5 ms·

Is it common, now or historically, to follow up a notification of compromise with self-directed PoC and privilege escalation exercises on the resources of a com

Is it common, now or historically, to follow up a notification of compromise with self-directed PoC and privilege escalation exercises on the resources of a company with which you're not under contract? My naïve take is that this was a series of well-intentioned but possibly criminal actions used to illustrate a lesson we could all be reminded of from time to time. Also, the HackerOne page doesn't appear to be claimed by SEGA Sammy, so notices might dead-end there as well.

aaronwp 5y ago
Yes, if PII is involved it's common to run an audit like this. In addition to the access keys on the server image, Sega also accidentally published a database export containing PII. In order to write a comprehensive disclosure I have to investigate thoroughly. And yeah, there's no branding or information on HackerOne. Even if this had been in scope, I would have thought twice about submitting anything. Our publishing standards match HackerOne ethical disclosure standards.
- tentacleuno 5y ago
  > Even if this had been in scope, I would have thought twice about submitting anything. Sorry, I don't understand. Why would you be hesitant to responsibly disclose it to HackerOne?
  - phnofive 5y ago
    They didn't know about it beforehand, but even if you visit the page, it says that SEGA Sammy hasn't claimed it, so it appears unofficial.
- phnofive 5y ago
  Did Sega agree to this public disclosure? Referring to the HackerOne standards, it appears your team violated a couple: > Respect privacy. Make a good faith effort not to access or destroy another user's data. > Do no harm. Act for the common good through the prompt reporting of all found vulnerabilities. Never willfully exploit others without their permission.
  - wwtrv 5y ago
    Public disclosing it seems to clearly fall under the ‘ Act for the common good through the prompt’ since SEGA’s user are the real victims in this situation and have the right to known that SEGA us incapable of keeping their data safe.
    - batch12 5y ago
      This sounds similar to justification used by ransomware groups.
      - rectang 5y ago
        Only under the most carelessly superficial analysis. Is there any limit to the vast, systemic negligence and enabled criminality which can be excused away into nothingness because the circumstances under which they were made public were problematic? This isn't a criminal prosecution of the company who was irresponsible with user data. If the people who exposed the negligence screwed up, that doesn't mean we have to act as though that the negligence ever happened. Demonizing the messenger while remaining silent about the message is a choice.
        batch12 5y ago
        Mostly agree. It is unfortunate that the methods used by the messenger add distractions to the situation. The point I am trying to make is the ends don't absolve the hacker from consequences. Ransomware operators often blame their victims for poor security and frame their actions as security-as-a-service.
        rectang 5y ago
        > The point I am trying to make is the ends don't absolve the hacker from consequences. I agree on this point. I see it as analogous to holding your allies to a standard that your adversaries are unwilling to uphold. In this case I categorize both black hats and toxic data hoarding companies (including their techie apologist employees) as "adversaries" (though I don't assert you agree with my assessment). > Ransomware operators often blame their victims for poor security and frame their actions as security-as-a-service. Despicable victim blaming by the very party doing the victimizing. I understand why advertising a VPN service can be seen as analogous, even if the scale of profiteering is not comparable. The argument against toxic data hoarding is easier to make when untainted by exploitative profit motive.
throwawaygh 5y ago
> Is it common, now or historically Historically: yes. Now: no. > possibly criminal Sans some sort of formal agreement (which platforms like HackerOne might facilitate), it's definitely criminal. (IMO at least not unethical, to be clear.) Again, sans some sort of contract either one-off or platform based. If SEGA wanted a prosecution, they would almost certainly be able to convince a prosecutor to press charges. The prosecutor would certainly get a guilty verdict. (Or, much more likely, a guilty plea with a bit of prison time and stiff probation.) This still happens from time to time in much more ambiguous situations. E.g., https://www.nytimes.com/2021/10/15/us/missouri-st-louis-post-teachers-hack.html https://www.nytimes.com/2021/10/15/us/missouri-st-louis-post... Fortunately, there's a bit of a gentleman's detente among reasonable white hats and reasonable companies. But if you venture much outside of the small set of companies who rely on and have technologists in senior leadership, the story changes fast.
- floatingatoll 5y ago
  That detente's boundaries may be somewhat vague and impossible to guarantee, but you can broad-brush paint yourself into a safer box with these four principles: - Don't make humiliating changes to their content - Don't mess with their userbase - Don't leave undocumented backdoors - Don't damage production If you do your best to comply with those principles, then you can make a strong argument to a judge/jury that your behavior was without malice, which will notably improve your chances of survival if someone decides the usual detente isn't palatable.
- kingcharles 5y ago
  I used to do this white hat hacking back in the day: modify a page on the web server, send a link to the admin with the exploit walkthrough. It's a dangerous game to play now, though. You're basically betting the company you tested your PoC on would rather avoid the negative PR of filing charges against you, vs. a bunch of non-technical suits who just want to see you do 150 years in Sing Sing.
voakbasda 5y ago
Yup, this was totally criminal in most jurisdictions. I don’t care if the person intended to help; this kind of vigilante hacking deserves to land you in prison. You want a bounty? Talk to me before you break into my systems. Because once you do that without my permission, you have proven yourself completely unworthy of being trusted. Why should I believe that you have not installed a rootkit or other tech that you did not subsequently disclose? You will need to be treated the same as any other criminal. If my insurance gets involved, that also probably means directly assisting with an attempt at criminal prosecution. So, yeah, brilliant strategy. /s
- voakbasda 5y ago
  Not sure why my comment got downvoted, but it very much feels like HN is defending this kind of behavior. This is why we can’t have nice things.
  - rectang 5y ago
    You can't have nice things because you aggressively criminalized the white hats, thus were never warned by them before a black hat took your nice things away. > Why should I believe that you have not installed a rootkit or other tech that you did not subsequently disclose? Because doing that and also disclosing your identity would be incredibly stupid?
    - ajmurmann 5y ago
      > You can't have nice things because you aggressively criminalized the white hats voakbasda even proposed giving a bounty. Is defacing a website and spearfishing the users (as is claimed higher up in the thread) needed for white hats to do their thing? I'm surprised that we aren't all in agreement that this isn't at least grey hat behavior.
      - rectang 5y ago
        It's unclear to me where the line is being drawn and a zero-tolerance policy applied with maximum criminal penalties pursued. The whole world sucks: the companies who are slovenly with our data, the criminals who exploit that data when it is inevitably leaked, the grey hat hackers who "joyride to prove they found your keys" to use the memorable metaphor from elsethread, the circumstances which make probing for vulnerabilities incredibly risky because one misstep gets you a prison sentence. the resulting feast of vulnerabilities ripe for criminal exploitation....
ta3927590 5y ago
Historically, definitely. Currently? Fairly common. However, what's both historically and currently uncommon is having the sense to not do so while also identifying yourself. For the h4x0r cred, or whatever. Which is of course childishly idiotic, but makes my job a whole lot easier. In my experience, if you're not under any such contract and even if you are going to report such a compromise in complete good faith and have done no damage, you are far better off doing so as anonymously as possible. Nobody likes to be embarrassed, and it's a lot simpler for a corporation with a stock price and public image to think about to pin the whole situation on those damn hackers than own up to even the slightest degree of incompetence. Typing at work in sort of a hurry so, please forgive grammatical issues.
- ta3927590 5y ago

