Yesterday, here at Oficina da Net, we announced the postponement of League of Legends update 13.2. The company suffered a social engineering attack that halted development not only on League of Legends, but also on TFT, Valorant, and other Riot games. Riot has ensured that no player personal information has been leaked, and has promised full transparency as investigations progress.
Today, Riot lives up to that promise and has sent out several tweets explaining what they know so far about what happened.
What is source code?
Riot Games confirms that the source code for League of Legends and TFT has been leaked. With that secret code in hand, hackers are free to exploit software vulnerabilities. We can understand this better through an analogy: it is as if they had stolen the blueprint of a bank, with precise information about all the vaults, passwords and security cameras, etc.
Source code is a high priority target for cyber attackers, and every year we have at least one major breach. In 2020 Valve suffered from leaks of the source code of Team Fortress 2 and CS:GO. Already last year we had the famous leak of the source code of GTA VI, as well as several screenshots and videos of the game. Check here all about this case.
How does this affect the game?
With this code, hackers are able to develop and improve cheating programs, known as “scripts“. The company claims that they are already working to assess the impact of the leak on the anti cheat and what measures should be taken to combat the possible new wave of cheating.
Riot also confirmed something we suspected in yesterday’s post: the leak of skins not yet released. Not only that, but also new game modes and experimental features in the prototype phase.
At the end of the statement, Riot Games states that they have notified authorities and are working in direct cooperation during the investigation. They reiterated that no personal data was leakedand that they are taking steps to ensure that this security breach does not happen again.
Check out the full translated speech
I took the liberty of translating Riot Games’ full statement and make it available below:
As promised, we’d like to update you on the status of last week’s cyberattack. This weekend, our review confirmed that the source code for League, TFT, and a “legacy” anti-cheat platform had been hacked. Today, we received a ransom email. Needless to say, but we won’t pay.
While this attack disrupted our development environment and could cause problems in the future, more importantly, we remain confident that no player data or personal information was compromised.
It’s true, any source code leak can increase the likelihood of new cheats emerging. Since the attack, we’ve been working to assess its impact on the anti-cheat and prepare to roll out fixes as quickly as possible if needed.
The illegally obtained source code also includes several experimental features. While we expect some of these game modes and other changes to make their way to players, most of this content is in the prototype stage and there’s no guarantee it will be released.
Our globally recognized security teams and external consultants continue to assess the attack and audit our systems. We have also notified the authorities and are in active cooperation with them as they investigate the attack and the group behind it.
We’re committed to transparency and will release a full report in the future detailing the attackers’ techniques, the areas where Riot’s security controls failed, and the steps we’re taking to ensure this doesn’t happen again.
We’ve made a lot of progress since last week, and we believe we’ll patch things up by the end of the week, which will allow us to stay on our regular patch cadence going forward. The League and TFT teams will update you soon on what this means for each game.”
Source: Twitter/Riot Games – Translated by Luís Jahn.
And now? Will LoL be unplayable, full of cheaters, right at the beginning of the Season? We will continue to keep an eye out and share information about the situation.
