4 ms·

Does it really count as a 'hacker' if it was just a straight up bribe? Where is the hacking here?

danso 6y ago
How do you define "hacker"? This site changed its name from "Startup News" to "Hacker News" [0], but I don't think it signaled a complete shift in userbase and topics. In any case, the article says the person "changed the password for and stole items from Roblox users". Would you say it's wrong for those users to describe their accounts as being "hacked"? edit: moreover, no matter the method of intrusion, it shows how basic/non-existent the auditing and access-control is for a system that services 100 million active monthly users, which is most definitely the kind of security issue that traditional technical hacks reveal. [0] https://web.archive.org/web/20080220095541/https://www.ycombinator.com/hackernews.html https://web.archive.org/web/20080220095541/https://www.ycomb...
jonny_eh 6y ago
Does Social Engineering count too?
- gruez 6y ago
  I don't think so. If I bribed (or "lobbied") a congressman to vote for my bill, did I really hack the US federal government?
  - scollet 6y ago
    I think the difference of opinion is whether or not you think on-paper democracy includes lobbying as a natural mechanism for law making and whether or not lobbying is, respectively, a workaround.
munchbunny 6y ago
I’d categorize this under social engineering, so... probably counts. But the terminology issue seems like a surface detail. The attack vector (bribing an insider with front door access to customer data) is a pretty big and actively exploited class of organizational vulnerabilities, so it’s a security problem anyway.
- mc32 6y ago
  It is a security problem but it’s not hacking. Default passwords are security problems but they’re also not hacking. Overhearing conversations in an airport or bar or whatever where sensitive information is disclosed is a security risk but also isn’t hacking.
  - wolco 6y ago
    These are all examples of hacking. Finding a way in is the goal it can be a clever way but sometimes doing the obvious is more clever.
    - umvi 6y ago
      So is torturing a password out of someone hacking? I suppose if the torture method involves a hacksaw.
      - kbenson 6y ago
        Yes, depending on the purpose and use of gaining the password, that qualifies as a horrible, horrible portion of a hack.
      - danso 6y ago
        Hacking imho implies a workaround or circumvention that has a certain degree of cost-effectiveness and an indirect angle of attack (e.g. many types of remote exploits). For example, I don't know if I'd consider a brute force calculation of a password to be "hacking", if the cost and time of computing resources outweighed the potential gain. And while hacking a user's arm off might be more "cost-effective" (to put it coldly) than brute forcing their password, it essentially requires the resources and opportunity to have very direct physical access – in the same way that blowing off a bank vault door with explosives doesn't feel like "hacking". But in any case, I don't think bribery as an effective attack vector for a service as big as Roblox is so self-evident that it lacks cleverness or insight. It's not just the work of finding someone with access privileges (could be as "easy" as searching LinkedIn for people listing Roblox as an employer), but also knowing what to bargain for (e.g. account credentials versus "give me the password of the richest Roblox player"), and having the confidence that the system would allow me essentially unfettered access (i.e. weak access-control policies and threat detection). Logically, if bribery is such a straightforward and cost-effective attack, then people would be going hard all the time bribing insider employees at a bank. Yet if I had the money and time and willingness for illegal behavior, I'm not at all certain what unauthorized access I could get from any bank employee, nevermind how far I'd get undetected. To put it another way, "legitimate" hacks usually reveal major substantive ways that a system can/should be hardened. I think it's pretty obvious how Roblox's access-control and auditing should be hardened after this kind of intrusion. How would a company realistically improve its security after learning a user's own account was compromised after the user was tortured into giving away their credentials?
xkcd-sucks 6y ago
It must take some skill in developing relationships -- Who has access to the information? Who is willing to take a bribe? What amount to bribe? Who can actually follow through? Who can do it tactfully enough to not get caught in the act? Etc. Maybe not "computer hacker", but "organizational hacker" sure
freepor 6y ago
On the "hacker's" resume for a security job? No, it doesn't count. From the user's perspective who had their data leak? Of course it counts.
2OEH8eoCRo0 6y ago
Unauthorized use of a computer system. Yeah, fits one definition.

