9 ms·

Hacker Bribed 'Roblox' Insider to Access User Data

151 points by danso 7y ago

dgrin91 7y ago
Does it really count as a 'hacker' if it was just a straight up bribe? Where is the hacking here?
- danso 7y ago
  How do you define "hacker"? This site changed its name from "Startup News" to "Hacker News" [0], but I don't think it signaled a complete shift in userbase and topics. In any case, the article says the person "changed the password for and stole items from Roblox users". Would you say it's wrong for those users to describe their accounts as being "hacked"? edit: moreover, no matter the method of intrusion, it shows how basic/non-existent the auditing and access-control is for a system that services 100 million active monthly users, which is most definitely the kind of security issue that traditional technical hacks reveal. [0] https://web.archive.org/web/20080220095541/https://www.ycombinator.com/hackernews.html https://web.archive.org/web/20080220095541/https://www.ycomb...
- jonny_eh 7y ago
  Does Social Engineering count too?
  - gruez 7y ago
    I don't think so. If I bribed (or "lobbied") a congressman to vote for my bill, did I really hack the US federal government?
    - scollet 7y ago
      I think the difference of opinion is whether or not you think on-paper democracy includes lobbying as a natural mechanism for law making and whether or not lobbying is, respectively, a workaround.
- munchbunny 7y ago
  I’d categorize this under social engineering, so... probably counts. But the terminology issue seems like a surface detail. The attack vector (bribing an insider with front door access to customer data) is a pretty big and actively exploited class of organizational vulnerabilities, so it’s a security problem anyway.
  - mc32 7y ago
    It is a security problem but it’s not hacking. Default passwords are security problems but they’re also not hacking. Overhearing conversations in an airport or bar or whatever where sensitive information is disclosed is a security risk but also isn’t hacking.
    - wolco 7y ago
      These are all examples of hacking. Finding a way in is the goal it can be a clever way but sometimes doing the obvious is more clever.
      - umvi 7y ago
        So is torturing a password out of someone hacking? I suppose if the torture method involves a hacksaw.
        kbenson 7y ago
        Yes, depending on the purpose and use of gaining the password, that qualifies as a horrible, horrible portion of a hack.
        danso 7y ago
        Hacking imho implies a workaround or circumvention that has a certain degree of cost-effectiveness and an indirect angle of attack (e.g. many types of remote exploits). For example, I don't know if I'd consider a brute force calculation of a password to be "hacking", if the cost and time of computing resources outweighed the potential gain. And while hacking a user's arm off might be more "cost-effective" (to put it coldly) than brute forcing their password, it essentially requires the resources and opportunity to have very direct physical access – in the same way that blowing off a bank vault door with explosives doesn't feel like "hacking". But in any case, I don't think bribery as an effective attack vector for a service as big as Roblox is so self-evident that it lacks cleverness or insight. It's not just the work of finding someone with access privileges (could be as "easy" as searching LinkedIn for people listing Roblox as an employer), but also knowing what to bargain for (e.g. account credentials versus "give me the password of the richest Roblox player"), and having the confidence that the system would allow me essentially unfettered access (i.e. weak access-control policies and threat detection). Logically, if bribery is such a straightforward and cost-effective attack, then people would be going hard all the time bribing insider employees at a bank. Yet if I had the money and time and willingness for illegal behavior, I'm not at all certain what unauthorized access I could get from any bank employee, nevermind how far I'd get undetected. To put it another way, "legitimate" hacks usually reveal major substantive ways that a system can/should be hardened. I think it's pretty obvious how Roblox's access-control and auditing should be hardened after this kind of intrusion. How would a company realistically improve its security after learning a user's own account was compromised after the user was tortured into giving away their credentials?
- xkcd-sucks 7y ago
  It must take some skill in developing relationships -- Who has access to the information? Who is willing to take a bribe? What amount to bribe? Who can actually follow through? Who can do it tactfully enough to not get caught in the act? Etc. Maybe not "computer hacker", but "organizational hacker" sure
- freepor 7y ago
  On the "hacker's" resume for a security job? No, it doesn't count. From the user's perspective who had their data leak? Of course it counts.
- 2OEH8eoCRo0 7y ago
  Unauthorized use of a computer system. Yeah, fits one definition.
al_chemist 7y ago
Does that mean Jeff Bezos is potentially the strongest hacker?
- lihaciudaniel 7y ago
  doing illegal stuff for money and bribes existed since antiquity it's just human nature
rietta 7y ago
I'll be using this example for years to come with clients who push back on why certain logging and alerting functionality has to be part of customer service related user stories as an acceptance criteria! There is always the insider threat!
- rietta 7y ago
  Seriously. This fits directly one of my go to examples of a user story that needs security constraints: "As customer service, I need to be able to help my customer regain access to their account easily so that they can continue to do business with us." I'm teaching a group of developers about Risk Assessment and threat modeling on Wednesday. This is perfect timing to enhance the lesson slides with this story and have them think about "Fraud Against People Assets". As customer service, I need to be able to help my customer regain access to their account easily so that they can continue to do business with us. Security Threat: Customer service agents may use their trusted access for fraudulent, purposes. Compensating Controls / Acceptance Criteria 1. Software should log all customer service actions and write to a file that is kept for 1 year for review 2. Users should be informed that their actions are logged in clear, bold language when accessing customer portal 3. Notify customers at already known contact when anything about their account is changed by customer service portal
quijoteuniv 7y ago
Online criminal = hacker That is probably the use of the word for most people
mschuster91 7y ago
And this is why you should not make backend services accessible from the wide Internet, only from a 2-factor secured VPN or corporate internal network. It's utterly amazing how many companies got hacked by this oversight.
