Libretro / RetroArch were hacked, wiping some repositories

What an odd choice of target practice for a hacker.


Last edited by TheSHEEEP on 17 August 2020 at 10:02 am UTC

But why tho?

Git should be optimal for those cases, right?
With every developer having the history on their discs?

What an odd choice of target practice for a hacker.

Not a fan of conspiracy theories, but maybe some companies that don't like the idea of having their older titles being emulated...

He accessed our buildbot server and crippled the nightly/stable buildbot services, and the netplay lobby service. Right now, the Core Updater won’t work. The websites for these have also been rendered inaccessible for the moment

He gained access to our Libretro organization on Github impersonating a very trusted member of the team and force-pushed a blank initial commit to a fair percentage of our repositories, effectively wiping them. He managed to do damage to 3 out of 9 pages of repositories. RetroArch and everything preceding it on page 3 has been left intact before his access got curtailed.

Do they already know it was a he?

This little detail was left out of their announcement, but they didn't force 2FA which appears to be how the attacker actually got in. Speaking on Twitter, they mentioned how some developers felt it was "too much of a pain" and they didn't want to lose those contributors.

I face this constantly at work. And to be honest, it's bullshit. With setups like MFA from Azure AD, with the Authenticator app, where not even a code is needed to use the 2nd factor. Or with tools like Yubikey that can be used for the same, but also as main way to authentication in websites, any developer complaining about the nuisance of 2FA goes into the "Suspicious list" right away.

And I'm a "quick to pull the trigger" kind of admin when it comes to revoking access to systems xD

Do they already know it was a he?

No, and they never will. They probably just didn't want to write "the asshole" and went with "he" instead.

I face this constantly at work. And to be honest, it's bullshit. With setups like MFA from Azure AD, with the Authenticator app, where not even a code is needed to use the 2nd factor. Or with tools like Yubikey that can be used for the same, but also as main way to authentication in websites, any developer complaining about the nuisance of 2FA goes into the "Suspicious list" right away.

And there's also Bitwarden which simplifies it even more with storing the TOTP url. You don't need a second device (which is a security risk), but it is still way harder to hack your account since the hacker should have direct access to your machine in order to get both your password and the TOTP address (which are protected by a main password in Bitwarden).

Here's a very interesting blog post from Bitwarden explaining 2FA in general, and their system:
https://bitwarden.com/blog/post/basics-of-two-factor-authentication-with-bitwarden/

Also, they answer the question "some may ask what is the point of having your username, email, and your two-step login code all stored within the same application [...]? Doesn’t that negate the value of two-step login?"

The answer depends. Let’s break it down.

• Your Bitwarden Vault hopefully already has two-step login using some other method. (ie. do not use the Bitwarden Authenticator to protect your Bitwarden account.) Therefore it is currently protected with a high level of security and, in fact, two-step login.


• Having two-step login enabled for websites and applications is always better than not having it enabled. A tighter bundling of two-step login makes it easier to use more frequently, which promotes better security hygiene as a practice.


• If you need to share an item, you can share it with two-step login enabled, which, again, is better security practice. This is a collaboration and two-step login power move.


• You do not need to remember which authentication app you used, since it is built in.


• You can always choose, on an individual basis, which login you want to authenticate internally within the Bitwarden app, or externally using a separate Authenticator app.

Bitwarden users find that the integrated Authenticator functionality provides faster workflows with better security and dexterity for collaboration. Users also note that they apply different policies to different types of accounts. Primary financial institutions may be authenticated externally using a separate Authenticator app, while all of their ecommerce logins are authenticated internally within Bitwarden.

Also.. Bitwarden is open source ;)


Last edited by Creak on 17 August 2020 at 2:47 pm UTC

I face this constantly at work. And to be honest, it's bullshit. With setups like MFA from Azure AD, with the Authenticator app, where not even a code is needed to use the 2nd factor. Or with tools like Yubikey that can be used for the same, but also as main way to authentication in websites, any developer complaining about the nuisance of 2FA goes into the "Suspicious list" right away.

And there's also Bitwarden which simplifies it even more with storing the TOTP url. You don't need a second device (which is a security risk), but it is still way harder to hack your account since the hacker should have direct access to your machine in order to get both your password and the TOTP address (which are protected by a main password in Bitwarden).

