17 ms·
Hackers used Slack to break into EA Games
- bellyfullofbac 5y ago> A representative for the hackers told Motherboard in an online chat that the process started by purchasing stolen cookies being sold online for $10 and using those to gain access to a Slack channel used by EA. How much to bet that a browser extension was involved? Man, the whole landscape is the new "Download this shareware EXE file" but with a thin veneer of legitimacy "It's hosted by Google/Mozilla/Microsoft, it can't be bad!".
- SV_BubbleTime 5y agoI have no idea at all, but I would assume that browser extensions are not just an exe with unlimited ability to run arbitrary code, but rather I would think they are sandboxed to have limited scope... right?
- pkulak 5y agoThey aren't sandboxed at all. Almost all of them request full access to every page you visit. At least an exe might not be able to view and manipulate the dom inside your browser.
- tomjakubowski 5y agoIf the extensions have to request permissions for "full access" to the page, doesn't that mean they're sandboxed?
- pkulak 5y agoIt doesn't, in practice, if they all ask for it and people are conditioned to always grant it.
- shadowgovt 5y agoThis is semi-correct, but basically leans in the right direction. A bit more detail: browser extensions have all manner of permissions and authorizations, generally specified in the manifest file. A lack of permissions translates to constraints on the extension (often in the form of the browser refraining from populating one of the `window` child objects in the context of that extension's JS code). Users downloading extensions can see what the extension is authorized to do. Problem is that much like the security ecosystem for mobile apps, end-users have no idea what any of those permissions mean and lack the technical competency (on average) to determine whether a given permission is high-risk or low-risk (how many end-users even know what CORS or XSRF are, let alone why they matter?). Plus, some of the manifest permissions are basically "keys to the kingdom"-level open permission that allow arbitrary behavior within the limits of the browser sandbox itself. One of the reasons Google is changing permissions in Manifest v3 (as discussed here: https://news.ycombinator.com/item?id=27441898 https://news.ycombinator.com/item?id=27441898) is to nerf some of those permissions (in particular, the Manifest V2 scripting permissions allow an extension's behavior to change by changing some script on a remote site, so an extension that was well-behaved when added to the Chrome Web Store can have its backing server changed or compromised later and become an attack vector).
- btown 5y agoEven with Manifest v3, if you suddenly have access to a browser extension (say, you bought the company making it) with global "inject a known content script that's been vetted by the Web Store and included in the extension bundle" permissions... it's possible to add obfuscated code in that content script that provides RCE on the page to the attacker. Imagine something like a modified form of jQuery that adds and immediately removes a script tag when provided specific inputs - inputs that would be expected to be controlled by the results of a web-based JSON endpoint that's core to the extension's functionality. Is the web store going to code review an entire minified jQuery? Can an automated system detect it? What if attackers hired someone who won IOCCC? The attackers have the upper hand here and can pull the trigger on any website they choose. Which is why Google might say Manifest v3 is all about security, but unless attackers get lazy and let their injectors get fingerprinted, it's all just airport-style security theater... that happens to strangle ad blockers... At any rate, cookies and other methods of XSS will begin to leak more and more, and defense in depth will become the paradigm of the day. Assume your employees' browsers are compromised and plan accordingly.
- asddubs 5y agoreminds me of the good old days when httponly didn't exist and basically every website was vulnerable to xss somewhere.
- mrlonglong 5y agoI have banned slack for years since it's just dross.
- mcraiha 5y agoI would assume that same kind of attack vector would work via Teams, Discord etc.
- grumple 5y agoI would not make that assumption if they use proper security practices. You can make cookies unusable (or harder to use) by anyone but the initial owner a few different ways. You could include a hardware or ip fingerprint in the cookie that has to be validated server side, for example. You can time out cookies after an hour. Etc.
- no-dr-onboard 5y agoWhat do you use instead?
- rednerrus 5y agoCarrier Pigeons.
