11 ms·

HelloKitty ransomware rebrands, releases CD Projekt and Cisco data

76 points by sam42 2y ago

user_7832 2y ago
> As first spotted by VX-Underground, a group of developers have already compiled Witcher 3 from the leaked source code, sharing screenshots and videos of development builds. > One representative of the group compiling Witcher 3 known as 'sventek' told BleepingComputer that the leaked CD Projekt data is 450 GB uncompressed and contains source code for Witcher 3, Gwent, Cyberpunk, various console SDK (PS4/PS5 XBOX NINTENDO), and some build logs. > Sventek told BleepingComputer that they were previously able to compile Cyberpunk 2077 from the CD Projekt's leak... Is 450gb really that big enough? Games are individually often close to a hundred gb, and I'd assume the source code has more things.
- mschuster91 2y ago
  > Is 450gb really that big enough? Games are individually often close to a hundred gb, and I'd assume the source code has more things. Raw assets like textures, I'd guess? These often get downscaled and compressed as part of build.
  - user_7832 2y ago
    Thanks, didn't realize this was w/o textures
  - bluefirebrand 2y ago
    Apparently a huge part of the average game's download size nowadays is uncompressed audio
    - mschuster91 2y ago
      Uncompressed audio? Why the fuck would anyone even want to do that? Even computers 20 years ago could handle Vorbis or if they were fancy enough to buy a decoder MP3 audio. Today's multicore monsters can easily handle dedicating an entire core to sound effects only.
      - Cixelyn 2y ago
        you check in the uncompressed audio, and then fmod, wwise or whatever other middleware you're using will compress to a different format and compression ratios on a per-platform basis during the build process (i.e. vorbis on PC, AT9 on PS4, FADPCM on mobile, etc.)
        mschuster91 2y ago
        Yeah that makes sense, but the person I replied to suggested that the end user's assets would be uncompressed as well. The only scenario I can think of is games supporting surround sound which can't afford the extra cycles of decompression.
        bluefirebrand 2y ago
        I was looking for a good reason why this might be and all I could find was an old HN thread suggesting that uncompressing audio takes CPU cycles so leaving it uncompressed helps to avoid CPU bottlenecks when you have a game that might be playing a lot of sfx at once
        fbdab103 2y ago
        Titanfall was infamous for this[0] PC gamers (especially those with SSDs) were puzzled to find out that Titanfall had a gargantuan 48 GB file size, despite the lack of a single player campaign and the fact that it was running on a modified source engine. Some digging around in the files revealed that a huge portion of that size was due to a whopping 35 GB of completely uncompressed audio. Respawn has now explained that the reason the audio was not compressed was so they could dedicate more system resources to running the game, and less to unpacking audio files. ... He did, however, admit that most PC gamers probably wouldn’t even notice the difference. “On a higher PC it wouldn’t be an issue. On a medium or moderate PC, it wouldn’t be an issue, it’s that on a two-core [machine] with where our min spec is, we couldn’t dedicate those resources to audio.” [0] https://www.escapistmagazine.com/titanfall-dev-explains-the-games-35-gb-of-uncompressed-audio/ https://www.escapistmagazine.com/titanfall-dev-explains-the-...
      - 2y ago
- iLoveOncall 2y ago
  450GB is 450 TRILLION characters. Assets are not part of the source code, so this is huge. That's almost 20,000 times all of Wikipedia, or 2 whole single page applications using a JavaScript framework!
  - user_7832 2y ago
    > Assets are not part of the source code, so this is huge. Aah thanks, that helps clarifying it. Yep, without media I could see that that many lines of code would be a lot. But how would they make the game without textures? I guess just ripping them from the published version, or just going "it compiles!" and calling it quits?
    - georgemcbay 2y ago
