Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Roblox cheat and one AI tool brought down Vercel's platform

webmatrices.com

Post reply on HN
Print view View original

111–120 of 186 posts

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#111

Post by hilariously »

lemagedurage wrote: post #76
dnnddidiej wrote: post #75

Earlier quoted context omitted.

Also if you want to keep a secret a secret forever, encrypted but saved data may be easily decrypted in the future. Most secrets though in reality are less useful in X years time.

Theoretically maybe, but there's no indication that a quantum-resistant algorithm can't encrypt something that's secure for the coming million+ years.

Sure there is, just use a one time pad and never repeat the message.

Oops - you said the opposite of what I read, my mistake.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#112

Post by otabdeveloper4 »

rcxdude wrote: post #56
otabdeveloper4 wrote: post #48

Earlier quoted context omitted.

There is -- you can expose a UNIX socket for serving credentials and allow access to it only from a whitelist of systemd services.

They would still exist in plaintext, just the permissions would make it a little harder to access.

No, UNIX sockets work over SSL too.

You can, theoretically, decompile the system memory dump and try to mine the credentials out of the credential server's heap, but that exploit is exponentially more difficult to do that a simple `cat /proc/1234/environ`.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#113

Post by otabdeveloper4 »

lemagedurage wrote: post #94
otabdeveloper4 wrote: post #48

Earlier quoted context omitted.

There is -- you can expose a UNIX socket for serving credentials and allow access to it only from a whitelist of systemd services.

That works on a single persistent box, but unfortunately, that means giving up on autoscaling, which is not so nice for cloud applications.

You can proxy the UNIX socket to a network server if you want to. You can even use SSL encryption at all times too.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#114

Post by otabdeveloper4 »

ErroneousBosh wrote: post #61
otabdeveloper4 wrote: post #46

Earlier quoted context omitted.

Env vars are not secure. Anything that has root access can see all env vars of all applications via /proc. (And modern Linux is unusable without root access, thanks to Docker and other fast-and-loose approaches.)

How often do you log in as root, or use sudo to become root, when you're working with Docker containers? Because I never do, unless I'm down in the depths of /var/lib/docker doing stuff I shouldn't.

That just means you outsourced the `sudo` invocations to some other person. (Which is even worse.)

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#115

Post by _pdp_ »

If I have to make a guess, it wasn't just any Google Workspace app but Gmail. The attacker gained broad access to the victim's inbox. They where then able to login into some internal systems using magic links or one-time codes.

It begs the question why there is no 2FA? And why did they had such a broad access to being with?

If this is not case, the only other option I can muster is perhaps API credentials but stored in google workspaces? It is possible but odd.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#116

Post by throwatdem12311 »

Lmaoooo this is why I never install anything but work stuff on my work machines. Always have everything separate. Even on my personal machines, I have separate non-sudoer user accounts for gaming because I’m often downloading random mods.

My son even asked me just the other day why I don’t have Roblox on the Mac….yeah stuff like this is why.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#117

Post by lmz »

otabdeveloper4 wrote: post #113
lemagedurage wrote: post #94

Earlier quoted context omitted.

That works on a single persistent box, but unfortunately, that means giving up on autoscaling, which is not so nice for cloud applications.

You can proxy the UNIX socket to a network server if you want to. You can even use SSL encryption at all times too.

Once it's networked you lose the "whitelist of systemd services" and it's then no different from any networked secret store.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#119

Post by r1ch »

morningsam wrote: post #118

What's the source of the claim that it was a Roblox cheat? Neither the report linked at the start of this article nor Context.ai's and Vercel's notices mention this.

The timeline is off too if the Trend Micro report is to be believed. It makes for a catchy headline, but a source is definitely warranted here.

Re: A Roblox cheat and one AI tool brought down Vercel's platform

#120

Post by Topfi »

baxtr wrote: post #87
Topfi wrote: post #84

Earlier quoted context omitted.

Endpoint Detection and Response? Heck, not giving the person Admin privileges would have sufficed to prevent this. Or better hiring preventing people who install Roblox cheats on work devices... There is no excuse and no fine line here. Even outside them boasting about SOC 2 Type II, this would be embarrassing for an SME not in the tech sector.

OP was talking about the security team. Not sure what you are proposing? Do you want to let any applicant be screened by the security team?

Just an addition to the prior comment: To be as generous as possible, I just pulled their audit report [0] and to answer your question, all I propose is that they stick to this (especially the part on minimum permissions, any extended permissions need to be reasonable and reasoned for, etc), which they did not. The fault lies threefold:

First of all with the team members as Context.ai, that either weren't experienced or did not care enough to know that the "all green" they got from Delve straight away couldn't have been accurate.

Secondly, with the people at Delve who, at least in this isolated case, seem to not have fulfilled their obligations and are suspected to have done so in a consistent, repeated and intentionally malicious manner.

Third, the people who, despite claiming to have done their due diligence, being experienced investors and professionals in the field whose own prior companies also had to undergo audits in the past, looked at Delve and were willing to overlook the misdeeds for financial gain.

[0] https://news.ycombinator.com/item?id=47848077

Post reply on HN