full-disclosure - Half-Life 2 source code stolen through IE exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3F7E61B5.22783.D9AA286@localhost>
From: nick at virus-l.demon.co.uk (Nick FitzGerald)
Subject: Half-Life 2 source code stolen through IE exploit

"Brown, Rodrick" <rbrown@...tt.nyc.gov> wrote:

> This is really sad there development network under all circumstances
> should not be connected to the internet. This is just lapse security on
> Valves part. Most big development shops have too workstations on
> separate networks just for this reason one network will be used for
> development only and the other for email/internet etc..

Indeed.

How much worse that instead of stealing the source and publicly posting 
it, the attacker had simply inserted a few backdoors into the code and 
checked that into the CVS?  Given that Valve is as careless about 
security as to alow the theft to happen, have you any confidence they 
would detect such a change anytime soon?

-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854