Here's a very interesting blog post from Bitwarden explaining 2FA in general, and their system:
https://bitwarden.com/blog/post/basics-of-two-factor-authentication-with-bitwarden/

Also, they answer the question "some may ask what is the point of having your username, email, and your two-step login code all stored within the same application [...]? Doesn’t that negate the value of two-step login?"

The answer depends. Let’s break it down.

• Your Bitwarden Vault hopefully already has two-step login using some other method. (ie. do not use the Bitwarden Authenticator to protect your Bitwarden account.) Therefore it is currently protected with a high level of security and, in fact, two-step login.


• Having two-step login enabled for websites and applications is always better than not having it enabled. A tighter bundling of two-step login makes it easier to use more frequently, which promotes better security hygiene as a practice.


• If you need to share an item, you can share it with two-step login enabled, which, again, is better security practice. This is a collaboration and two-step login power move.


• You do not need to remember which authentication app you used, since it is built in.


• You can always choose, on an individual basis, which login you want to authenticate internally within the Bitwarden app, or externally using a separate Authenticator app.

Bitwarden users find that the integrated Authenticator functionality provides faster workflows with better security and dexterity for collaboration. Users also note that they apply different policies to different types of accounts. Primary financial institutions may be authenticated externally using a separate Authenticator app, while all of their ecommerce logins are authenticated internally within Bitwarden.

Also.. Bitwarden is open source ;)

I use bitwarden personally with a yubikey as hardware 2FA plus OTP within the app :)

At work we use 1password. Plus AWS Secrets Manager. I still need to battle with people as of why is good for them haha.


Last edited by Arehandoro on 17 August 2020 at 3:06 pm UTC

I still need to battle with people as of why is good for them haha.

Bless your patient soul, you have my sympathy. Dealing with users can be a frustrating experience.

Reminds me of one time where an anonymous colleague force pushed the master on a separated branch where we had a version we still had to support on a single customer. The pain. But yeah, with some effort git allows to recover even from that. Still it's a lot of waste time for some people to recover things and for other people to wait for some people to recover things.

well from what im hearing they have done a crappy job with telling people they were hacked especially there patreon subscribers.i just got told by one them they had no warning at all that this went down and found my video about it which is very very messed up.you should not have to see this stuff in news articles or videos to find this out.very very bad thing on there part and as for backing things up that is on them.they should of known they needed to do that and now the flood gates are gonna come down on them for it.its there own fault.

they should of known they needed to do that and now the flood gates are gonna come down on them for it.its there own fault.

Libretro is an open source, community driven, low-funded project about playing retro games, and the hack was not about leaking private data, but about crippling a github repo.

Let's be reasonable, please. They don't have to know everything about security, they have the right to be wrong, it is not a bank.


Last edited by Creak on 17 August 2020 at 5:19 pm UTC

I figure the possibilities are.
1) aforementioned someone testing their skills
2) aforementioned bitter IP holder
3) FPGA vs Emulation vs Real hardware battle. RetroWar 2020!
4) There is no number 4
5) Simplest explanation, someone screwed up and they're blaming it on a hack.

they should of known they needed to do that and now the flood gates are gonna come down on them for it.its there own fault.

Libretro is an open source, community driven, low-funded project about playing retro games, and the hack was not about leaking private data, but about crippling a github repo.

Let's be reasonable, please. They don't have to know everything about security, they have the right to be wrong, it is not a bank.

again use a backup no excuse.

Did they protect their default (master/main) branch and require pull requests with approvals to do any merges? Admin accounts with the power to override shouldn't be used for anything beyond setting things up, I would think. Preferring NOT to use 2FA is the real surprise to me. Wow! :/ Just because you're paranoid doesn't mean they're not out to get you. Stay secure, my friends.

again use a backup no excuse.

Indeed. The problem there is that it's presumed that the hosting service would actually take care of that as it's one of the features of most services. Couple this with git having a backup of pretty much everything there... It's more about finding out the hosting service didn't do backups (oops) and figuring out which is the cleanest clone with the good history you have to restore.

It's more a pain in the ass than anything else. Nothing QUITE like you're making it out to be.

Did they protect their default (master/main) branch and require pull requests with approvals to do any merges? Admin accounts with the power to override shouldn't be used for anything beyond setting things up, I would think. Preferring NOT to use 2FA is the real surprise to me. Wow! :/ Just because you're paranoid doesn't mean they're not out to get you. Stay secure, my friends.

This presumes that your admin/control accounts aren't hacked/compromised. Once that happens...all bets are off.

From my admittedly limited understanding...that's what happened there.