- tailspin2019 5y agoAhh. CPaaS
- cecilpl2 5y agoIt uses IPoAC.
- klhutchins 5y agosmoke signals
- mrlonglong 5y ago
- sxp 5y agoThe key bit is "The hackers then requested a multifactor authentication token from EA IT support to gain access to EA's corporate network. The representative said this was successful two times." So this was primarily a social engineering hack after Slack was used to get access to a trusted messaging channel.
- barbazoo 5y agoExactly, doesn't sound like this has anything to do with Slack in particular.
- danso 5y agoThe problem probably isn't Slack itself, but EA's policies around Slack. I think it's not nothing that the social engineering happened over Slack. For starters, somehow login cookies to the Slack were stolen and then sold, and those were enough to get into the Slack. And then in 2 separate instances, the hackers were able to convince IT to give them 2 new tokens. Maybe the IT team/policy is just weak across the board, and they would've handed keys over the phone or through internal email. But it's not impossible for the IT team to have a complacent mindset around Slack.
- bostonsre 5y agoYea, I think most users think slack is a safe space. They haven't been conditioned to be suspicious of messages on slack like they have with email. It's a pretty ripe attack vector. Was bored the other week and found a ton of slack web hook urls in public github repos. I think it would be a pretty great way to do some phishing, just need to scrape the urls and brute force channel names with messages with links to websites you own.
- SCHiM 5y agoIt's the same old same old. Like you correctly identified it's a new place, it looks different. People don't think an attacker could approach them over IM, but they can. But the problem goes beyond that. Many organizations have disabled sharing executable file formats in attachments over e-mail. GMail flat-out prevents you from sharing executables, and macro enabled word documents as attachments, even when put into a zip file. But on Microsoft teams? I sent a zip file with 8 unsigned executables to a colleague a few days ago. No warnings, no messages, no nothing :)
- paxys 5y agoIf your employees’ browser cookies are being bought and sold on the open market and tech support is handing out 2FA tokens over chat then which IM software you use is the least of your concerns.
- SV_BubbleTime 5y agoOf course, but on the topic of slack, shouldn't there be more security than a browser cookie required to get access? I get that this in normal scenarios this cookie wouldn't leave the machine, I get that it's very convenient to not have to log in all the time, I get that Slack people know this stuff a lot better than me... but it sure seems like a weakness to have single point of failure to leak your slack channel by losing a cookie. Isn't it?
- jacobsenscott 5y agoGiving your cookies short timeouts, say 5 minutes, and including the client's ip address in the cookie are both mitigating techniques.
- ubercow13 5y agoSo you would be signed out of Slack every 5 minutes?
- theshrike79 5y agoNo, Slack would reauthenticate every 5 minutes. It doesn't mean that the user needs to do anything.
- kleinsch 5y agoIf you closed Slack for more than 5 mins, you’d get signed out. Users would hate it, which is why nobody does this.
- 5y ago
- jayski 5y agohmm a lot of online services have smart to detect suspicious connections, even if you have q cookie. even something as simple as verifying the geo of the IP and client type couldve been useful here. im not sure if slack has this funcionality
- staticassertion 5y agoSlack has an audit trail for some accesses, at the least, so EA could have done the GEOIP on their side.
- paxys 5y agoPretty trivial to route your request through an IP address in the same city as the victim.
- sneak 5y agoPossible, but not exactly trivial to do the same with an IP address in the same city and from the same ASN as the impersonation victim. There are definitely some mitigations you can do servers use to reduce the likelihood of success of this kind of attack. Now I want to go build an auth system. :D
- plorntus 5y agoHow would mobile networks fair with something like this if youre moving around?
- neurostimulant 5y agoPlenty of webapps already do this. You'll usually get asked to re-login or to provide a 2fa code to proceed. Very annoying when you hop between networks often.
- ConcernedCoder 5y agoIMHO tricking an employee to provide a login token is a con, not a hack.