aaronwp 5y ago

Yes, if PII is involved it's common to run an audit like this. In addition to the access keys on the server image, Sega also accidentally published a database export containing PII. In order to write a comprehensive disclosure I have to investigate thoroughly. And yeah, there's no branding or information on HackerOne. Even if this had been in scope, I would have thought twice about submitting anything. Our publishing standards match HackerOne ethical disclosure standards.

tentacleuno 5y ago
> Even if this had been in scope, I would have thought twice about submitting anything. Sorry, I don't understand. Why would you be hesitant to responsibly disclose it to HackerOne?
- phnofive 5y ago
  They didn't know about it beforehand, but even if you visit the page, it says that SEGA Sammy hasn't claimed it, so it appears unofficial.
phnofive 5y ago
Did Sega agree to this public disclosure? Referring to the HackerOne standards, it appears your team violated a couple: > Respect privacy. Make a good faith effort not to access or destroy another user's data. > Do no harm. Act for the common good through the prompt reporting of all found vulnerabilities. Never willfully exploit others without their permission.
- wwtrv 5y ago
  Public disclosing it seems to clearly fall under the ‘ Act for the common good through the prompt’ since SEGA’s user are the real victims in this situation and have the right to known that SEGA us incapable of keeping their data safe.
  - batch12 5y ago
    This sounds similar to justification used by ransomware groups.
    - rectang 5y ago
      Only under the most carelessly superficial analysis. Is there any limit to the vast, systemic negligence and enabled criminality which can be excused away into nothingness because the circumstances under which they were made public were problematic? This isn't a criminal prosecution of the company who was irresponsible with user data. If the people who exposed the negligence screwed up, that doesn't mean we have to act as though that the negligence ever happened. Demonizing the messenger while remaining silent about the message is a choice.
      - batch12 5y ago
        Mostly agree. It is unfortunate that the methods used by the messenger add distractions to the situation. The point I am trying to make is the ends don't absolve the hacker from consequences. Ransomware operators often blame their victims for poor security and frame their actions as security-as-a-service.
        rectang 5y ago
        > The point I am trying to make is the ends don't absolve the hacker from consequences. I agree on this point. I see it as analogous to holding your allies to a standard that your adversaries are unwilling to uphold. In this case I categorize both black hats and toxic data hoarding companies (including their techie apologist employees) as "adversaries" (though I don't assert you agree with my assessment). > Ransomware operators often blame their victims for poor security and frame their actions as security-as-a-service. Despicable victim blaming by the very party doing the victimizing. I understand why advertising a VPN service can be seen as analogous, even if the scale of profiteering is not comparable. The argument against toxic data hoarding is easier to make when untainted by exploitative profit motive.

