- Background<\/a><\/li>
- The Gigaleaks<\/a>
- First Leak: March 2018<\/a><\/li>
- Second Leak: July 2020<\/a><\/li>
- Third-Fifth Leak: September 2020<\/a><\/li>
- Sixth-Eighth Leak: October 2020<\/a><\/li>
- Ninth Leak: December 2020<\/a><\/li>
- Tenth Leak: July 2021<\/a><\/li><\/ul><\/li>
- The Perpetrators<\/a>
- The Breach<\/a><\/li><\/ul><\/li>
- Nintendo's Response in concern to security<\/a><\/li>
- Closure<\/a><\/li>
- Sources<\/a>
- References<\/a><\/li>
- Image Sources<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n\n\n\n\n
Background<\/h2>\n\n\n\n
Nintendo is a Japanese video game company that is engaged in developing and publishing video games and video game consoles. With an annual revenue of more than 11 billion dollars, Nintendo stands as a powerhouse in the video game landscape with influence and prestige sounding within the global market [1]<\/sup>. As with other similarly large industrial giants, Nintendo also has to deal with malicious attacks that are targeted towards phishing user account data, finding exploits in their security infrastructure and also within their games and consoles. Needless to say, a potential security leak could lead to serious issues which could undermine Nintendo\u2019s ability to secure and protect valuable user data, both from a legal and moral perspective.<\/p>\n\n\n\n
Even prior to the actual leaks which started in July 2020, Nintendo was already dealt a bad card in terms of cybersecurity incidents. In March 2020, Nintendo reported that up to 160.000 Nintendo Switch accounts were accessed by hackers and their Nintendo Network IDs were phished [2]<\/sup>. The manner on how the hackers could obtain access to the accounts is assumed to be either via credential stuffing attacks or by exploiting the legacy login system via NNID [3]<\/sup>. With sensitive user data including nicknames, birth dates and email-addresses leaked, Nintendo was urged to upgrade security measurements which later resulted in Nintendo requiring users to use two-factor authentication in order to prevent future unauthorized access [4]<\/sup>. The fact that the Gigaleak happened just months after this security incident could be attributed to bad luck on Nintendo\u2019s part.<\/p>\n\n\n\n
The Gigaleaks<\/h2>\n\n\n\n
To establish the base line of the blog article about the Gigaleak itself, it is important to mention that the leaks most likely started long before 2020, as a small set of leaks happened in 2018 which illegally publicized tech demo builds of Pokemon Gold and Silver from the Pokemon Space World Demo in 1997 [5]<\/sup>. Due to the comparable insignificance of the leak amount to the Gigaleak and it being an isolated incident, it was not evidently connected to the Gigaleak. Yet by the nature of how the later Gigaleaks would be distributed, a clear connection and reference to the 2018 leak could be established [6]<\/sup>. As the total file sizes of the leaks vary greatly, they are not always one gigabyte in size as some leaks are smaller than that. Despite this, as they likely all come from the same source, these individual incidences are still categorized as belonging to the Gigaleak events. More on the topic of the method of leak distribution and Behind the Scenes circumstances will be explained here<\/a>.<\/p>\n\n\n\n
Now for the leaks themselves: the Gigaleak consisted of nine separate leak incidents which exposes different topics of illegally obtained information and data. Its contents ranges from old documentation and drafts of potential technological patents, to development-specific game project CVSs (Concurrent Versions System) and unreleased game builds. With the exception of the very first leak in March 2018, the actual dump of data happens between July and December of 2020. This blog article will first explore the individual leaks and immediate caused impact. Afterwards, it will describe the circumstances surrounding the supposed leaker and the manner with which the data was obtained. Lastly we will summarize the findings of the leaks and Nintendo’s response and actions in regard to strengthening its security.<\/p>\n\n\n\n
First Leak: March 2018<\/h3>\n\n\n\n
Back in March 2018, leaks surfaced on multiple platforms and they likely came from the same source. Leaks of a mysterious ROM containing the Space World 1997 prototype of Pokemon Gold and Silver (labelled \u201cSW97\u201d) were uploaded to PRET’s discord server [7]<\/sup>. PRET stands for \u201cPokemon Reverse Engineering Team\u201d and their github account shows feats of decompilations and disassemblies of various Pokemon game titles, including being able to fully reverse engineer Pokemon Red and Blue back into Z80 assembly code [8]<\/sup>.<\/p>\n\n\n\n
More presentable images such as records of old and scrapped Pokemon designs and a discontinued China-only console model called the iQue Player were leaked onto the image-based bulletin board 4chan [9]<\/sup>. Especially the Pokemon design leaks sparked huge discussions on the internet and gave valuable insight on earlier design prototypes and also about certain common criteria which ruled Pokemon designs out from being picked [10]<\/sup>.<\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik.png\")
