Hello, World!
It’s being called the “biggest leak in gaming history”, GTA 6 gameplay footage
and source code have been posted all over the internet in the last few days.
But who did it?
In this video I’m going to be covering what we know about who hacked Rockstar, how they
did it, and are the rumours true?
Is our hacker the same guy who breached Uber a few days ago?
So, the initial leak was posted on gtaforums, and I find the level of initial skepticism
kinda amusing, “sorry bud no pic no click”, “I bet that link has AIDS”.
The post blew up, getting over 200 pages of replies until it was eventually taken down
by forum admins - probably when they realised just how litigious rockstar can be.
I mean, when there seems to be an entire genre of youtube videos talking about rockstar lawsuits
you know you’re in for trouble.
And right on cue, rockstar unleashed a barrage of DMCA takedowns against youtube videos and
tweets.
But the original leak thread was reinstated once mods had deleted all of the copyrighted
content.
But the question remains, who was responsible?
Some people noticed that one of the leaked videos had a rockstar employee’s name in
the title, so they automatically assumed that this must be the guy behind the leak.
But that just makes no sense, it only proves he had something to do with gta6 development
and in no way means he leaked it, it’s just nonsensical.
I imagine the poor guy received a ton of hate, because whilst at first people were excited
by the leaks, when it eventually dawned on them that this could potentially delay the
release of GTA 6, the mood changed.
And after this employee’s linkedin was posted on twitter he ended up deleting his account.
The second candidate as the leaker is the same guy who hacked Uber just a few days ago,
I mean, the name of the leaker on GTA forums was literally “tea pot uber hacker”, and
the guy who hacked uber did call himself “tea pot, for some reason” - so I’d say there’s
a pretty strong connection there.
However, that’s not conclusive evidence because sometimes hackers will adopt a false
identity to complicate attribution and intentionally lead investigators down the wrong path.
To bolster this idea, the GTA hackers’ motives are pretty different to the Uber hacker’s
motives, suggesting that it might not be the same person.
Because whilst in the case of Uber, the hacker did it just for the lulz, using his high level
of access to Uber’s systems, just to troll employees.
Whereas in the case of the GTA hack, after gaining access to GTA 5 and 6’s source code,
he immediately went down the road of extorting rockstar for a bunch of money, otherwise he
says he’ll leak the lot.
To further complicate things, breachforums’ owner and infamous threat actor, Pompompurin
has claimed, that the GTA leaker and Uber hacker are in fact the same person.
Though he didn’t post any proof of that whatsoever, because apparently after talking
to the leaker on Telegram, the leaker wiped the chat.
Pompompurin also posted a dox of the guy, a dox which is fairly extensive and detailed,
and one which I’m obviously not showing here - and I find it a bit of a low blow when
doxes include family members, which this one does.
I’m also blurring the real name of who Pompompurin alleges hacked both Uber and Rockstar, because
he’s only 17 apparently, and I’m pretty sure there’s some kind of reporting restrictions
in the UK on identifying under 18s.
However, what I can say - and this is where things get interesting, is that this hacker
is allegedly known by the name ‘white’, who is part of the Lapsus cybercrime gang.
This is the same ‘white’ that has previously been arrested in the UK for Lapsus’s operations
which have targeted Microsoft, Nvidia, Samsung and so on, Lapsus is fairly well known at
this point.
To top things off, in the last few hours Uber has put out an update on the investigation
into their breach, claiming that the bad actor who hacked them is “affiliated with a hacking
group called Lapsus$,”, they also give credence to the idea that the same actor also hacked
rockstar.
So it looks like Pompompurin’s accusations may be true after all.
So, what happens now?
With a potential perpetrator identified and his dox all over the internet, ‘White’
will be investigated, rockstar is no doubt warming up their lawyers, and I don’t think
it’ll be long before we know for sure if White was the miscreant behind all of this.
Though there are several factors which could complicate legal proceedings if ‘White’
is the perp, firstly he’s only 17, also, as per the BBC article on him, he is autistic.
Which in the past has been a contributing factor preventing the US from extraditing
hackers in the UK - the most notable example being “Gary McKinnon” who hacked a bunch
of NASA computers looking for evidence of aliens.
As for how rockstar was hacked, we have some ideas.
“tea pot uber hacker” (whoever he his) claims to have breached rockstar’s slack
and confluence server and then stolen files from there - which does make sense, slack
is a messaging app, and confluence is a project management tool, so you can bet they hold
some pretty sensitive information.
These two services were also breached in the Uber hack, where the intruder got in by spamming
2fa requests at an Uber contractor until he got bored of the spam and just tapped accept.
However in the case of the rockstar hack, we don’t know how they were initially compromised.
Rockstar put out a statement saying that: “We are extremely disappointed to have any
details of our next game shared with you all in this way”, but that this doesn’t change
anything, the “next Grand Theft Auto game will continue as planned”.
Which I’m glad to hear, as whilst I’m just personally not much of a gamer these
days, when GTA6 does drop, I’ll be all over it.
The best pentesting teams trust PlexTrac - the cybersecurity reporting and collaboration
platform - helping them build better reports in half the time, aggregate findings from
all their tools, and maximize their reusable report content, like writeups and narratives.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement, whilst exponentially increasing ROI and time savings.
Ready to elevate your reporting, improve collaboration across teams, and demonstrate real progress?
Spend more time hacking and less time reporting with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching, I presume we’ll be back to normal with the aggregate news
videos from the next video, assuming nothing too major happens in the mean time