Team Fortress 2 and CS:GO Source Code Leaked

by in CS:GO | Apr, 23rd 2020

Now, this is a fascinating news story. Valve had a pair of massive titles get their source codes leaked, in the form of Team Fortress 2 and CS:GO! On April 22, an anonymously posted blog (through a user named Maxx) alleges the leak. However, it’s also important to note it’s not the most recent content. The files for this are dated back for 2017/2018. While the code was leaked in 2018, it simply didn’t come into the mainstream until this week.

Old (But New) News!

That still means there’s a major leak. Hackers could do a fair amount with it. In theory, the worst case is that hackers could run some remote code into a player’s account if it’s still the same information and do god only knows what.

To protect the users, many player-run servers shut down for the overall safety of the users like Creators.TF. They made a blog post that says the following: “Due to the recent source code leak, we are shutting our servers down for the foreseeable future. This is because of the uncertainty surrounding security to our infrastructure as well as your computer. We will monitor the situation and keep you updated.”

Redsun.TF also released a similar statement. “Due to the recent code leaks for both CS:GO and TF2, I have decided to keep all servers offline until a patch is released for potential bugs.”

Though the code is still old, there’s no telling what information they could have and if it could aid hackers and cheaters create new tools or sneak into people’s accounts. What’s Valve’s official response?

“We have reviewed the leaked code and believe it to be a reposting of a limited CS:GO engine code depot released to partners in late 2017, and originally leaked in 2018,” said Doug Lombardi, vice president of marketing of Valve.

“From this review, we have not found any reason for players to be alarmed or avoid the current builds (as always, playing on the official servers is recommended for greatest security). We will continue to investigate the situation and will update news outlets and players if we find anything to prove otherwise. In the meantime, if anyone has more information about the leak, the Valve security page describes how best to report that information.”

We hope this gets resolved quickly and it doesn’t lead to more cheat engines or ways to hack CS:GO, but I imagine this will be the result. Though, since the data is two years old, I cannot imagine it will change the cheating game too much with the Team Fortress and CS:GO code leak.

Discussion on Guilty Parties

Who is the guilty party? That’s hard to say one way or another, but several people are aiming the blame at Valve News Network creator Tyler McVicker. They cite that the April 22 blog post reveals the source code also includes a conversation between McVicker and several friends about Valve leaks.

McVicker’s response was to hold a Twitch Q&A livestream, where he then clarified what the leaked conversations were about, and tries to clear the air that he is in fact, not the leaker. This statement was then collaborated by Valve Archive curator Jaycie Erysdren on Twitter, which we learned about, courtesy of Gamespot.

“So, for the longest time, I ran a community server team named Lever Softworks,” McVicker said during his Q&A. “And on Lever Softworks, we did a few things–Portal: Still Alive for PC, Half-Life 2: Aftermath, Half-Life 3 dog resource gathering maps–and behind the scenes we were working on a community recreation of F-STOP based almost entirely on the available assets we had found [and] new information in the retail build of Portal 2.” McVicker then goes on to say how the team fell apart, partly because he “got busy” and largely because the team “kept arguing about things.” McVicker also talks about a problematic member who was racist and transphobic, which alienated another teammate who was crucial to the project.

On April 21, McVicker got a call from a long-time friend who asked if McVicker would be willing to transfer ownership of the Lever Softworks account to them. “I wasn’t doing anything with it,” McVicker said, “I was busy with Creators.TF.” In the process of transferring ownership, the problematic person was removed from the Lever Softworks team. Assuming there would be some form of retaliation in the form of excessive messaging, McVicker preemptively blocked them on social media. “There had been a pattern in the past of this person not being in certain groups or chat rooms and getting very upset about it.”

Ultimately, McVicker says that “Maxx” is leaking to get back at the team for being removed. McVicker states that they tried to warn Valve about the leak. We’ll have to see if Valve pursues this further and if anything comes of the investigation.

But if it winds up spawning lots of CS:GO or Team Fortress clones conveniently using the accurate source code of the game, well, that might be another story entirely. We’re willing to bet that if they find the source of the leak, they’re going to get sued, and sued hard.


Leave a Reply