6 ms·

Should I shed tears for them for getting hacked, or laugh to them because they are not taking security seriously?

emilsedgh 5y ago
I'm inclined to laugh at them but honestly what does it even mean at this point to take security seriously? It appears that the only companies capable of being secure are Google and Apple. Aside them everyone is getting hacked every other day.
- papito 5y ago
  Imagine a world where there is no, say, AWS. So many basic security things that we take for granted are automatically set up for you in the cloud, as most shops out there could not care for it to save their own lives. Companies that torch through millions of dollars of VC money need a nice ransomeware kick in the ass to set up a MongoDB password, and will proactively ignore S3 warnings to not make something public, so what do you expect?
  - bserge 5y ago
    I can imagine it, I see many independent security consultants and companies making money instead of Amazon.
NmAmDa 5y ago
I think this my first time I see a leaked source code for a closed source product before its lunch. Viva battlefield 2042. Cheats will be available in a time record.
- din-9 5y ago
  Half Life 2 was a big one https://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article https://www.eurogamer.net/articles/2011-02-21-the-boy-who-st...
  - Hamuko 5y ago
    The Half-Life 2 leak happened way before launch (13 months) and there were a lot of changes when it actually released. 2042 is much closer (4 months) if the release date keeps.
    - joshspankit 5y ago
      The HL2 leak was super cool and practically a behind the scenes copy. Untextured walls, unfinished levels, all sorts of fascinating test areas. Great reference.
Aeronwen 5y ago
Shed tears because they're not taking security seriously.
- guavaNinja 5y ago
  No, laugh to them for getting hacked. It's EA afterall.
  - joshspankit 5y ago
    In the old days, EA used to mean genuinely good games with great level design. It’s not even close to the same company now, but I understand some people being sad because they still think about EA as old EA.
qwerty456127 5y ago
I feel neither sorrow nor laugh. Just joy about the fact the source code is going to be available.
- NmAmDa 5y ago
  Maybe it is not going to be available publicly after all.
- squarefoot 5y ago
  Not sure if it is a good thing, besides plain studying, though. Imagine some developer in perfect good faith who finds some interesting graphics code online with no references to EA and a fake Open Source license attached to it, and that code happens to be part of EA's code, then imagine this developer incorporating them into an Open Source game, maybe just 150 lines of code out of several tens of thousands. EA's lawyers would hardly ignore him, and the poor guy would see his own career and possibly his entire life ruined. Not to mention the possibility of becoming a case against Open Source.
rplnt 5y ago
> because they are not taking security seriously? I don't think is necessarily the case. You can take security seriously, but there are limits, and you have to balance the effort with the willingness of someone breaching your safeguards. I would use a bicycle as an example. You can buy whatever lock you want, it can be broken by someone. The better the lock, the less people can get through it or are less inclined to do so anyway. You can pay a security guard to look after your bike, but at some point, if your bicycle is really valuable, one guard can be bribed (or killed), and so on, and so on. In summary, just because they were "hacked" does not mean they are not taking security seriously.
- silviot 5y ago
  > In summary, just because they were "hacked" does not mean they are not taking security seriously. To some extent though it does mean they were not taking security seriously _enough_. In your example, they misjudged whether they needed a guard or not. [EDIT] Actually, I realized it's not about taking it seriously, but executing it efficiently.
  - sabas123 5y ago
    Even so, they could have defended perfectly against a threat model, which might have been completely reasonable. But it might have been pure bad luck. Although I don't know any of the details.
- darumderum 5y ago
  > I don't think is necessarily the case Back then, when they enforced a maximum 16 character password, I saw enough security. Are they storing them in plaintext or what? Btw, I think they increased the limit to 32 now
  - kenniskrag 5y ago
    some hashing algorithm don't allow longer passwords. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#:~:text=bcrypt%20has%20a%20maximum%20length,be%20enforced%20when%20using%20bcrypt https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor....
incrudible 5y ago
Realistically, what are you going to do to protect against this case? Your developers/artists are going to use Windows machines, they're going to need access to the source code and access to the internet. Add in a 0-day and that's all the the ingredients to allow for exfiltration of data. Ultimately, there is no protection against this. Of course you can make your employees' lives worse by siloing them off, enforcing all sorts of security policies and so on. It's just not worth it in this case. So the source code of some video games got leaked... big deal. What are hackers going to do with it, make their own version of Battlefield and FIFA? Write snarky comments on how crappy the code is? Maybe they'll develop cheats, but that can also be done without the source code.
- nradov 5y ago
  Application whitelisting can prevent most vulnerabilities from being exploited.
  - incrudible 5y ago
    Application whitelisting can prevent the execution of unapproved executables, that's about it. Oh, you need to run Python scripts? You're using npm? There go your whitelisting efforts... Whitelisting also won't protect you from exploits in the software itself. If some non-technical user gets compromised and starts sending out malicious PDFs, you better make sure every single installation of Acrobat is up-to-date. If you get hit by a 0-day in Outlook - good luck. Now perhaps in this case people were just sloppy, but again, if you want to rule out exfiltration of data - as opposed to just making it less likely - you need a completely different approach and it'll cost you.

