9 ms·
Hackers demand $10M from Riot Games to stop leak of ‘League of Legends’ code
- WhatsName 4y agoKudos for transparency. On the other hand it reads the same as any other breach press statement I've read. It seems to be clearly carved to not include a single bit more information than necessary(undeniable). Wish these were written by security people instead of a PR/Compliance/legal taskforce.
- jwestbury 4y agoThey did say they'll have a full report with more technical details forthcoming. Having been involved in a few incidents which had substantial public post-mortems, they need to go through a LOT of revision and approvals. They generally take more than a week to release, especially when they have security implications.
- neoncontrails 4y agoThe timeline of events might explain why they're proceeding with caution. Last Wednesday, 46 people were let go[1]; that Friday, Riot tweets that their development systems were compromised "earlier in the week." Insider job, perhaps? I wonder. [1] https://www.eurogamer.net/riot-games-reportedly-making-layoffs https://www.eurogamer.net/riot-games-reportedly-making-layof...
- PradeetPatel 4y ago> Wish these were written by security people instead of a PR/Compliance/legal taskforce. Additional transparency is always better for the consumer. However, one must ask - what would that achieve for the business? Providing technical details may open them up to additional scrutiny from the general public, and potentially regulatory bodies. Another additional risk is that the more information disclosured, the harder it is to control the narrative. As someone who used to work in reputation management, ensuring a cohesive and correct narrative in mainstream & social media is an essential component of reputation damage control.
- Zetobal 4y agoMost of their clients are not even adults...
- bradhe 4y agoHonestly would love to see how these games are built...
- jdmichal 4y agoWe already knew that. Everything is coded as a minion. It's an geeky in-joke from the old Warcraft3 DotA and early LoL days. Please don't murder me. https://www.reddit.com/r/dotamasterrace/comments/4pozfx/can_someone_explain_me_coded_as_minion_meme/ https://www.reddit.com/r/dotamasterrace/comments/4pozfx/can_...
- Q6T46nT668w6i3m 4y agoSo … Unreal? ;)
- bob1029 4y agoI think it is natural that every game engine eventually winds up with some sort of god object placed into a recursive, tree-like structure. You need some abstraction to represent "a thing in the world" and usually a way to say if a thing is subordinate to another thing. Minon, GameObject, Actor, Item, etc., are all solving the same problem.
- aliqot 4y ago> I think it is natural that every game engine eventually winds up with some sort of god object placed into a recursive, tree-like structure. I experienced less distress when discovering Santa wasn't real.
- shoo 4y agoreduce the signal to noise ratio of your cache reads with this one weird trick! data-oriented game engine developers hate him! more seriously, resources explaining why and how not to do this: CppCon 2014 Mike Acton Data Oriented Design and C++ https://www.youtube.com/watch?v=92KFSD3ObrY https://www.youtube.com/watch?v=92KFSD3ObrY Richard Fabian's book: https://www.dataorienteddesign.com/dodbook/ https://www.dataorienteddesign.com/dodbook/ Handmade Seattle 2021 Andrew Kelley A Practical Guide to Applying Data-Oriented Design https://media.handmade-seattle.com/practical-data-oriented-design/ https://media.handmade-seattle.com/practical-data-oriented-d...
- w4rh4wk5 4y agoAny chance attackers got hold of Valorant's anti-cheat?
- Operyl 4y agoThey mentioned "legacy anticheat system" so it seems unlikely. Given that the source code for that internally is probably much more guarded, smaller specialized team, I would be surprised if it got included.
- darkwizard42 4y agoKind of more curious if they found a way to mess with the kernel level access given when installing games like Valorant.
- daheza 4y agoMaybe the attackers can make TFT scale correctly on the ipad.
- eska 4y agoTime to look for all the FIXME comments in the Viego and Mordekaiser code.
- 71bw 4y agos/Viego and Mordekaiser/Yuumi and Yasuo
- deleted 4y ago[deleted]
- IYasha 4y agoI loled very hard when compared leaked MS headers to official ones once :D They've removed harsh words from the comments )
- ricardobayes 4y agoThere are even tons of fixme comments in react code.
- lpapez 4y agoLooking forward to seeing Tyler1's reaction.
- meltyness 4y agoICYMI Riot makes players install a kernel-level driver to play games, so we might be witnessing the start of a once-in-a-decade cybersecurity Chernobyl. https://news.ycombinator.com/item?id=22855600 https://news.ycombinator.com/item?id=22855600
- Y_Y 4y agoIf the lasting tragedy of Chernobyl was the curtailment of nuclear power in favour of burning hydrocarbons, then will the victim of Cheriotnobyo be thsy society turns against MOBAs?
- 0cf8612b2e1e 4y agoThis is why I begrudgingly had to build a separate PC for nothing but gaming. Furious that it is the only way to firewall the cowboy coding what-is-security development practices of the industry.
- viraptor 4y agoWhy a separate PC rather than a separate boot drive?
- 0cf8612b2e1e 4y agoIf the drives live in the same host system, they should be mountable by the other OS. The untrusted gaming partition/drive could then manipulate the trusted one. In practice, that would require the malware to be specifically targeted to dual-booters (representing a tiny fraction of users). Much better to go after the millions of Windows gaming PCs that also host the entirely of someone’s digital life. Which is to say the physical separation likely buys me little real security, but it does make me feel better.
- scotty79 4y agoMaybe you could keep the secure partition encrypted?
- bluelightning2k 4y agoI wonder how many places have some super weird spaghetti with a comment saying // because Sylas
- TheFattestNinja 4y agoOverride def isProjectile=true //Yasuo,Samira
- pitkali 4y agoI remember reading somewhere that, I think, Jarvan ult at least used to be coded as a group of tightly packed special minions.
