Sega Europe suffers major security breach • Hacker News Board

Re: Sega Europe suffers major security breach

#31

Post by foldr » Thu, Dec 30, 2021, 7:03 PM UTC

ff7c11 wrote: post #19

By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punis…

>Sega deserved to be punished

I don't understand this way of thinking. They made a serious security oversight, but that doesn't mean that they deserve to have their website defaced.

Re: Sega Europe suffers major security breach

#32

Post by vmception » Thu, Dec 30, 2021, 7:04 PM UTC

aaronwp wrote: post #2

Sega Europe left AWS S3 creds laying around in a server image on downloads.sega.com. I was able to use them to enumerate a bunch of storage, dig out more keys, and mock up a spear phishing attack against the Football Manager forums. All the keys and services are secure and the breach is closed.

Should have just left it at that and collected the bug bounty, defacing for a proof of concept and telling everyone pretty much makes you ineligible in any white hat program. Can I get dibs on your flat while you're in the... camp?

Re: Sega Europe suffers major security breach

#33

Post by whoknew1122 » Thu, Dec 30, 2021, 7:05 PM UTC

vlunkr wrote: post #28

whoknew1122 wrote: post #26

Earlier quoted context omitted.

They clearly said they modified careers.sega.co.uk and posted a screenshot of the careers site displaying vpnoverview's logo ( https://vpnoverview.com/wp-content/uploads/screenshot-about-... )

They say it "briefly" showed that logo. Who knows how long that is.

The question was whether a site was defaced, not how long it was defaced for.

Re: Sega Europe suffers major security breach

#34

Post by walrus01 » Thu, Dec 30, 2021, 7:05 PM UTC

rosndo wrote: post #20

It’s hilarious to see people generating content like this to push their VPN affiliate marketing schemes.

If there's one thing that I can absolutely rely upon, it's for VPN service providers to use any and every form of shady grey marketing sales technique that exists.

Re: Sega Europe suffers major security breach

#35

Post by jsploit » Thu, Dec 30, 2021, 7:05 PM UTC

aaronwp wrote: post #2

Sega Europe left AWS S3 creds laying around in a server image on downloads.sega.com. I was able to use them to enumerate a bunch of storage, dig out more keys, and mock up a spear phishing attack against the Football Manager forums. All the keys and services are secure and the breach is closed.

> I was able to use them to enumerate a bunch of storage, dig out more keys

That's unethical and likely criminal without explicit testing authorization (which it appears you didn't have).

I wonder if there are any examples of "researchers" being sued/prosecuted for stunts like this.

Re: Sega Europe suffers major security breach

#36

Post by politelemon » Thu, Dec 30, 2021, 7:13 PM UTC

If I'm understanding correctly, a whole bunch of credentials, like IAMs, DB passwords, Steam keys, and MailChimp keys were lying around in S3 buckets.

But I don't understand the use case, what would be the purpose of uploading those details into S3 buckets? Or I suppose I'm trying to reverse engineer the situation where the dev/ops team decided to do this.

Re: Sega Europe suffers major security breach

#37

Post by whoknew1122 » Thu, Dec 30, 2021, 7:14 PM UTC

isbvhodnvemrwvn wrote: post #9

If you're running on AWS, why would you even have long-lived credentials in your images?

There's a few reasons, none of them good.

Likely the answer is gross incompetence.

If I were to give them the benefit of the doubt and provide the most defensible reason to have an image that contains AWS credentials, you could theoretically use long-term (i.e. user) AWS credentials on an on-premises VM and then export the server image to AWS. When you rehost the server in EC2, you would switch to an instance role per best practices. And then you forget to delete the image stored in S3.

Still doesn't explain why the S3 bucket is publicly available. But that's one reason a server image with long-term credentials could end up stored in an S3 bucket.

Unlikely that the image was an EBS snapshot or AMI. While those are technically housed in S3, you can't access them from the S3 console. And they didn't brag about accessing the EC2 console.

Re: Sega Europe suffers major security breach

#38

Post by beckman466 » Thu, Dec 30, 2021, 7:21 PM UTC

ff7c11 wrote: post #19

By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punis…

No post body was provided.

Re: Sega Europe suffers major security breach

#39

Post by drjasonharrison » Thu, Dec 30, 2021, 7:23 PM UTC

politelemon wrote: post #36

If I'm understanding correctly, a whole bunch of credentials, like IAMs, DB passwords, Steam keys, and MailChimp keys were lying around in S3 buckets. But I don't understand the use case, what would be the purpose of uploading those details into S3 buckets? Or I suppose I'm trying to reverse engineer the situation where the dev/ops team decided to do this.

Rather than use a password manager, or credential store, or some other secure way to keep these credentials safe while providing access to internal developers for development purposes, they put them on S3.

Here's an example I have seen: - env file is needed for development to run a service on development machine and to access the staging deployment - the credentials in the env file aren't per-developer because that requires work to setup accounts for every developer with the staging hosting service - so make a copy of the credentials, put them in an env file on the NAS - NAS isn't available from home or from other network locations - so make a copy of the env file in the cloud

If the S3 bucket hadn't been public they probably would have been fine.

Re: Sega Europe suffers major security breach

#40

Post by dragontamer » Thu, Dec 30, 2021, 7:23 PM UTC

ff7c11 wrote: post #19

By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punis…

> Sega deserved to be punished

The store owner was gone on vacation, and thus the side of his store was riddled with graffiti. He deserved to get graffiti because he didn't take basic security precautions.