<\/a>Many prototype designs feel familiar and throughout development they will shift to slowly become the iconic Pokemon we know [I1]<\/sup>.<\/figcaption><\/figure>\n\n\n\n ![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik-1.png\")
<\/a>Certain Pokemon such as Vulpix, Paras, Meowth, Doduo, Grimer and Mr. Mime were planned to have a pre-evolution [I2]<\/sup>.<\/figcaption><\/figure>\n\n\n\n Second Leak: July 2020<\/h3>\n\n\n\n
Around the 24th<\/sup> of July 2020, a series threads on 4chan titled \u201cGigaleak\u201d would publish several compressed files containing source codes of earlier Nintendo consoles such as the Super Nintendo Entertainment System (SNES) and the Nintendo 64 (N64). The leaks were numerous gigabytes in size and the term Gigaleak would primarily refer to the leak incidences on the image-based bulletin board 4chan. As the terminology is not adopted naturally, some people refer to the leak of SNES and N64 source codes as separate incidences while internet archivists would sum them up into one big leak [11] [12]<\/sup>.<\/p>\n\n\n\n
People immediately sought out validation of these files by bringing in the opinion of former Nintendo employees who in fact confirmed them to be valid as they have seen the exact files during their work days at Nintendo. Especially the sheer size and the granular detail of the information would speak for its validity [13]<\/sup>.<\/p>\n\n\n\n
Besides the leaks of the console source code, several game ROMS and SVN repositories were leaked, which covered the following Nintendo consoles and handhelds: SNES, Famicon\/NES, Gameboy, Gameboy Color and N64 [11]<\/sup>. The repositories revealed unused assets directly tied to the game or even related to Nintendo’s future game projects which were created as initial prototypes [13]<\/sup>.<\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik-8-1024x421.png\")
<\/a>The development cycle surrounding the creation of the Hyrule field in the Nintendo 64 game “Zelda: Ocarina of Time” [I3]<\/sup>.<\/figcaption><\/figure>\n\n\n\n These types of leaks sparked discussion but also caused concern as private conversations between members of the development team were found within the source code and repository history, including some very private mail exchanges. The former lead developer of Star Fox especially commented on the fact that he was frustrated by the public discussion on the source code comments and that many did not understand the technological leap in utilizing one of the first multi-threaded tokenized script languages for a video game [14]<\/sup>.<\/p>\n\n\n\n
As the public would marvel over the findings of the leaks, the tightlipped community focused on game preservation would find themselves in a difficult spot if Nintendo decided to tighten up their security in response to the leaks. On the other hand, it would serve as solace to those who were affected by the Nintendo account breaches back in March 2020 [14]<\/sup>.<\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik-2.png\")
<\/a>Former Nintendo employees would find themselves in a nostalgic rush from seeing screenshots of their old work tools resurface from several decades ago [I4]<\/sup>.<\/figcaption><\/figure>\n\n\n\n ![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/alttp.png\")
<\/a>A peek in the source code of Zelda: A Link to the Past, for the SNES [Ix]<\/sup>.<\/figcaption><\/figure>\n\n\n\n Third-Fifth Leak: September 2020<\/h3>\n\n\n\n
After an uneventful month of August, the leaks continued in September. The first of the September leaks happened on the first week with documents surfacing about two unreleased GameCube models. The first model would resemble the current Nintendo Switch as the model specification of this hybrid console version would list a built-in display and the ability to be connected to a TV via docking station [15]<\/sup>.<\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik-3-1024x647.png\")
<\/a>The leaked specification of a GameCube hybrid-console version would include a docking station with ports for external controllers, memory cards and a disc-drive for GameCube game discs [I5]<\/sup>.<\/figcaption><\/figure>\n\n\n\n The second model with its codename ‘Tako’ would render games at HP video resolutions. The model with its high specs would be thought of as an competitive answer to the XBOX360 and the PlayStation 3. It is unclear how far this console consideration went in terms of prototype manufacturing as nothing but its specifications was leaked [16]<\/sup>.<\/p>\n\n\n\n