      Assuming the code is complete enough to be compiled, I would guess that it has no problem reading any content assets from the commercial version (even if they are packed into custom packaging files) with the major concern being versioning related (maybe the most recent source code branch references to various assets might not match up exactly with what is on disc for a specific retail build). But also it isn't that uncommon at game studios for assets to be checked in alongside the code, so I wouldn't be shocked if these source code dumps and the associated sizes being reported also include the assets.
  - denotational 2y ago
    > 450GB is 450 TRILLION characters. 450GB is ~450•10^9 B (~ to handle the fact that it might be GiB), which is 450 billion bytes in the short scale (450 thousand million/450 milliard in the long scale). 1B may or may not equal 1 character depending on your encoding, but 1000 characters per byte is unlikely.
  - Macha 2y ago
    > Assets are not part of the source code, so this is huge. Depends how linguistically precise the hackers are being. I could see them calling the contents of a repository the source code, and to my understanding, especially around the time of witcher 3's development, a lot of game dev studios used Perforce specifically because they were checking assets in and Perforce handled that better.
- deaddodo 2y ago
  If you see an application with 1% of 450gb worth of code, run as far as you possibly can. That's a Lovecraftian horror. Also, it also almost certainly does not exist. The largest codebases would be lucky if they hit a 200MBs-2GB of straight code. And they're far an away the exceptions, not the norm.
  - geek_at 2y ago
    They are probably talking about source code and assets, which makes 450gb very realistic
    - deaddodo 2y ago
      The person I am responded to specifically said "code": > Games are individually often close to a hundred gb, and I'd assume the source code has more things They acknowledge they were mistaken about code size in a sister comment.
  - MarkSweep 2y ago
    > it also almost certainly does not exist Google has billions of lines of code in one repo. I don’t have hard numbers on file sizes, but a billion bytes is a gigabyte. A billion lines taking tens of gigabytes does not seem unreasonable. https://cacm.acm.org/research/why-google-stores-billions-of-lines-of-code-in-a-single-repository/ https://cacm.acm.org/research/why-google-stores-billions-of-... > That's a Lovecraftian horror Perhaps.
    - Aloisius 2y ago
      Google's repo contains more than a single application.
      - ChainOfFools 2y ago
        But you see, now we know that GP knows how big Google's repo is, a detail from which we are perhaps to conclude I suspect, falsely, but who knows) they are or were employed as an engineer there, despite making an argument that seems well below the common sense threshold even to a non-engineer, Google or otherwise.
- dijit 2y ago
  450GiB is probably right. I’ve worked on a bunch of AAA game projects and the “MAIN” stream is usually somewhat small because people often want to have multiple checkouts on one drive.
  - andersa 2y ago
    On the project I'm currently working on, we use filters to disable syncing groups of art assets we don't need, so a checkout for an engineer is usually quite reasonable. Probably also around 400GB though it includes the engine. With all filters disabled I'd end up downloading multiple terabytes of stuff for the main branch.
    - dijit 2y ago
      Ah yeah, we keep things like blender/maya models on a separate stream completely. Usually the main stream can compile the entire game so it has all the required assets, but not everything that is used to make the assets for the game in the first place.
agilob 2y ago
Have almost the same thing been leaked before, but now decryption keys are released? Edit Found it, previously they released a magnet link called funnytorrent that was over 800gb, but all files are 7z encrypted and no password was available. There are still seeds :O So I'm guessing the new thing is the new TW3 version CDP confirmed this week they are working on. Edit 2 The "new magnet" link is the same hash, so no new files in there.
tester756 2y ago
It sucks because their games are really good
- orbital-decay 2y ago
  How much harm can a source leak really do for a game released long ago? Especially for CDPR, owners of GOG.com and big proponents of DRM-free games.
  - Mountain_Skies 2y ago
    Probably not much danger that players will end up with pirated copies of the games, especially those with an online component, but having the source code will make finding cheats and security vulnerabilities easier.