- madjam002 7y ago
  Why not just make the back office require 2fa? No need for a VPN
  - mschuster91 7y ago
    Simple: because an Internet-accessible backend will always be a prime target for hackers. RCE exploits, API endpoints where the developer forgot or misconfigured the authorization checks, credential spoofing/phishing... keep that stuff on the real intranet and a whole class of attacks simply vanishes.
    - Skunkleton 7y ago
      For small organizations isolating this stuff on an intranet makes sense. For larger organizations that is less valuable, as the intranet becomes less trusted. Some larger companies have done away with large portions of their intranet.
    - madjam002 7y ago
      And a VPN isn't subject to exploits or misconfiguration either? I'd much rather put my back office behind a 2fa in the browser than use a VPN, it's a far better user experience. Using an off the shelf reverse proxy or commercial solution mitigates to some extent the risk of developers messing up the auth, but both a VPN and proxy can be misconfigured. https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp
      - robotnikman 7y ago
        I would argue that making sure a VPN is correctly configured is easier than making sure every single backend service is configured correctly and patched against all known vulnerabilities. Overall I think its best to keep those things on the company intranet and only accessible remotely via VPN, while further limiting the employee to have access only to the services they need on the network Even better though, why not use both 2fa and locking such improtant services to the intranet or behind a VPN
UI_at_80x24 7y ago
The real takeaway from this: Do your threat models include your staff? Of course, nobody has admin access. Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job? IME this is a great interview question to ask potential employers. The rabbit hole that you are required to go down will open eyes. The answer is: you can't. But how you mitigate damage (with data silos) and engage in disaster recovery after the fact puts you in excellent condition to weather any storm.
- dec0dedab0de 7y ago
  Every time a friend or relative asks my opinion on some tech that involves cameras or microphones I always point this out. Usually by asking How comfortable do you feel with a bored admin watching you? How well do you think the company is monitoring it?
- munchbunny 7y ago
  Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job? That's precisely the hard question, but I think you can reframe that question: "How can you tell when somebody is accessing data that isn't necessary to do their job, in a given specific case?" For example, could you correlate access logs to support tickets to make sure a support agent was only accessing sensitive data corresponding to the customer whose ticket they were working on? Could you do that in a mostly transparent way? What if the customer has to explicitly grant access before the agent can open the account for investigation? (None of these ideas are silver bullets, they're all situational possibilities.) I don't think there are any easy answers, but I do think there's some granularity to how hard any given company finds it reasonable to try to guard against this issue at a behavioral level.
  - eternalban 7y ago
    This may be a killer app for capability (security) model' approach. The "bored admin" of another comment in this thread has a 'superuser' ACL grant, and would leave auditable traces [if using] a provisionally granted security capability.
ipnon 7y ago
The boundary between cyber criminal and smooth criminal has always been blurred. Consider the social engineering prerequisite for LOVE-LETTER-FOR-YOU.txt.vbs. No one remembers his other worms because nobody opens malware.sh.
ChrisArchitect 7y ago
This is Mr. Eddie Vedder, from Accounting. I just had a power surge here at home that wiped out a file I was working on. Listen, I'm in big trouble, do you know anything about computers? Right, well my BLT drive on my computer just went AWOL, and I've got this big project due tomorrow for Mr. Kawasaki, and if I don't get it in, he's gonna ask me to commit Hari Kari... Yeah, well, you know these Japanese management techniques. Could you, uh, read me the number on the modem? --Dade social engineers a security guy over the phone in Hackers
- function_seven 7y ago
  For those on mobile: > This is Mr. Eddie Vedder, from Accounting. I just had a power surge here at home that wiped out a file I was working on. Listen, I'm in big trouble, do you know anything about computers? > Right, well my BLT drive on my computer just went AWOL, and I've got this big project due tomorrow for Mr. Kawasaki, and if I don't get it in, he's gonna ask me to commit Hari Kari... > Yeah, well, you know these Japanese management techniques. Could you, uh, read me the number on the modem?
VikingCoder 7y ago
Step 1, audit everything. Step 2, have a Red Team that's trying to do sneaky things. Make sure you can catch them. Is this not obvious? I mean, it's as obvious to me as "if it's important, back it up," and "if you don't test backups, they're not backups." Roblox Corporation raised $150M at a $2.5B valuation, in 2018. [1] That's big enough that they should understand these rules and follow them. [1] https://variety.com/2018/gaming/news/roblox-investor-funding-1202926691/ https://variety.com/2018/gaming/news/roblox-investor-funding...
- techntoke 7y ago
  How is this data not covered under COPPA? Most people I know that play Roblox are under 13 years old.
annoyingnoob 7y ago
Does Roblox pay the folks with access to this system a living wage? Why was it so easy to sway someone in this group?
- Nextgrid 7y ago
  This is the main problem and it isn't specific to Roblox; mobile carriers have the same attack vector when it comes to fraudulent SIM swaps.
lihaciudaniel 7y ago
To prove a point that these people use Microsoft framework for their back back end development.
notadev 7y ago
Back in the days of AOL, before phishing became mainstream, it was all about getting the leetest screen names or wielding power over inferior "hacking" rivals. One of the easiest ways was to befriend college kids who worked as CSRs and eventually extract enough info to call in and reset the password. That eventually stopped working so well when AOL added auditing to their customer support activities. History repeats itself!
pokspoof 7y ago
https://hackaday.io/pokemongospoofing https://hackaday.io/pokemongospoofing
pokspoof 7y ago
https://hackaday.io/freerobuxgenerator https://hackaday.io/freerobuxgenerator
pokspoof 7y ago
https://wiseintro.co/free-robux-codes https://wiseintro.co/free-robux-codes
pokspoof 7y ago
https://free-robux-generator-2020.hackathon.com/ https://free-robux-generator-2020.hackathon.com/