throwawaygh 5y ago

> Is it common, now or historically Historically: yes. Now: no. > possibly criminal Sans some sort of formal agreement (which platforms like HackerOne might facilitate), it's definitely criminal. (IMO at least not unethical, to be clear.) Again, sans some sort of contract either one-off or platform based. If SEGA wanted a prosecution, they would almost certainly be able to convince a prosecutor to press charges. The prosecutor would certainly get a guilty verdict. (Or, much more likely, a guilty plea with a bit of prison time and stiff probation.) This still happens from time to time in much more ambiguous situations. E.g., https://www.nytimes.com/2021/10/15/us/missouri-st-louis-post-teachers-hack.html https://www.nytimes.com/2021/10/15/us/missouri-st-louis-post... Fortunately, there's a bit of a gentleman's detente among reasonable white hats and reasonable companies. But if you venture much outside of the small set of companies who rely on and have technologists in senior leadership, the story changes fast.

floatingatoll 5y ago
That detente's boundaries may be somewhat vague and impossible to guarantee, but you can broad-brush paint yourself into a safer box with these four principles: - Don't make humiliating changes to their content - Don't mess with their userbase - Don't leave undocumented backdoors - Don't damage production If you do your best to comply with those principles, then you can make a strong argument to a judge/jury that your behavior was without malice, which will notably improve your chances of survival if someone decides the usual detente isn't palatable.
kingcharles 5y ago
I used to do this white hat hacking back in the day: modify a page on the web server, send a link to the admin with the exploit walkthrough. It's a dangerous game to play now, though. You're basically betting the company you tested your PoC on would rather avoid the negative PR of filing charges against you, vs. a bunch of non-technical suits who just want to see you do 150 years in Sing Sing.

voakbasda 5y ago

Yup, this was totally criminal in most jurisdictions. I don’t care if the person intended to help; this kind of vigilante hacking deserves to land you in prison. You want a bounty? Talk to me before you break into my systems. Because once you do that without my permission, you have proven yourself completely unworthy of being trusted. Why should I believe that you have not installed a rootkit or other tech that you did not subsequently disclose? You will need to be treated the same as any other criminal. If my insurance gets involved, that also probably means directly assisting with an attempt at criminal prosecution. So, yeah, brilliant strategy. /s

voakbasda 5y ago
Not sure why my comment got downvoted, but it very much feels like HN is defending this kind of behavior. This is why we can’t have nice things.
- rectang 5y ago
  You can't have nice things because you aggressively criminalized the white hats, thus were never warned by them before a black hat took your nice things away. > Why should I believe that you have not installed a rootkit or other tech that you did not subsequently disclose? Because doing that and also disclosing your identity would be incredibly stupid?
  - ajmurmann 5y ago
    > You can't have nice things because you aggressively criminalized the white hats voakbasda even proposed giving a bounty. Is defacing a website and spearfishing the users (as is claimed higher up in the thread) needed for white hats to do their thing? I'm surprised that we aren't all in agreement that this isn't at least grey hat behavior.
    - rectang 5y ago
      It's unclear to me where the line is being drawn and a zero-tolerance policy applied with maximum criminal penalties pursued. The whole world sucks: the companies who are slovenly with our data, the criminals who exploit that data when it is inevitably leaked, the grey hat hackers who "joyride to prove they found your keys" to use the memorable metaphor from elsethread, the circumstances which make probing for vulnerabilities incredibly risky because one misstep gets you a prison sentence. the resulting feast of vulnerabilities ripe for criminal exploitation....

ta3927590 5y ago

Historically, definitely. Currently? Fairly common. However, what's both historically and currently uncommon is having the sense to not do so while also identifying yourself. For the h4x0r cred, or whatever. Which is of course childishly idiotic, but makes my job a whole lot easier. In my experience, if you're not under any such contract and even if you are going to report such a compromise in complete good faith and have done no damage, you are far better off doing so as anonymously as possible. Nobody likes to be embarrassed, and it's a lot simpler for a corporation with a stock price and public image to think about to pin the whole situation on those damn hackers than own up to even the slightest degree of incompetence. Typing at work in sort of a hurry so, please forgive grammatical issues.

ta3927590 5y ago