full-disclosure - Half-Life 2 source code stolen through IE exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: rbrown at doitt.nyc.gov (Brown, Rodrick)
Subject: Half-Life 2 source code stolen through IE       exploit

I don't see how Microsoft is at fault? This was a known bug released by
Microsoft months ago if they had adequate patches or even a decent
security protocol in placed this would never have happened. 

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of Trey
Mujakporue/UK/Tesco
Sent: Monday, October 06, 2003 4:25 AM
To: full-disclosure@...ts.netsys.com
Cc: nick@...us-l.demon.co.uk
Subject: RE: [Full-Disclosure] Half-Life 2 source code stolen through IE
exploit

The point here is, not to go about bashing Valve. They messed up and
they know they did.
I'd be surprised if after  going public with this, they wouldn't do the
due dilligence thing and do a full code audit.
There really isnt much point in coming up with mad theories and "what
if" scenarios, 
Its happened already!.  *Get over it*

Our time would be better put to use either helping them to track down
the perps or at least lobbying MS into sorting out their security
issues.

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com] On Behalf Of
nick@...us-l.demon.co.uk
Sent: 03 October 2003 18:59
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Half-Life 2 source code stolen through IE
exploit

"Brown, Rodrick" <rbrown@...tt.nyc.gov> wrote:

> This is really sad there development network under all circumstances 
> should not be connected to the internet. This is just lapse security 
> on Valves part. Most big development shops have too workstations on 
> separate networks just for this reason one network will be used for 
> development only and the other for email/internet etc..

Indeed.

How much worse that instead of stealing the source and publicly posting 
it, the attacker had simply inserted a few backdoors into the code and 
checked that into the CVS?  Given that Valve is as careless about 
security as to alow the theft to happen, have you any confidence they 
would detect such a change anytime soon?

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

-------------------Warning------------------------

This e-mail is from outside Tesco - check that it is genuine. Tesco may
monitor and record all e-mails.

---- Disclaimer ----
This is a confidential email.  Tesco may monitor and record all emails.
The views expressed in this email are those of the sender and not Tesco.

Tesco Stores Limited, Tesco House, Delamare Road, Cheshunt, Herts, EN8
9SL: company number 519500. 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html