151 points by danso 7y ago

dgrin91 7y ago

Does it really count as a 'hacker' if it was just a straight up bribe? Where is the hacking here?

danso 7y ago
How do you define "hacker"? This site changed its name from "Startup News" to "Hacker News" [0], but I don't think it signaled a complete shift in userbase and topics. In any case, the article says the person "changed the password for and stole items from Roblox users". Would you say it's wrong for those users to describe their accounts as being "hacked"? edit: moreover, no matter the method of intrusion, it shows how basic/non-existent the auditing and access-control is for a system that services 100 million active monthly users, which is most definitely the kind of security issue that traditional technical hacks reveal. [0] https://web.archive.org/web/20080220095541/https://www.ycombinator.com/hackernews.html https://web.archive.org/web/20080220095541/https://www.ycomb...
jonny_eh 7y ago
Does Social Engineering count too?
- gruez 7y ago
  I don't think so. If I bribed (or "lobbied") a congressman to vote for my bill, did I really hack the US federal government?
  - scollet 7y ago
    I think the difference of opinion is whether or not you think on-paper democracy includes lobbying as a natural mechanism for law making and whether or not lobbying is, respectively, a workaround.
munchbunny 7y ago
I’d categorize this under social engineering, so... probably counts. But the terminology issue seems like a surface detail. The attack vector (bribing an insider with front door access to customer data) is a pretty big and actively exploited class of organizational vulnerabilities, so it’s a security problem anyway.
- mc32 7y ago
  It is a security problem but it’s not hacking. Default passwords are security problems but they’re also not hacking. Overhearing conversations in an airport or bar or whatever where sensitive information is disclosed is a security risk but also isn’t hacking.
  - wolco 7y ago
    These are all examples of hacking. Finding a way in is the goal it can be a clever way but sometimes doing the obvious is more clever.
    - umvi 7y ago
      So is torturing a password out of someone hacking? I suppose if the torture method involves a hacksaw.
      - kbenson 7y ago
        Yes, depending on the purpose and use of gaining the password, that qualifies as a horrible, horrible portion of a hack.
      - danso 7y ago
        Hacking imho implies a workaround or circumvention that has a certain degree of cost-effectiveness and an indirect angle of attack (e.g. many types of remote exploits). For example, I don't know if I'd consider a brute force calculation of a password to be "hacking", if the cost and time of computing resources outweighed the potential gain. And while hacking a user's arm off might be more "cost-effective" (to put it coldly) than brute forcing their password, it essentially requires the resources and opportunity to have very direct physical access – in the same way that blowing off a bank vault door with explosives doesn't feel like "hacking". But in any case, I don't think bribery as an effective attack vector for a service as big as Roblox is so self-evident that it lacks cleverness or insight. It's not just the work of finding someone with access privileges (could be as "easy" as searching LinkedIn for people listing Roblox as an employer), but also knowing what to bargain for (e.g. account credentials versus "give me the password of the richest Roblox player"), and having the confidence that the system would allow me essentially unfettered access (i.e. weak access-control policies and threat detection). Logically, if bribery is such a straightforward and cost-effective attack, then people would be going hard all the time bribing insider employees at a bank. Yet if I had the money and time and willingness for illegal behavior, I'm not at all certain what unauthorized access I could get from any bank employee, nevermind how far I'd get undetected. To put it another way, "legitimate" hacks usually reveal major substantive ways that a system can/should be hardened. I think it's pretty obvious how Roblox's access-control and auditing should be hardened after this kind of intrusion. How would a company realistically improve its security after learning a user's own account was compromised after the user was tortured into giving away their credentials?
xkcd-sucks 7y ago
It must take some skill in developing relationships -- Who has access to the information? Who is willing to take a bribe? What amount to bribe? Who can actually follow through? Who can do it tactfully enough to not get caught in the act? Etc. Maybe not "computer hacker", but "organizational hacker" sure
freepor 7y ago
On the "hacker's" resume for a security job? No, it doesn't count. From the user's perspective who had their data leak? Of course it counts.
2OEH8eoCRo0 7y ago
Unauthorized use of a computer system. Yeah, fits one definition.