    - mschuster91 2y ago
      Don't get why you've been downvoted to grey, you make a very valid point particularly regarding security issues given the recent Apex Legends hack [1]. [1] https://www.tweaktown.com/news/96928/apex-legends-pro-players-get-hacked-during-na-finals-ea-confirmed-compromised/index.html https://www.tweaktown.com/news/96928/apex-legends-pro-player...
    - arandomusername 2y ago
      They're all single player games (except maybe Gwent?).
    - devwastaken 2y ago
      Shouldn't be serious vulns if they made it correctly. If they didn't, they were there waiting to be exposed eventually and are still the corps fault.
  - DaiPlusPlus 2y ago
    Indirectly: the source-code will include third-party licensed libraries, stuff like audio and video decoding/rendering and other middleware - so they could be sued by the original devs/licensors for not keeping that protected.
grzeshru 2y ago
Can we get a StarCraft or Warcraft 3 leak?
- DaiPlusPlus 2y ago
  I’d love to see the source-code comments over-time as they tweaked the balancing rules in SC… but are these leaks just a snapshot of the file system or does it include the full source-control history?
  - boneitis 2y ago
    If you haven't seen it before, you might enjoy Patrick Wyatt's (a lead dev for a time at Blizzard) blog. It is a treasure trove of anecdotes and war stories. https://www.codeofhonor.com/blog/ https://www.codeofhonor.com/blog/
    - DaiPlusPlus 2y ago
      Ah yes - I remember reading his article about the origins of StarCraft way-back-when - when StarCraft was still a low-effort "Orcs in space" re-skin of Warcraft 2, but they went to E3 or CES and got spooked by Ion Storm's demo of their visually impressive, isometric, RTS game - and reinvented SC - released SC - and the rest is history - while it turned out Ion Storm's demo was a prerendered video fake. That's a story right there.
      - DaiPlusPlus 2y ago
        Right here: https://www.codeofhonor.com/blog/starcraft-orcs-in-space-go-down-in-flames https://www.codeofhonor.com/blog/starcraft-orcs-in-space-go-...
        accrual 2y ago
        Extremely cool read, thank you for sharing this. The author's other posts are interesting too. I learned they disabled collision for resource harvesting units so they could smoothly fly through each other on the way to/from the base and resources.
GaggiX 2y ago
Are there any companies that would actually pay the ransom? Because I have never seen one.
- rnewme 2y ago
  Yes, there are. Some ransonware groups are reputable, and keep their word so they keep being trusted by future victims.
- nxobject 2y ago
  One of the key insurance claims clearinghouses in America's hilariously privatised health care system was hacked – and they paid $22 million to one ransomware group (which is chump change to their corporate parent, United Health, robber capitalism incarnate.) What they didn't anticipate was that the same data was _hacked twice_. [1] [1] https://www.wired.com/story/change-healthcare-ransomhub-threat/ https://www.wired.com/story/change-healthcare-ransomhub-thre...
- agilob 2y ago
  It's like to be another survivorship bias. The paying ones aren't talked about in media because their business isn't obstructed that much. Pay, get data back, no harm to the reputation, maybe we never even hear about it.
- TrexArms 2y ago
  I got a panic phone call from one of of the companies I used to do contract work for, "Do you know how to buy bitcoin? We got hacked and the website isn't working and we're trying to pay so we can use our computers again." I stopped what I was doing and drove over there. Luckily someone DDoS'd the pay site so they couldn't pay. I asked them what they were thinking. They told me that they were going to pay with their super prestigious credit card and refute the charge as fraud because in their words, "Technically, this is fraud." I shook my head and cleaned it up and restored the backups. I asked them a week later how much data was lost. They asked me what I was talking about. Apparently they didn't have anything important they did since the backup ran the night before. They switched to a SaaS shortly afterwards. Then raided by the government & shut down a couple years later. Good times.