Just one week later, a fourth set of leaks happened with a very sizeable amount of data. It’s informal name would be titled “Gigaleak 3” due to the sheer size of leaked materials but the actual numbering would stay inconsistent with the transpired events and public retelling. The fourth set of leaks contained internal documents for Wii Sports and Wii Sports Resort for the Nintendo Wii, and also various source code repositories for the portable Nintendo DSi handheld and DSi apps. The leak also contained numerous unreleased GameBoy games alongside prototypes of unreleased localized versions, many of which were thought to have never existed [17] [18]<\/sup>. The most notable content of this leak was the entire source code for Pokemon Platinum, hence why some also called this leak set the “Platinum Leak” [19]<\/sup>.<\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik-4-1024x576.png\")
<\/a>Leaks of the Nintendo Wii reveals interesting prototype designs for the Wii Remote [I6]<\/sup>.<\/figcaption><\/figure>\n\n\n\n On the last day of September, the fifth set of leaks happened with debug and demo ROMs of various Poekmon games including Pokemon Ranger, Pokemon Mystery Dungeon and the FireRed\/LeafGreen remakes. These builds were primarily used for quality assurance and E3 demo panels. The leaks also contained SDKs for the Nintendo DS and source code repositories for the 3DS boot ROMs [20]<\/sup>. <\/p>\n\n\n\n
Sixth-Eighth Leak: October 2020<\/h3>\n\n\n\n
The month of October would see three individual sets of leaks yet again but the topic would stay solely focused on Nintendo’s Pokemon games for the Nintendo 3DS handheld and the Nintendo Switch. The first set included source code repositories of Pokemon Sun an Moon and their rereleases UltraSun and UltraMoon [21]<\/sup>. The seventh leak contained source code repositories for Pokemon Sword and Shield including prototype UI designs and beta builds which were based off Pokemon Sun and Moon. Although the files within the leaks were password-protected, they were easily brute-forced [22]<\/sup>.<\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik-5-1024x576.png\")
<\/a>Based on Pokemon Sun and Moon, leaks of early build of Pokemon Sword and Shield seemed to suggest various features that ended up being scrapped from the actual release (most notably the minimap) [I7]<\/sup>.<\/figcaption><\/figure>\n\n\n\n The last October leak contained another password-protected archive of a more recent build of Pokemon Sword. The leak itself did not receive much traction on the internet as most information could be traced with the early leaks of Pokemon Sword.<\/p>\n\n\n\n
Ninth Leak: December 2020<\/h3>\n\n\n\n
Another leak happened on December 2020, now we exclusive info about the development and design specifications of the Nintendo Switch with an included SDK from 2015 and related documents about security details. The design mockups visualizes the Nintendo Switch prototype to have a circular shaped display and far less powerful hardware than the finalized product. The initial concept of the Nintendo Switch was that of a stronger Nintendo 3DS with no docking capabilities but instead communicating with the television wirelessly [23]<\/sup>. <\/p>\n\n\n\n
Besides the information about the Nintendo Switch, the leak also contained secretive information about Nintendo’s surveillance protocols in concern to a Belgian hacker and the subsequent attempts to recruit and hire him [23]. This Belgian hacker by their online handle Neimod and codename “Belgian Waffle” was active in the 3DS homebrew scene with a history of hacking Nintendo-related products. Nintendo’s surveillance resulted in a portfolio of Neimod’s daytime activities and even included his engagement with family, occupation and close friends [24]<\/sup>. <\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik-7-1024x464.png\")
<\/a>Nintendo’s internal files on surveillance and subsequent hiring attempts of hacker\/homebrewer Neimod leaked which caused a plethora of web discussion on individual privacy and the scope of Nintendo’s counter-intelligence efforts [I8]<\/sup>.<\/figcaption><\/figure>\n\n\n\n Lastly, the leaks included the source code repository for the Nintendo Switch boot ROM that was affecting both hardware revisions.<\/p>\n\n\n\n
Tenth Leak: July 2021<\/h3>\n\n\n\n
After a long hiatus, the Gigaleak continued with one final leak on the 20th of July. The leaks included the source code of Nintendo Wii’s Service program and several prototype builds of Pokemon X and Y, Pokemon Emerald, Pokemon Diamond and Pealr and Pokemon Let’s Go Eevee!. It also included the full development repository for the cancelled iQue Box, which was the successor to the china-only iQue and all related documentation [25]<\/sup>. <\/p>\n\n\n\n
Lastly, it also contained the personal email inbox of Murakawa Tsushin, who is a Nintendo employee and in charge of the localization from Japanese to Korean and English and handful of other European languages. The fact that this particular mail box was included in the leaks would later become another important clue for the investigation of the main perpetrator of the Gigaleak incidents [26] [27]<\/sup>.<\/p>\n\n\n\n
The Perpetrators<\/h2>\n\n\n\n