- ssully 5y agoIt's social engineering, which is definitely a hack/technique used in hacking.
- hpoe 5y agoActually I am with the parent on this one. We call it "social engineering" because it sounds cool, but I think that issue muddies the waters for the lay people. When people hear "hackers used Slack to break into EA games" they think something from the movies with some people in a dark room sitting around a screen and say "I'm in" in a deep voice. This convinces people hackers are prevaisve, unseen, and wield Godlike powers, clearly something they can't comprehend or do anything about, so no changes needed in their day to day life. In comparison if you were to phrase it as "some employees got conned into giving out their login info" that changes it to, "wow look at these guys, everyone knows you shouldn't give out your password morons." then the next time they need to give out their info they may hesitate for a moment, because they don't want to be considered the "moron" in that situation. I don't think it will make a big effect but it will help other people become more aware that most of these "hackers" are mostly just con artists, instead of letting everyone live with the constant anxiety of godlike hackers being able to wreak havoc at will.
- danso 5y agoYou really think that any average person, given a login cookie, is equally able to blindly infiltrate a company and successfully exfiltrate its core assets, as long as they can sweet talk a single IT person?
- shadowgovt 5y agoBut no employees in this story were conned into giving out their login info. Instead, hackers acquired enough stolen data to become a passable simulacrum of an employee in the text-based virtual space of Slack, convinced someone they were a coworker, and had that someone hand over the simulated employee's extended credentials. "Hackers can appear to be someone you think you know" is exactly the amount of paranoia the public should have. Faking an authentic-looking request is the most common form of hack, whether that fake is the right 1's and 0's to an API, "Hey Bob, got a small problem..." over Slack, or "I'm the CEO, and I will have you fired if you don't fix this right now" in voice over the phone.
- simonw 5y ago"the process started by purchasing stolen cookies being sold online for $10" Anyone know the details of how this actually works? Does it mean browser cookies? How do cookies end up being sold in this way?
- Theizestooke 5y agoJust ask the girl scouts in your area.
- miketery 5y agoI don’t know for sure, however I presume if you have a compromised browser extension or malware on your device then the cookie can be extracted. And then they’re sold on marketplaces for black hats.
- fooey 5y agoNo idea in this instance, but it's trivial for rogue browser extensions to siphon off cookies
- tyingq 5y agoI see browser extensions mentioned. Maybe Tor exit nodes as well? Or a compromised corporate MITM proxy...that would be funny.
- thrower123 5y agoWhy would you be surprised that the TCS or Cognizant or Accenture customer support rep in Bangalore would care one iota about security? All they care about minimizing Average-time-to-answer and Average-handle-time.
- jabroni_salad 5y agoSpeaking as a consultant, let me tell you that literally none of my clients over the past three years had a password reset authentication policy. Employee just calls IT, and they reset the pw on the spot with no checks whatsoever. Keep in mind that pretty much everyone hates passwords, and a lockout constitutes a work stoppage. Adding any additional friction is resisted at every level from the C-suite to the janitor. I try to mitigate it by proposing self-service workflows, and that's popular, but the IT hotline reset is incredibly difficult to get rid of.
- croes 5y ago>A representative for the hackers told Motherboard in an online chat Isn't it strange how hacking groups more and more seem to behave like valid businesses nowadays?
- throwawayboise 5y agoIt's organized crime. They've always operated like a business.
- dylan604 5y agoI can't decide if that's insulting to OC being compared to the ruthlessness of business like that or not. When big business comes after you, you lose everything. When the OC comes after you, you at least have a chance to fight back.
- croes 5y agoYes, but they buffed up their PR department
- S_A_P 5y agoI beta for a music instrument manufacturer. Getting into their slack channel felt completely arbitrary. I never entered a password I just clicked a link on whichever browser I was using. What? Is that normal?? I’ve never used slack prior to this.