How do you define "hacker"? This site changed its name from "Startup News" to "Hacker News" [0], but I don't think it signaled a complete shift in userbase and topics. In any case, the article says the person "changed the password for and stole items from Roblox users". Would you say it's wrong for those users to describe their accounts as being "hacked"? edit: moreover, no matter the method of intrusion, it shows how basic/non-existent the auditing and access-control is for a system that services 100 million active monthly users, which is most definitely the kind of security issue that traditional technical hacks reveal. [0] https://web.archive.org/web/20080220095541/https://www.ycombinator.com/hackernews.html https://web.archive.org/web/20080220095541/https://www.ycomb...

jonny_eh 6y ago

Does Social Engineering count too?

gruez 6y ago
I don't think so. If I bribed (or "lobbied") a congressman to vote for my bill, did I really hack the US federal government?
- scollet 6y ago
  I think the difference of opinion is whether or not you think on-paper democracy includes lobbying as a natural mechanism for law making and whether or not lobbying is, respectively, a workaround.

munchbunny 6y ago

I’d categorize this under social engineering, so... probably counts. But the terminology issue seems like a surface detail. The attack vector (bribing an insider with front door access to customer data) is a pretty big and actively exploited class of organizational vulnerabilities, so it’s a security problem anyway.

mc32 6y ago
It is a security problem but it’s not hacking. Default passwords are security problems but they’re also not hacking. Overhearing conversations in an airport or bar or whatever where sensitive information is disclosed is a security risk but also isn’t hacking.
- wolco 6y ago
  These are all examples of hacking. Finding a way in is the goal it can be a clever way but sometimes doing the obvious is more clever.
  - umvi 6y ago
    So is torturing a password out of someone hacking? I suppose if the torture method involves a hacksaw.
    - kbenson 6y ago
      Yes, depending on the purpose and use of gaining the password, that qualifies as a horrible, horrible portion of a hack.
    - danso 6y ago
      Hacking imho implies a workaround or circumvention that has a certain degree of cost-effectiveness and an indirect angle of attack (e.g. many types of remote exploits). For example, I don't know if I'd consider a brute force calculation of a password to be "hacking", if the cost and time of computing resources outweighed the potential gain. And while hacking a user's arm off might be more "cost-effective" (to put it coldly) than brute forcing their password, it essentially requires the resources and opportunity to have very direct physical access – in the same way that blowing off a bank vault door with explosives doesn't feel like "hacking". But in any case, I don't think bribery as an effective attack vector for a service as big as Roblox is so self-evident that it lacks cleverness or insight. It's not just the work of finding someone with access privileges (could be as "easy" as searching LinkedIn for people listing Roblox as an employer), but also knowing what to bargain for (e.g. account credentials versus "give me the password of the richest Roblox player"), and having the confidence that the system would allow me essentially unfettered access (i.e. weak access-control policies and threat detection). Logically, if bribery is such a straightforward and cost-effective attack, then people would be going hard all the time bribing insider employees at a bank. Yet if I had the money and time and willingness for illegal behavior, I'm not at all certain what unauthorized access I could get from any bank employee, nevermind how far I'd get undetected. To put it another way, "legitimate" hacks usually reveal major substantive ways that a system can/should be hardened. I think it's pretty obvious how Roblox's access-control and auditing should be hardened after this kind of intrusion. How would a company realistically improve its security after learning a user's own account was compromised after the user was tortured into giving away their credentials?

xkcd-sucks 6y ago

It must take some skill in developing relationships -- Who has access to the information? Who is willing to take a bribe? What amount to bribe? Who can actually follow through? Who can do it tactfully enough to not get caught in the act? Etc. Maybe not "computer hacker", but "organizational hacker" sure

freepor 6y ago

On the "hacker's" resume for a security job? No, it doesn't count. From the user's perspective who had their data leak? Of course it counts.

2OEH8eoCRo0 6y ago

Unauthorized use of a computer system. Yeah, fits one definition.