Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Team Fortress 2 source code has leaked

techradar.com

Post reply on HN
Print view View original

31–40 of 167 posts

Re: Team Fortress 2 source code has leaked

#31

Post by deadbunny »

trufas wrote: post #9

The fact that the servers didn't immediately get shut down is pretty irresponsible. There's tens of thousands of people logged in to tf2 who are at risk of having their computers pwned because the tf2 servers are still up.

Valve could shut down the servers they run but there are thousands of community servers they have no control over.

Valve could possibly kill the server browser service for TF2 to stop people searching for servers but then people could just connect directly to the community server of their choice either from their favourites or by IP directly.

They could push an update via steam which bricks the game completely but that would piss off a metric fuckton of the userbase when the game is still playable with some precautions in place (playing on password protected servers with people you know)

A shutdown as you are suggesting would only work with a game with published provided multiplayer servers and no community servers.

I know I for one don't want to live in a world with only publisher provided servers, those games regularly have the servers shut down because they are no longer profitable for the publisher/devs leaving any remaing community out in the wind.

Re: Team Fortress 2 source code has leaked

#32

Post by floatingatoll »

VectorLock wrote: post #5

If the remote code execution thing in CS:GO is true I wonder if it could lead to virtual item theft. We're talking about potential loss of items worth of tens of thousands of dollars. I'm sure Valve could eventually recover them but that could be some serious anxiety and opportunity loss for item holders that are affected.

Valve can unwind any item transaction that occurs within their marketplaces under fraudulent circumstances.

Re: Team Fortress 2 source code has leaked

#33

Post by d1str0 »

3fe9a03ccd14ca5 wrote: post #25
ocdtrekkie wrote: post #19

Earlier quoted context omitted.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

Every statement you just made is speculation and not backed up by any meaningful data. While it’s obviously “easier” to find bugs when you can view the source code, making it one or the other doesn’t bestow any magical protections on the software.

"Time and effort required" in order to find vulnerabilities is not a magical protection. It is a legitimate protection. Not one that should be relied on, but very much something that factors in. Open sourcing software doesn't immediately improve security, but it drastically lowers the barrier of entry for researchers to start looking into it.

Re: Team Fortress 2 source code has leaked

#34

Post by skykooler »

exabrial wrote: post #3

Cheats and hacks were already bad enough, I imagine this won't help :( Darn, one of the most fun games I like to play. Sadly, OSX Catalina killed the game for Mac users because Apple recognized the extreme demand by casual users to break all their old 32bit applications.

I wonder if it would be possible to use this source code to build a 64-bit version?

Re: Team Fortress 2 source code has leaked

#35

Post by colejohnson66 »

ocdtrekkie wrote: post #19
notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

Source code availability makes it a lot easier to find vulnerabilities. Open source code is much more likely to already have been audited better. Closed source code often depends more heavily on security by obscurity, and unexpected source release can definitely make vulnerabilities immediately apparent that weren't known prior.

> Open source code is much more likely to already have been audited better.

Worth keeping in mind this isn’t a silver bullet. OpenSSL with Heartbleed comes to mind.

Re: Team Fortress 2 source code has leaked

#36

Post by ThomPete »

exabrial wrote: post #3

Cheats and hacks were already bad enough, I imagine this won't help :( Darn, one of the most fun games I like to play. Sadly, OSX Catalina killed the game for Mac users because Apple recognized the extreme demand by casual users to break all their old 32bit applications.

I literally just downloaded Steam on the mac to show my boys Team Fortress only to be met by this sad news :(

I really hope something like TF2 resurfaces in some form again. I never liked the feel of Fortnite.

Re: Team Fortress 2 source code has leaked

#37

Post by ccouzens »

MayeulC wrote: post #20
misnome wrote: post #7

Earlier quoted context omitted.

That was 2004, so not a very busy agent... I’m slightly shocked with the phrasing in that post “It is definitely possible that someone could install a virus on your machine by just being in the same server.” That.... seems like a pretty shocking security hole, unless they are talking about unknown possibilities, in which case the term “definitely” is a bad choice. If this can be done with the source, it could have be…

That sounds pretty reasonable to assume for any game, even those that are singleplayer, if they access the network. Game code is particularly known to be "spaghetti", "code cowoy"-style, where the result is more important than the form or correctness. I mean, that's art, after all, so that seems obvious. And do you think a lot of companies update their games after they are out? Most often, the code is definitive, ref…

> sandbox your games. There's a reason I run Steam in a flatpak, on Wayland

If flatpak works perfectly, I suppose an attacker could still steal the "cookie" that automatically logs you into Steam.

Ideally you want Steam to be sandboxed, and then Steam to in turn run all the games in individual sandboxes.

Re: Team Fortress 2 source code has leaked

#38

Post by arrivance »

Cyph0n wrote: post #13
wolfd wrote: post #11

Earlier quoted context omitted.

I doubt it, due to how the leak is purportedly from 2017/2018 code, and according to the tweet from SteamDB is the version that is included to Source engine licensees. The original hl2 code leak was a fan from Germany that hacked into Valve's network and stole a version. https://arstechnica.com/gaming/2016/06/what-drove-one-half-l... There are YouTube channels like VNN that rely on Valve leaks, but most of it seems l…

It was actually leaked to VNN by a Valve employee. VNN then gave it to a small group of friends, one of which went crazy and leaked it. Refer to this r/Games thread for more details: https://reddit.com/r/Games/comments/g61v4x/_/fo6r9ef/?contex...

VNN indicates that he never had access to the code.

https://twitter.com/ValveNewsNetwor/status/12529744828321382...

He also re-tweeted this account of the events https://twitter.com/JaycieErysdren/status/125300494000139878...

Re: Team Fortress 2 source code has leaked

#39

Post by res0nat0r »

3fe9a03ccd14ca5 wrote: post #21
notaplumber wrote: post #17

What is up with the strange sensationalist claims in the article on and Twitter? Source code availability is not a prerequisite to people finding vulnerabilities or RCE exploits in games, there are many established games with open source game clients. Security researchers routinely reverse engineer proprietary software. Bizarre.

I’m wondering the same thing. Is there any evidence of an RCE bug out in the wild? Or was it just wild speculation because the source code is now available? Unless they specifically hardcoded a back door into the game, I’m dubious a leak would result in an RCE so quickly, if ever.

I'm assuming that whomever leaked the code modified it and added a remote exploit to the codebase and that's what folks online are referring to. Happens a lot with shady non-scene type of warez.

Re: Team Fortress 2 source code has leaked

#40

Post by eswat »

misnome wrote: post #7
runawaybottle wrote: post #4

Is there some kind of secret agent inside Valve? Half Life 2 source code got leaked before it’s release date as well (or parts of it). The TF2 subreddit announcement: https://www.reddit.com/r/tf2/comments/g64t0b/data_leak_warni...

That was 2004, so not a very busy agent... I’m slightly shocked with the phrasing in that post “It is definitely possible that someone could install a virus on your machine by just being in the same server.” That.... seems like a pretty shocking security hole, unless they are talking about unknown possibilities, in which case the term “definitely” is a bad choice. If this can be done with the source, it could have be…

There are a few RCE disclosures for Valve games related to this previously

- https://hackerone.com/reports/542180

- https://nvd.nist.gov/vuln/detail/CVE-2020-9005

- https://nvd.nist.gov/vuln/detail/CVE-2020-7952

- https://nvd.nist.gov/vuln/detail/CVE-2020-7951

- https://nvd.nist.gov/vuln/detail/CVE-2020-7950

- https://nvd.nist.gov/vuln/detail/CVE-2020-7949

Post reply on HN