- jacobsenscott 5y agoI believe slack can send one time use login links via email. Given the short timeout and one time use on these links I would consider this more secure than a password based login. Most users just re-use passwords or use simple passwords.
- paulpauper 5y agoI suspect that these hackers are disappointed by how little they earned from stolen EA info, assuming they earned much of anything. This is why hackers target bitcoin exchanges so much, because that is where the money is.
- imglorp 5y agoThe value might not be in the perps selling stolen IP. If they can make new game builds, they can trojan them and hand them out as bootlegs. Boom thousands more intrusions.
- charcircuit 5y agoModding a game to add malware is easy. The source code wouldn't even be helpful since your malware is completely separate as opposed to having to interact with the game engine.
- throwaway52170 5y agoFIFA 21 is uncracked, the source code could potentially help with that step
- kerng 5y agoWhat is interesting here is that the hackers actively describe and share how they broke in, rather then EA setting the narrative. This isn't very common I think.
- dylan604 5y agoThere may be a bit of a desire on the hacker's part to hummiliate EA. This isn't good PR for EA.
- paxys 5y agoThese hackers are about to find out that the market value of 780GB of source code is wayyy less than they think.
- throwawayboise 5y agoYeah, who would buy it? It would be radioactive for any competitor. Even if they were willing to pay for it and launder the funds used, releasing any games that used any EA secret sauce would very likely be detectable. They'd need engage in a parallel construction of source code history to show how they arrived at their implementation independently.
- hu3 5y agoIt's useful for devs of multiplayer game cheats.
- throwawayboise 5y agoIs there much money to be made in those? Honest question; I don't play games at all.
- tiborsaas 5y agoYes, and it's mind-boggling: https://www.bbc.com/news/technology-56579449 https://www.bbc.com/news/technology-56579449
- mardifoufs 5y agoWait i couldn't figure out exactly why they were arrested. Is it illegal to sell video games cheats in china? Was it at the request of the game devs involved? Or maybe money laundering? Even assuming that online cheating is illegal there for some baffling reason... why would the Chinese police care about cheaters on western video games when its not even illegal here? That bbc article is a bit frustrating, just not a lot of useful info there.
- misiti3780 5y agoHow did they use a 10 dollar cookie to get into the slack channel?
- maccard 5y agoThe cookie is an authenticated token to log in to the EA slack. They put the Cookie in-place on their machine and as far as slack is concerned they are the person who the cookie came from.
- philip1209 5y agoThe reality is that it's tough to verify somebody's identity in remote work. The office used to be a walled garden, and now people seem to treat chat as a walled garden. We'll probably see more security incidents like this in the future.
- leipert 5y agoJust do a video call with the employee when they request e.g. MFA resets. Have a policy that enforces that. Maybe have them show an ID.
- patmcc 5y agoShowing ID would work, but a video call? I've worked remotely for years - why would half the people in IT know my face from some other dude?
- leipert 5y agoEven if the person in the video call doesn’t have an ID, the IT support person could: - compare the person with an ID on file - invite the manager or a colleague of the person into the call to confirm - ask for PII (birthdays, address) that are on file I assume someone assuming the identity is more reluctant to show themselves on video. Furthermore being asked PII they are likely not as prepared.
- TumorousJoker 5y agoI guess you could compare the face with the Identity you have on file when the employee joined.
- dang 5y agoRecent related threads: Hackers breach Electronic Arts, stealing game source code and tools - https://news.ycombinator.com/item?id=27470577 https://news.ycombinator.com/item?id=27470577 - June 2021 (111 comments) EA got hacked and games source code leaked including new game Battlefield 2042 - https://news.ycombinator.com/item?id=27468766 https://news.ycombinator.com/item?id=27468766 - June 2021 (139 comments) EA hacked and source code stolen - https://news.ycombinator.com/item?id=27462952 https://news.ycombinator.com/item?id=27462952 - June 2021 (35 comments)
- neurostimulant 5y agoThere is a marketplace for stolen cookies? Anyone know where it is? Seems interesting.