- notshift 4y agoNo wonder they refuse to remove creep block.
- apetresc 4y agoHave the attackers actually leaked the code publicly yet, or are they just threatening to for now?
- otuva 4y agoTo my understanding, they demanded ransom a couple of days after the initial breach and not leaked anything yet. Granted that their motivations are purely financial, they would try to sell first. And if it's not worth anything, they'd release it then.
- dang 4y agoUrl changed from https://threadreaderapp.com/thread/1617900234734198787.html https://threadreaderapp.com/thread/1617900234734198787.html, which points to this. I know people have strong prefs for/against different styles, but please post alternative links in the comments and keep the top-level URL for the canonical source. This is in the site guidelines ("Please submit the original source. If a post reports on something found on another site, submit the latter." - https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html).
- gnabgib 4y agoThe vice article[0] seems more substantial than the twittering (although it does reference these tweets it also includes a copy the ransom demand and the lack of reply from riot) [0]: https://www.vice.com/en/article/qjky8d/hackers-demand-dollar10m-from-riot-games-to-stop-leak-of-league-of-legends-source-code https://www.vice.com/en/article/qjky8d/hackers-demand-dollar...
- dang 4y agoOk, changed to that from https://twitter.com/riotgames/status/1617900234734198787 https://twitter.com/riotgames/status/1617900234734198787. Thanks!
- hahalolha 4y ago[flagged]
- boomboomsubban 4y agoI highly doubt this hack will lead to Riot relicensing the game.
- revskill 4y agoCurious to know if there's discord for HN LOL players ?
- xeyownt 4y agoThat's a leak of legends.
- RangerScience 4y agoLast time I saw one of those, it was playing Stardew Valley!
- canadiantim 4y ago[flagged]
- SoraNoTenshi 4y agoThis pun made me happy and sad at the same time.
- lwansbrough 4y agoI’d be curious to see how a game as complex as League manages the balance between engine development and scripting.
- scotty79 4y agoI don't see how getting more eyeballs on that code can harm it.
- errantmind 4y agoWhen the TF2 code was leaked, it resulted in new vectors of attack on the servers being found and the development of bots that are still ruining the game.
- russelg 4y agoCathook (the main botting tool) has been in existence since at least Oct 2016, which is a year older than the code in the source leak.
- errantmind 4y agoYea, that existed, but it got even worse after the code was released. There are many examples of issues that most likely resulted from the leak. For example: https://www.reddit.com/r/tf2/comments/rbpyh0/this_happened_when_i_tried_to_kick_someone_with/ https://www.reddit.com/r/tf2/comments/rbpyh0/this_happened_w...
- fps-hero 4y agoImagine if you could simply deploy an army of fuzzers on a piece of code, vs what could be derived from client side probing. Yes, having access to the source is a problem.
- maeln 4y agoWhich wouldn't have been an issue for too long if Valve was still maintaining TF2. For a game still being maintained and developed like LoL, a new vector of attack would probably only last for a few days before it is patched or mitigated.
- scotty79 4y agoIt's a bit different because TF2 is basically abandonware.
- mise_en_place 4y agoWhat's interesting is the very specific sum they are asking for. I wonder how they arrived at that sum. Although it is a good question, how do you value the src for a multimillion dollar game?
- Gasp0de 4y agoIt's going to be the Leak of Legends
- kleiba 4y agoHonestly, what would happen if a company like Riot Games would just release their source code? As far as I can see, perhaps the two most relevant "risks" are the following: 1. Competition: now your competitors know exactly how to program a game like League of Legends. Well, guess what: they already knew that before. 2. Attack vectors: if your game's security relies on the code not being available, that basically boils down to "security by obscurity". I don't quite get from the vice.com link whether the assets were also stolen but I understand that there's probably more value in them than in the code.
- psychphysic 4y agoI guess one risk is that they see a copy pasted chunk of GPL code. Or that a portion looks suspiciously like something a former Dev wrote for you before moving to riot. Worse still a bunch of competitors suddenly have insight into prospective future features. I'm sure the source code is part of the company's net worth should things go tits up.
- wepzen 4y agoYeah, that's definitely a risk for any company. If a competitor gets their hands on their code, it could be a major setback for them. And if someone sees a copy-pasted chunk of GPL code, it could lead to legal trouble. But, the real problem is that it's hard to put a number on the potential losses. A leak could lead to all sorts of unforeseen consequences that can't even be predicted. The best thing a company can do is invest in protecting their source code. It's not just a line item on a balance sheet, it's a crucial part of a company's net worth.
- thot_experiment 4y agoThe idea that "security through obscurity is not security" is a dumb meme that needs to die. In the real world security through obscurity is absolutely security. Your threat model is not super hackers with unlimited resources, obscurity helps, in some cases it helps a LOT. (to be clear I'm responding specifically to your second point, I believe RIOT is institutionally incompetent and it is fully possible to have a game with an open source core that has less cheating than LoL, I also believe that the folks at RIOT are incapable of such a thing because of a combination of bad incentives and incompetence)
- slowhadoken 4y agoI’d like to rub my eyeballs all over that code. I don’t care for Tencent.
- gggggg5 4y agoLeague source code has leaked multiple times though? Probably most famously in the LoLIP-OP incident.
- wepzen 4y agoIt's ridiculous that source code leaks happen so frequently. Even if it's inevitable to a certain degree, it sometimes seems like companies aren't doing enough to protect it. It's a shame that valuable company assets like source code can be so easily compromised.