al_chemist 7y ago

Does that mean Jeff Bezos is potentially the strongest hacker?

lihaciudaniel 7y ago
doing illegal stuff for money and bribes existed since antiquity it's just human nature

rietta 7y ago

I'll be using this example for years to come with clients who push back on why certain logging and alerting functionality has to be part of customer service related user stories as an acceptance criteria! There is always the insider threat!

rietta 7y ago
Seriously. This fits directly one of my go to examples of a user story that needs security constraints: "As customer service, I need to be able to help my customer regain access to their account easily so that they can continue to do business with us." I'm teaching a group of developers about Risk Assessment and threat modeling on Wednesday. This is perfect timing to enhance the lesson slides with this story and have them think about "Fraud Against People Assets". As customer service, I need to be able to help my customer regain access to their account easily so that they can continue to do business with us. Security Threat: Customer service agents may use their trusted access for fraudulent, purposes. Compensating Controls / Acceptance Criteria 1. Software should log all customer service actions and write to a file that is kept for 1 year for review 2. Users should be informed that their actions are logged in clear, bold language when accessing customer portal 3. Notify customers at already known contact when anything about their account is changed by customer service portal

quijoteuniv 7y ago

Online criminal = hacker That is probably the use of the word for most people

mschuster91 7y ago

And this is why you should not make backend services accessible from the wide Internet, only from a 2-factor secured VPN or corporate internal network. It's utterly amazing how many companies got hacked by this oversight.

madjam002 7y ago
Why not just make the back office require 2fa? No need for a VPN
- mschuster91 7y ago
  Simple: because an Internet-accessible backend will always be a prime target for hackers. RCE exploits, API endpoints where the developer forgot or misconfigured the authorization checks, credential spoofing/phishing... keep that stuff on the real intranet and a whole class of attacks simply vanishes.
  - Skunkleton 7y ago
    For small organizations isolating this stuff on an intranet makes sense. For larger organizations that is less valuable, as the intranet becomes less trusted. Some larger companies have done away with large portions of their intranet.
  - madjam002 7y ago
    And a VPN isn't subject to exploits or misconfiguration either? I'd much rather put my back office behind a 2fa in the browser than use a VPN, it's a far better user experience. Using an off the shelf reverse proxy or commercial solution mitigates to some extent the risk of developers messing up the auth, but both a VPN and proxy can be misconfigured. https://cloud.google.com/beyondcorp https://cloud.google.com/beyondcorp
    - robotnikman 7y ago
      I would argue that making sure a VPN is correctly configured is easier than making sure every single backend service is configured correctly and patched against all known vulnerabilities. Overall I think its best to keep those things on the company intranet and only accessible remotely via VPN, while further limiting the employee to have access only to the services they need on the network Even better though, why not use both 2fa and locking such improtant services to the intranet or behind a VPN

