are still up.

Valve has no control over user-owned servers, only the listings for the server browser. Valve was informed of this leak years ago. All of this talk of an RCE is pure speculation; the leak hasn't even been out for a day.

It's good to be informed and take steps toward being safe, but we're talking about a leak where any meaningful security flaws have had multiple years to be patched.

Re: Team Fortress 2 source code has leaked

#27

Post by notaplumber » Wed, Apr 22, 2020, 8:36 PM UTC

ocdtrekkie wrote: post #19

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

I have to believe given the sheer size of these communities, that the source code being available only helped to confirm what was already known. The panic seen here hearkens back to the days when companies made similar ridiculous security claims about open source software compared to proprietary software.

Re: Team Fortress 2 source code has leaked

#28

Post by [deleted] » Wed, Apr 22, 2020, 8:36 PM UTC

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

[deleted]

Re: Team Fortress 2 source code has leaked

#29

Post by trufas » Wed, Apr 22, 2020, 8:36 PM UTC

3fe9a03ccd14ca5 wrote: post #21

notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

I’m wondering the same thing. Is there any evidence of an RCE bug out in the wild? Or was it just wild speculation because the source code is now available? Unless they specifically hardcoded a back door into the game, I’m dubious a leak would result in an RCE so quickly, if ever.

Allegedly there's already an exploit in the wild that lets you open a popup in game to all other players in a server. You can find screenshots if you look around the /r/tf2 subreddit.

Re: Team Fortress 2 source code has leaked

#30

Post by MayeulC » Wed, Apr 22, 2020, 8:39 PM UTC

misnome wrote: post #7

runawaybottle wrote: post #4

Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...

That was 2004, so not a very busy agent... I’m slightly shocked with the phrasing in that post “It is definitely possible that someone could install a virus on your machine by just being in the same server.” That.... seems like a pretty shocking security hole, unless they are talking about unknown possibilities, in which case the term “definitely” is a bad choice. If this can be done with the source, it could have be…

> If this can be done with the source, it could have been done before, no?

This analysis is on-point, and something a lot of sources seem to miss. A determined actor can find the exact same exploits with and without access to the source code, though I admit it is much more complicated without ("determined").