Cyberpunk 2077 - Page 56

This initial leak is believed to include source code of the CDPR’s virtual card game Gwent, while vx-underground disclosed that auctions for the more valuable source code were happening on a hacking forum known as Exploit. We haven’t been able to verify that information, and CDPR has not responded to a request for comment.

But a cybersecurity firm called KELA, which specializes in providing threat intelligence to companies based on analyses of dark web websites and communities, says it has reason to believe the auctions are, in fact, legitimate.

“We do believe that this is a real auction by a real seller who accessed the data. The seller offers to use a guarantor and he allows only those who have a deposit to participate — a tactic that is used by many sellers to show that they are serious and to ensure that no scam will occur,” a spokesperson for KELA tells The Verge.

KELA says its threat intelligence analyst, Victoria Kivilevich, was able to download some of the information provided to him by an individual claiming to be involved with the auctions. Kivilevich believes it is genuine, and KELA shared screenshots with The Verge of some of the file lists allegedly showing off stolen source code of CDPR’s Red Engine, its in-house game engine platform.

KELA says the auction is offering source code files for both the Red Engine and CDPR game releases, including The Witcher 3: Wild Hunt, Thronebreaker: The Witcher Tales spinoff, and the recently released Cyberpunk 2077. The stolen material is also believed to include internal documents, though it’s not clear what types of documents or additional material the full cache includes.

KELA says the starting price of the auction is $1 million, with higher bids in increments of $500,000 and a buy-it-now price of $7 million. Only users who deposit 0.1 bitcoin can participate, which is why Kivilevich believes the hackers are serious about hosting the auction and that the material for sale is likely legitimate because it ensures nobody participating in the auction is trying to scam the sellers.

Vx-underground also independently verified the pricing terms of the auction after KELA had provided the information to The Verge, including screenshots alleging it’s to take place tomorrow at 5AM ET / 1PM Moscow Standard Time and run until 48 hours after the last bid.

It’s not clear whether the leak from earlier today — which has already been removed from file upload sites like Mega and scrubbed from hacking forums and other sites — is in any way associated with the ransomware attack.

On February 12 2021 00:22 ZerOCoolSC2 wrote:
Kinda news....but not really. Like...that's a lot of speculating on if the material is legit or not. It's a story but it repeats itself to make it something that honestly...who gives a fuck about?

On February 12 2021 01:50 ZerOCoolSC2 wrote:
Isn't the mod community for W3 already pretty robust? What more do you want from that game in particular? CP2077 just released more mod tools for the community to use. So it'll build itself with time.

I feel like it isn't going to amount to anything because anything used will be flagged immediately and taken down. It might sting a bit, but at the same time, it only hurts CDPR's bottom line.

I honestly just want them to continue to support CP2077.

On February 12 2021 06:55 Manit0u wrote:
I don't really get all the hype with Skyrim. It's a pretty crappy game without mods and when you finally download and install 60GB of mods on top of it you kinda lose all desire to play it from that effort alone.

Having big and involved modding community is great but if you have more mods than actual game then something is terribly wrong.

Edit: Apparently W3 and CP2077 code was auctioned on the dark web for millions.

https://www.theverge.com/2021/2/10/22276664/cyberpunk-witcher-hackers-auction-source-code-ransomware-attack

At least one analyst sees reason to doubt the seller's report of a separate buyer swooping in from outside the auction. "There is another possible scenario that we think is more likely: no buyer exists and the closure of the auction is simply a means for the criminals to save face after failing to monetize the attack following CD Projekt’s refusal to pay the ransom," Emsisoft Threat Analyst Brett Callow wrote in a blog post. "We have seen this behavior in the past with REvil, a ransomware group that threatened to release damaging information about Donald Trump. Although the hacked law firm refused to pay to prevent the leak, the information was never published—the attackers just claimed to have sold it."

On February 13 2021 06:40 zatic wrote:
I find that much more likely. I didn't believe the news about it being sold, it just doesn't make sense. How would the buyer recover millions from IP protected source code? What would be the play here?

On February 14 2021 03:36 Simberto wrote:
The problem with that argument is that pretty much all software companies take very much care to keep their source code from ever being released to the public. This leads me to believe that these companies value keeping their source code secret, which in turn means that there must be some value to getting your hands onto that source code.