76 points by sam42 2y ago

> As first spotted by VX-Underground, a group of developers have already compiled Witcher 3 from the leaked source code, sharing screenshots and videos of development builds. > One representative of the group compiling Witcher 3 known as 'sventek' told BleepingComputer that the leaked CD Projekt data is 450 GB uncompressed and contains source code for Witcher 3, Gwent, Cyberpunk, various console SDK (PS4/PS5 XBOX NINTENDO), and some build logs. > Sventek told BleepingComputer that they were previously able to compile Cyberpunk 2077 from the CD Projekt's leak... Is 450gb really that big enough? Games are individually often close to a hundred gb, and I'd assume the source code has more things.

mschuster91 2y ago
> Is 450gb really that big enough? Games are individually often close to a hundred gb, and I'd assume the source code has more things. Raw assets like textures, I'd guess? These often get downscaled and compressed as part of build.
- user_7832 2y ago
  Thanks, didn't realize this was w/o textures
- bluefirebrand 2y ago
  Apparently a huge part of the average game's download size nowadays is uncompressed audio
  - mschuster91 2y ago
    Uncompressed audio? Why the fuck would anyone even want to do that? Even computers 20 years ago could handle Vorbis or if they were fancy enough to buy a decoder MP3 audio. Today's multicore monsters can easily handle dedicating an entire core to sound effects only.
    - Cixelyn 2y ago
      you check in the uncompressed audio, and then fmod, wwise or whatever other middleware you're using will compress to a different format and compression ratios on a per-platform basis during the build process (i.e. vorbis on PC, AT9 on PS4, FADPCM on mobile, etc.)
      - mschuster91 2y ago
        Yeah that makes sense, but the person I replied to suggested that the end user's assets would be uncompressed as well. The only scenario I can think of is games supporting surround sound which can't afford the extra cycles of decompression.
        bluefirebrand 2y ago
        I was looking for a good reason why this might be and all I could find was an old HN thread suggesting that uncompressing audio takes CPU cycles so leaving it uncompressed helps to avoid CPU bottlenecks when you have a game that might be playing a lot of sfx at once
        fbdab103 2y ago
        Titanfall was infamous for this[0] PC gamers (especially those with SSDs) were puzzled to find out that Titanfall had a gargantuan 48 GB file size, despite the lack of a single player campaign and the fact that it was running on a modified source engine. Some digging around in the files revealed that a huge portion of that size was due to a whopping 35 GB of completely uncompressed audio. Respawn has now explained that the reason the audio was not compressed was so they could dedicate more system resources to running the game, and less to unpacking audio files. ... He did, however, admit that most PC gamers probably wouldn’t even notice the difference. “On a higher PC it wouldn’t be an issue. On a medium or moderate PC, it wouldn’t be an issue, it’s that on a two-core [machine] with where our min spec is, we couldn’t dedicate those resources to audio.” [0] https://www.escapistmagazine.com/titanfall-dev-explains-the-games-35-gb-of-uncompressed-audio/ https://www.escapistmagazine.com/titanfall-dev-explains-the-...
    - 2y ago
iLoveOncall 2y ago
450GB is 450 TRILLION characters. Assets are not part of the source code, so this is huge. That's almost 20,000 times all of Wikipedia, or 2 whole single page applications using a JavaScript framework!
- user_7832 2y ago
  > Assets are not part of the source code, so this is huge. Aah thanks, that helps clarifying it. Yep, without media I could see that that many lines of code would be a lot. But how would they make the game without textures? I guess just ripping them from the published version, or just going "it compiles!" and calling it quits?
  - georgemcbay 2y ago
    Assuming the code is complete enough to be compiled, I would guess that it has no problem reading any content assets from the commercial version (even if they are packed into custom packaging files) with the major concern being versioning related (maybe the most recent source code branch references to various assets might not match up exactly with what is on disc for a specific retail build). But also it isn't that uncommon at game studios for assets to be checked in alongside the code, so I wouldn't be shocked if these source code dumps and the associated sizes being reported also include the assets.
- denotational 2y ago
  > 450GB is 450 TRILLION characters. 450GB is ~450•10^9 B (~ to handle the fact that it might be GiB), which is 450 billion bytes in the short scale (450 thousand million/450 milliard in the long scale). 1B may or may not equal 1 character depending on your encoding, but 1000 characters per byte is unlikely.
- Macha 2y ago
  > Assets are not part of the source code, so this is huge. Depends how linguistically precise the hackers are being. I could see them calling the contents of a repository the source code, and to my understanding, especially around the time of witcher 3's development, a lot of game dev studios used Perforce specifically because they were checking assets in and Perforce handled that better.
deaddodo 2y ago
If you see an application with 1% of 450gb worth of code, run as far as you possibly can. That's a Lovecraftian horror. Also, it also almost certainly does not exist. The largest codebases would be lucky if they hit a 200MBs-2GB of straight code. And they're far an away the exceptions, not the norm.
- geek_at 2y ago
  They are probably talking about source code and assets, which makes 450gb very realistic
  - deaddodo 2y ago
    The person I am responded to specifically said "code": > Games are individually often close to a hundred gb, and I'd assume the source code has more things They acknowledge they were mistaken about code size in a sister comment.
- MarkSweep 2y ago
  > it also almost certainly does not exist Google has billions of lines of code in one repo. I don’t have hard numbers on file sizes, but a billion bytes is a gigabyte. A billion lines taking tens of gigabytes does not seem unreasonable. https://cacm.acm.org/research/why-google-stores-billions-of-lines-of-code-in-a-single-repository/ https://cacm.acm.org/research/why-google-stores-billions-of-... > That's a Lovecraftian horror Perhaps.
  - Aloisius 2y ago
    Google's repo contains more than a single application.
    - ChainOfFools 2y ago
      But you see, now we know that GP knows how big Google's repo is, a detail from which we are perhaps to conclude I suspect, falsely, but who knows) they are or were employed as an engineer there, despite making an argument that seems well below the common sense threshold even to a non-engineer, Google or otherwise.
dijit 2y ago
450GiB is probably right. I’ve worked on a bunch of AAA game projects and the “MAIN” stream is usually somewhat small because people often want to have multiple checkouts on one drive.
- andersa 2y ago
  On the project I'm currently working on, we use filters to disable syncing groups of art assets we don't need, so a checkout for an engineer is usually quite reasonable. Probably also around 400GB though it includes the engine. With all filters disabled I'd end up downloading multiple terabytes of stuff for the main branch.
  - dijit 2y ago
    Ah yeah, we keep things like blender/maya models on a separate stream completely. Usually the main stream can compile the entire game so it has all the required assets, but not everything that is used to make the assets for the game in the first place.