UI_at_80x24 7y ago

The real takeaway from this: Do your threat models include your staff? Of course, nobody has admin access. Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job? IME this is a great interview question to ask potential employers. The rabbit hole that you are required to go down will open eyes. The answer is: you can't. But how you mitigate damage (with data silos) and engage in disaster recovery after the fact puts you in excellent condition to weather any storm.

dec0dedab0de 7y ago
Every time a friend or relative asks my opinion on some tech that involves cameras or microphones I always point this out. Usually by asking How comfortable do you feel with a bored admin watching you? How well do you think the company is monitoring it?
munchbunny 7y ago
Do your threat models include your staff accessing restricted information that they need to access? How do you stop somebody from doing their job? That's precisely the hard question, but I think you can reframe that question: "How can you tell when somebody is accessing data that isn't necessary to do their job, in a given specific case?" For example, could you correlate access logs to support tickets to make sure a support agent was only accessing sensitive data corresponding to the customer whose ticket they were working on? Could you do that in a mostly transparent way? What if the customer has to explicitly grant access before the agent can open the account for investigation? (None of these ideas are silver bullets, they're all situational possibilities.) I don't think there are any easy answers, but I do think there's some granularity to how hard any given company finds it reasonable to try to guard against this issue at a behavioral level.
- eternalban 7y ago
  This may be a killer app for capability (security) model' approach. The "bored admin" of another comment in this thread has a 'superuser' ACL grant, and would leave auditable traces [if using] a provisionally granted security capability.

ipnon 7y ago

The boundary between cyber criminal and smooth criminal has always been blurred. Consider the social engineering prerequisite for LOVE-LETTER-FOR-YOU.txt.vbs. No one remembers his other worms because nobody opens malware.sh.

ChrisArchitect 7y ago

This is Mr. Eddie Vedder, from Accounting. I just had a power surge here at home that wiped out a file I was working on. Listen, I'm in big trouble, do you know anything about computers? Right, well my BLT drive on my computer just went AWOL, and I've got this big project due tomorrow for Mr. Kawasaki, and if I don't get it in, he's gonna ask me to commit Hari Kari... Yeah, well, you know these Japanese management techniques. Could you, uh, read me the number on the modem? --Dade social engineers a security guy over the phone in Hackers

function_seven 7y ago
For those on mobile: > This is Mr. Eddie Vedder, from Accounting. I just had a power surge here at home that wiped out a file I was working on. Listen, I'm in big trouble, do you know anything about computers? > Right, well my BLT drive on my computer just went AWOL, and I've got this big project due tomorrow for Mr. Kawasaki, and if I don't get it in, he's gonna ask me to commit Hari Kari... > Yeah, well, you know these Japanese management techniques. Could you, uh, read me the number on the modem?

VikingCoder 7y ago

Step 1, audit everything. Step 2, have a Red Team that's trying to do sneaky things. Make sure you can catch them. Is this not obvious? I mean, it's as obvious to me as "if it's important, back it up," and "if you don't test backups, they're not backups." Roblox Corporation raised $150M at a $2.5B valuation, in 2018. [1] That's big enough that they should understand these rules and follow them. [1] https://variety.com/2018/gaming/news/roblox-investor-funding-1202926691/ https://variety.com/2018/gaming/news/roblox-investor-funding...

techntoke 7y ago
How is this data not covered under COPPA? Most people I know that play Roblox are under 13 years old.

annoyingnoob 7y ago

Does Roblox pay the folks with access to this system a living wage? Why was it so easy to sway someone in this group?

Nextgrid 7y ago
This is the main problem and it isn't specific to Roblox; mobile carriers have the same attack vector when it comes to fraudulent SIM swaps.

lihaciudaniel 7y ago

To prove a point that these people use Microsoft framework for their back back end development.

notadev 7y ago

Back in the days of AOL, before phishing became mainstream, it was all about getting the leetest screen names or wielding power over inferior "hacking" rivals. One of the easiest ways was to befriend college kids who worked as CSRs and eventually extract enough info to call in and reset the password. That eventually stopped working so well when AOL added auditing to their customer support activities. History repeats itself!

pokspoof 7y ago

https://hackaday.io/pokemongospoofing https://hackaday.io/pokemongospoofing

pokspoof 7y ago

https://hackaday.io/freerobuxgenerator https://hackaday.io/freerobuxgenerator

pokspoof 7y ago

https://wiseintro.co/free-robux-codes https://wiseintro.co/free-robux-codes

pokspoof 7y ago

https://free-robux-generator-2020.hackathon.com/ https://free-robux-generator-2020.hackathon.com/