3 ms·

I’d categorize this under social engineering, so... probably counts. But the terminology issue seems like a surface detail. The attack vector (bribing an insid

I’d categorize this under social engineering, so... probably counts. But the terminology issue seems like a surface detail. The attack vector (bribing an insider with front door access to customer data) is a pretty big and actively exploited class of organizational vulnerabilities, so it’s a security problem anyway.

mc32 6y ago
It is a security problem but it’s not hacking. Default passwords are security problems but they’re also not hacking. Overhearing conversations in an airport or bar or whatever where sensitive information is disclosed is a security risk but also isn’t hacking.
- wolco 6y ago
  These are all examples of hacking. Finding a way in is the goal it can be a clever way but sometimes doing the obvious is more clever.
  - umvi 6y ago
    So is torturing a password out of someone hacking? I suppose if the torture method involves a hacksaw.
    - kbenson 6y ago
      Yes, depending on the purpose and use of gaining the password, that qualifies as a horrible, horrible portion of a hack.
    - danso 6y ago
      Hacking imho implies a workaround or circumvention that has a certain degree of cost-effectiveness and an indirect angle of attack (e.g. many types of remote exploits). For example, I don't know if I'd consider a brute force calculation of a password to be "hacking", if the cost and time of computing resources outweighed the potential gain. And while hacking a user's arm off might be more "cost-effective" (to put it coldly) than brute forcing their password, it essentially requires the resources and opportunity to have very direct physical access – in the same way that blowing off a bank vault door with explosives doesn't feel like "hacking". But in any case, I don't think bribery as an effective attack vector for a service as big as Roblox is so self-evident that it lacks cleverness or insight. It's not just the work of finding someone with access privileges (could be as "easy" as searching LinkedIn for people listing Roblox as an employer), but also knowing what to bargain for (e.g. account credentials versus "give me the password of the richest Roblox player"), and having the confidence that the system would allow me essentially unfettered access (i.e. weak access-control policies and threat detection). Logically, if bribery is such a straightforward and cost-effective attack, then people would be going hard all the time bribing insider employees at a bank. Yet if I had the money and time and willingness for illegal behavior, I'm not at all certain what unauthorized access I could get from any bank employee, nevermind how far I'd get undetected. To put it another way, "legitimate" hacks usually reveal major substantive ways that a system can/should be hardened. I think it's pretty obvious how Roblox's access-control and auditing should be hardened after this kind of intrusion. How would a company realistically improve its security after learning a user's own account was compromised after the user was tortured into giving away their credentials?
- danso 6y ago
  Hacking almost always involves a decisive understanding of weaknesses general and specific to a system. Most of us know what default passwords are but don't have the initiative or ability to find an opportunity and actually exploit it. Similarly, just because I know what a bribe is doesn't mean I think it's trivial to bribe someone successfully and gain useful escalated privileges to a very large system.
- kbenson 6y ago
  Overhearing something accidentally isn't, but purposefully putting yourself in proximity so you have a chance for that is espionage and possibly social engineering (depending on whether you're just near or playing yourself off as part of a similar group). In many ways, this is close to the original term of hacking, which is less about computers and more about circumvention of restrictions and security.
- munchbunny 6y ago
  Fair enough. I could get on board with your way of delineating it. The way I see it is that modern day "hacking" and "espionage" form a venn diagram, and that particular distinction isn't important anymore when it comes to attacking and protecting businesses in digital space. Espionage based tactics for digital intrusion, including getting physical access to the digital assets, are usually fair game for pentesting and are often within the scope of the blue team.
deleted 6y ago
[deleted]

mc32 6y ago

It is a security problem but it’s not hacking. Default passwords are security problems but they’re also not hacking. Overhearing conversations in an airport or bar or whatever where sensitive information is disclosed is a security risk but also isn’t hacking.

wolco 6y ago
These are all examples of hacking. Finding a way in is the goal it can be a clever way but sometimes doing the obvious is more clever.
- umvi 6y ago
  So is torturing a password out of someone hacking? I suppose if the torture method involves a hacksaw.
  - kbenson 6y ago
    Yes, depending on the purpose and use of gaining the password, that qualifies as a horrible, horrible portion of a hack.
  - danso 6y ago
    Hacking imho implies a workaround or circumvention that has a certain degree of cost-effectiveness and an indirect angle of attack (e.g. many types of remote exploits). For example, I don't know if I'd consider a brute force calculation of a password to be "hacking", if the cost and time of computing resources outweighed the potential gain. And while hacking a user's arm off might be more "cost-effective" (to put it coldly) than brute forcing their password, it essentially requires the resources and opportunity to have very direct physical access – in the same way that blowing off a bank vault door with explosives doesn't feel like "hacking". But in any case, I don't think bribery as an effective attack vector for a service as big as Roblox is so self-evident that it lacks cleverness or insight. It's not just the work of finding someone with access privileges (could be as "easy" as searching LinkedIn for people listing Roblox as an employer), but also knowing what to bargain for (e.g. account credentials versus "give me the password of the richest Roblox player"), and having the confidence that the system would allow me essentially unfettered access (i.e. weak access-control policies and threat detection). Logically, if bribery is such a straightforward and cost-effective attack, then people would be going hard all the time bribing insider employees at a bank. Yet if I had the money and time and willingness for illegal behavior, I'm not at all certain what unauthorized access I could get from any bank employee, nevermind how far I'd get undetected. To put it another way, "legitimate" hacks usually reveal major substantive ways that a system can/should be hardened. I think it's pretty obvious how Roblox's access-control and auditing should be hardened after this kind of intrusion. How would a company realistically improve its security after learning a user's own account was compromised after the user was tortured into giving away their credentials?
danso 6y ago
Hacking almost always involves a decisive understanding of weaknesses general and specific to a system. Most of us know what default passwords are but don't have the initiative or ability to find an opportunity and actually exploit it. Similarly, just because I know what a bribe is doesn't mean I think it's trivial to bribe someone successfully and gain useful escalated privileges to a very large system.
kbenson 6y ago
Overhearing something accidentally isn't, but purposefully putting yourself in proximity so you have a chance for that is espionage and possibly social engineering (depending on whether you're just near or playing yourself off as part of a similar group). In many ways, this is close to the original term of hacking, which is less about computers and more about circumvention of restrictions and security.
munchbunny 6y ago
Fair enough. I could get on board with your way of delineating it. The way I see it is that modern day "hacking" and "espionage" form a venn diagram, and that particular distinction isn't important anymore when it comes to attacking and protecting businesses in digital space. Espionage based tactics for digital intrusion, including getting physical access to the digital assets, are usually fair game for pentesting and are often within the scope of the blue team.

deleted 6y ago

[deleted]