In order to search for the perpetrator who initiated the leaks, it is important to clarify the means in which the files were obtained and the time periods of the leaked information. when discussing the time frame of the first and second leak incident, the leaks happened on two different platforms: the PRET discord server and 4chan. It is highly plausible by the file formats and structure, that the source was likely the same. <\/p>\n\n\n\n
The first indicator was the unique file format found in the leaks which were specific to BroadOn’s development tools. BroadOn was a software engineering company who was contracted by Nintendo to develop Wii hardware and software. Many of the Wii specifications found in the leaks were exclusively accessible only by the BroadOn company. So the suspicion was that either BroadOn’s security was compromised and their server was leaking data or the perpetrators were working as employees at BroadOn [28]<\/sup>.<\/p>\n\n\n\n
As time went on and numerous other leaks surfaced, it would seem that the leakers were in possession of far more material than BroadOn’s reach could suggest. Due to how the leaks were systematically uploaded and distributed to the internet, it would seem that the leaker would incorporate the help of several of their trusted acquaintances who would then spread the files as their proxy. The leaker themselves would adopt several different nicknames and online handles for each occassion. For the purposes of sharing files and plan the leaks, they would found Team Spaceworld (TSW) and use the Glitch City Laboratories forum to spread insights and files prior to their leaks on 4chan [29]<\/sup>. As Nintendo would trace back the amount of material leaked to the past incidents of Nintendo server access infringements, they would soon stumble upon the name of Zammis Clark, who was previously pleaded guilty for infiltrating Microsoft and Nintendo’s servers between March and May of 2018 [30]<\/sup>.<\/p>\n\n\n\n
In search for validating Zammis Clark to be the perpetrator, they traced back all of his aliases including SlipStream, wack0, Riley, Raichain, Raylee. Many of his online handles could be traced back even to his participations in pokemon challenge romhacks where he openly used these aliases [31]<\/sup>. Clark, at the time of his server infiltrations, worked as a security expert at Malwarebytes and had an unusual obsession with Nintendo and Pokemon.<\/p>\n\n\n\n
The Breach<\/h3>\n\n\n\n
Assumingly, Clark gained access to Nintendo’s internal network via VPN and then obtained 2,365 usernames and passwords. During the time frame of March and May of 2018, he illegally obtained material in size of at least 2 terabytes and then distributed them to his close friends who would then leak the files on 4chan on his behalf. Even though Zammis Clark was sentenced to 15-months in prison, his condition and the mercy of the judge spared him from prison [32]<\/sup>.<\/p>\n\n\n\n
Even after Zammis Clark ceased any activities surrounding the distribution of leaks or supporting any third party actions that would be incriminating, the damage was already done. More than 2 terabytes of uncompressed information was on the internet and ready to be leaked [33]<\/sup>.<\/p>\n\n\n\n
![\"\"](\"https:\/\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/07\/grafik-9.png\")
<\/a>A screenshot purposely showing the total amount of files of the leaked data [I9]<\/sup>.<\/figcaption><\/figure>\n\n\n\n Nintendo’s Response in concern to security<\/h2>\n\n\n\n
In Nintendo’s 82nd Annual General Meeting of Shareholders in 2022, Nintendo addressed the security concerns surrounding the 2020 leaks. Nintendo’s president Shuntaro Furukawa had stated that in concern to information security, they have introduced an information security management system and an Information Security Committee. Additionally, Nintendo had established policies for information management which also adopted countermeasures both in physical and technical manners. Nintendo also confirmed that they will cooperate with outside specialists and conduct diagnostics to check for any potential security issues. Lastly, Nintendo will raise awareness of information security among their employees through training and other means to discourage malicious social engineering [34]<\/sup>.<\/p>\n\n\n\n
Closure<\/h2>\n\n\n\n
The later half of 2020 proved to be a hectic time period as old gaming myths and rumors were solved and answered. Of more than 2 terabytes of data leaked, only several gigabytes was released to the public via uploads. And from the leaked materials, some of them even dated as far back as 1980. The Nintendo Gigaleak is considered the biggest dump of illegally obtained information in gaming history. For fans and video game preservationists, the Gigaleaks were both insightful and meaningful as for example in 2021, the leaks of Super Mario Advance’s source code was used to recreate music that would sound native prior to being compressed to fit hardware limitations [35]<\/sup>.<\/p>\n\n\n\n
- Image Sources<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n\n\n\n\n
- Nintendo's Response in concern to security<\/a><\/li>
- Second Leak: July 2020<\/a><\/li>
- The Gigaleaks<\/a>