- rmac 5y agohttps://www.f5.com/labs/articles/threat-intelligence/genesis-marketplace--a-digital-fingerprint-darknet-store https://www.f5.com/labs/articles/threat-intelligence/genesis...
- mcoliver 5y agoSo cookie gets them into Slack. But how were they able to get into the network, spin up a vm and connect to p4? That doesn't happen with a cookie and MFA token. They either had a username/password combo already, or support also allowed them to reset the compromised users password (ex through a one time link to set a new pw, or perhaps more egregiously "here is your new password: welcome2EA". A video call and a few questions could have stopped this. Or a password reset flow that requires some sort of previous information. Would love more details here.
- delive 5y agoThis is where I'm confused as well and yours is the first comment mentioning it. A more plausible scenario is that IT reset their AD/IDP password because of the lost device and gave them the temp pw over slack + some MFA token.
- rmac 5y agoThey said they lost their phone, which means they could have told the IT person they also lost access to email "my laptop email logged me out!, Our game is already behind schedule I need to get online now before I get fired" Remember: a good phish will push the target to make quick and poor decisions, by appealing to various emotions.
- fakename 5y agoIt's one cookie, Michael. What could it cost, $10?
- Jenk 5y agoAnyone wondering how "easy" it is to obtain a token may be interested in the setup instructions for slack-term[0]. As for token expiration.. I've been logged into slack-term using the same token for weeks if not months, without needing to reauthenticate. I assume it refreshes. [0]: https://github.com/erroneousboat/slack-term/wiki#running-slack-term-without-legacy-tokens https://github.com/erroneousboat/slack-term/wiki#running-sla... Also free plug for slack-term, I guess. :) TL;DR: socially engineer an EA employee with a link like https://slack.com/oauth/authorize?client_id=32165416946541.136213516385138513521&scope=client&redirect_uri=http%3A%2F%2Foopsyougotjaxxed.com https://slack.com/oauth/authorize?client_id=32165416946541.1... and if they are half asleep they just might auth you. STL;SDR: EA probably permit employees to authenticate with non-official apps/clients, which they probably won't be permitting anymore.
- xupybd 5y agoI really think we need more resources in law enforcement to fight this sort of thing. Yes everyone needs better security practices as well.
- aleks224 5y agoanyone has a guess on how those who sell EA slack cookies for $10 got them in the first place?
- bfrit 5y agoReminds me of using the machine email addresses for Zendesk tickets and other helpdesks where you can reply to the ticket via email to join domain-restricted services like slack, notion, etc. So many clever ways to get in without an explicit technical vuln.
- theshadowknows 5y agoI like to think our policies would prevent this. Like you can’t just get an access token from support. And you have to know your employee network ID to even call support in the first place. And no one can arbitrarily spin up a VM (well, I say no one..no one that I work with including the guys who always need them). But I’m sure there’s one smooth talking person out there that could talk themselves into access if they tried and got to the right overworked and underpaid support person.
- deadite 5y agoThis article doesn't really talk about it but the Witcher 3 and Cyberpunk 2077 source code (including engine and whatnot) are up on torrents now. I suspect this one will be as well in the coming weeks/months. For those curious and with nothing better to do than to have some +ORC styled martini-wodka and spend an evening reading source code, feel free to google at your own leisure. It shouldn't take too long.
- alternatetwo 5y agoAfaik the Witcher 3 and Witcher 3 RTX archives are passworded and have been around since mid march without the passwords surfacing, so you can't really browse those. Cyberpunk has recently leaked without pw, even though it's included in the passworded dump as well.
- Ansil849 5y agoDoes using a stolen cookie allow you to bypass account 2FA in Slack? Or did EA's slack not enforce 2FA for all accounts? I feel like this is an important question because if the former, the security lapse here is on Slack; if the latter, it is on EA.