agilob 2y ago

Have almost the same thing been leaked before, but now decryption keys are released? Edit Found it, previously they released a magnet link called funnytorrent that was over 800gb, but all files are 7z encrypted and no password was available. There are still seeds :O So I'm guessing the new thing is the new TW3 version CDP confirmed this week they are working on. Edit 2 The "new magnet" link is the same hash, so no new files in there.

tester756 2y ago

It sucks because their games are really good

orbital-decay 2y ago
How much harm can a source leak really do for a game released long ago? Especially for CDPR, owners of GOG.com and big proponents of DRM-free games.
- Mountain_Skies 2y ago
  Probably not much danger that players will end up with pirated copies of the games, especially those with an online component, but having the source code will make finding cheats and security vulnerabilities easier.
  - mschuster91 2y ago
    Don't get why you've been downvoted to grey, you make a very valid point particularly regarding security issues given the recent Apex Legends hack [1]. [1] https://www.tweaktown.com/news/96928/apex-legends-pro-players-get-hacked-during-na-finals-ea-confirmed-compromised/index.html https://www.tweaktown.com/news/96928/apex-legends-pro-player...
  - arandomusername 2y ago
    They're all single player games (except maybe Gwent?).
  - devwastaken 2y ago
    Shouldn't be serious vulns if they made it correctly. If they didn't, they were there waiting to be exposed eventually and are still the corps fault.
- DaiPlusPlus 2y ago
  Indirectly: the source-code will include third-party licensed libraries, stuff like audio and video decoding/rendering and other middleware - so they could be sued by the original devs/licensors for not keeping that protected.

grzeshru 2y ago

Can we get a StarCraft or Warcraft 3 leak?

DaiPlusPlus 2y ago
I’d love to see the source-code comments over-time as they tweaked the balancing rules in SC… but are these leaks just a snapshot of the file system or does it include the full source-control history?
- boneitis 2y ago
  If you haven't seen it before, you might enjoy Patrick Wyatt's (a lead dev for a time at Blizzard) blog. It is a treasure trove of anecdotes and war stories. https://www.codeofhonor.com/blog/ https://www.codeofhonor.com/blog/
  - DaiPlusPlus 2y ago
    Ah yes - I remember reading his article about the origins of StarCraft way-back-when - when StarCraft was still a low-effort "Orcs in space" re-skin of Warcraft 2, but they went to E3 or CES and got spooked by Ion Storm's demo of their visually impressive, isometric, RTS game - and reinvented SC - released SC - and the rest is history - while it turned out Ion Storm's demo was a prerendered video fake. That's a story right there.
    - DaiPlusPlus 2y ago
      Right here: https://www.codeofhonor.com/blog/starcraft-orcs-in-space-go-down-in-flames https://www.codeofhonor.com/blog/starcraft-orcs-in-space-go-...
      - accrual 2y ago
        Extremely cool read, thank you for sharing this. The author's other posts are interesting too. I learned they disabled collision for resource harvesting units so they could smoothly fly through each other on the way to/from the base and resources.

GaggiX 2y ago

Are there any companies that would actually pay the ransom? Because I have never seen one.

rnewme 2y ago
Yes, there are. Some ransonware groups are reputable, and keep their word so they keep being trusted by future victims.
nxobject 2y ago
One of the key insurance claims clearinghouses in America's hilariously privatised health care system was hacked – and they paid $22 million to one ransomware group (which is chump change to their corporate parent, United Health, robber capitalism incarnate.) What they didn't anticipate was that the same data was _hacked twice_. [1] [1] https://www.wired.com/story/change-healthcare-ransomhub-threat/ https://www.wired.com/story/change-healthcare-ransomhub-thre...
agilob 2y ago
It's like to be another survivorship bias. The paying ones aren't talked about in media because their business isn't obstructed that much. Pay, get data back, no harm to the reputation, maybe we never even hear about it.
TrexArms 2y ago
I got a panic phone call from one of of the companies I used to do contract work for, "Do you know how to buy bitcoin? We got hacked and the website isn't working and we're trying to pay so we can use our computers again." I stopped what I was doing and drove over there. Luckily someone DDoS'd the pay site so they couldn't pay. I asked them what they were thinking. They told me that they were going to pay with their super prestigious credit card and refute the charge as fraud because in their words, "Technically, this is fraud." I shook my head and cleaned it up and restored the backups. I asked them a week later how much data was lost. They asked me what I was talking about. Apparently they didn't have anything important they did since the backup ran the night before. They switched to a SaaS shortly afterwards. Then raided by the government & shut down a couple years later. Good times.