RE: [Full-Disclosure] Half-Life 2 source code stolen through IE exploit

[Nick FitzGerald <nick@virus-l.demon.co.uk>]

"Brown, Rodrick" <rbrown@doitt.nyc.gov> wrote:

> This is really sad there development network under all circumstances
> should not be connected to the internet. This is just lapse security on
> Valves part. Most big development shops have too workstations on
> separate networks just for this reason one network will be used for
> development only and the other for email/internet etc..

Indeed.

How much worse that instead of stealing the source and publicly posting 
it, the attacker had simply inserted a few backdoors into the code and 
checked that into the CVS?  Given that Valve is as careless about 
security as to alow the theft to happen, have you any confidence they 
would detect such a change anytime soon?


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html