I'm inclined to laugh at them but honestly what does it even mean at this point to take security seriously? It appears that the only companies capable of being secure are Google and Apple. Aside them everyone is getting hacked every other day.

papito 5y ago
Imagine a world where there is no, say, AWS. So many basic security things that we take for granted are automatically set up for you in the cloud, as most shops out there could not care for it to save their own lives. Companies that torch through millions of dollars of VC money need a nice ransomeware kick in the ass to set up a MongoDB password, and will proactively ignore S3 warnings to not make something public, so what do you expect?
- bserge 5y ago
  I can imagine it, I see many independent security consultants and companies making money instead of Amazon.

NmAmDa 5y ago

I think this my first time I see a leaked source code for a closed source product before its lunch. Viva battlefield 2042. Cheats will be available in a time record.

din-9 5y ago
Half Life 2 was a big one https://www.eurogamer.net/articles/2011-02-21-the-boy-who-stole-half-life-2-article https://www.eurogamer.net/articles/2011-02-21-the-boy-who-st...
- Hamuko 5y ago
  The Half-Life 2 leak happened way before launch (13 months) and there were a lot of changes when it actually released. 2042 is much closer (4 months) if the release date keeps.
  - joshspankit 5y ago
    The HL2 leak was super cool and practically a behind the scenes copy. Untextured walls, unfinished levels, all sorts of fascinating test areas. Great reference.

Aeronwen 5y ago

Shed tears because they're not taking security seriously.

guavaNinja 5y ago
No, laugh to them for getting hacked. It's EA afterall.
- joshspankit 5y ago
  In the old days, EA used to mean genuinely good games with great level design. It’s not even close to the same company now, but I understand some people being sad because they still think about EA as old EA.

qwerty456127 5y ago

I feel neither sorrow nor laugh. Just joy about the fact the source code is going to be available.

NmAmDa 5y ago
Maybe it is not going to be available publicly after all.
squarefoot 5y ago
Not sure if it is a good thing, besides plain studying, though. Imagine some developer in perfect good faith who finds some interesting graphics code online with no references to EA and a fake Open Source license attached to it, and that code happens to be part of EA's code, then imagine this developer incorporating them into an Open Source game, maybe just 150 lines of code out of several tens of thousands. EA's lawyers would hardly ignore him, and the poor guy would see his own career and possibly his entire life ruined. Not to mention the possibility of becoming a case against Open Source.

rplnt 5y ago

> because they are not taking security seriously? I don't think is necessarily the case. You can take security seriously, but there are limits, and you have to balance the effort with the willingness of someone breaching your safeguards. I would use a bicycle as an example. You can buy whatever lock you want, it can be broken by someone. The better the lock, the less people can get through it or are less inclined to do so anyway. You can pay a security guard to look after your bike, but at some point, if your bicycle is really valuable, one guard can be bribed (or killed), and so on, and so on. In summary, just because they were "hacked" does not mean they are not taking security seriously.

silviot 5y ago
> In summary, just because they were "hacked" does not mean they are not taking security seriously. To some extent though it does mean they were not taking security seriously _enough_. In your example, they misjudged whether they needed a guard or not. [EDIT] Actually, I realized it's not about taking it seriously, but executing it efficiently.
- sabas123 5y ago
  Even so, they could have defended perfectly against a threat model, which might have been completely reasonable. But it might have been pure bad luck. Although I don't know any of the details.
darumderum 5y ago
> I don't think is necessarily the case Back then, when they enforced a maximum 16 character password, I saw enough security. Are they storing them in plaintext or what? Btw, I think they increased the limit to 32 now
- kenniskrag 5y ago
  some hashing algorithm don't allow longer passwords. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#:~:text=bcrypt%20has%20a%20maximum%20length,be%20enforced%20when%20using%20bcrypt https://cheatsheetseries.owasp.org/cheatsheets/Password_Stor....

incrudible 5y ago

Realistically, what are you going to do to protect against this case? Your developers/artists are going to use Windows machines, they're going to need access to the source code and access to the internet. Add in a 0-day and that's all the the ingredients to allow for exfiltration of data. Ultimately, there is no protection against this. Of course you can make your employees' lives worse by siloing them off, enforcing all sorts of security policies and so on. It's just not worth it in this case. So the source code of some video games got leaked... big deal. What are hackers going to do with it, make their own version of Battlefield and FIFA? Write snarky comments on how crappy the code is? Maybe they'll develop cheats, but that can also be done without the source code.

nradov 5y ago
Application whitelisting can prevent most vulnerabilities from being exploited.
- incrudible 5y ago
  Application whitelisting can prevent the execution of unapproved executables, that's about it. Oh, you need to run Python scripts? You're using npm? There go your whitelisting efforts... Whitelisting also won't protect you from exploits in the software itself. If some non-technical user gets compromised and starts sending out malicious PDFs, you better make sure every single installation of Acrobat is up-to-date. If you get hit by a 0-day in Outlook - good luck. Now perhaps in this case people were just sloppy, but again, if you want to rule out exfiltration of data - as opposed to just making it less likely - you need a completely different approach and it'll cost you.