Sega Europe suffers major security breach • Hacker News Board

Re: Sega Europe suffers major security breach

#51

Post by charlesju » Thu, Dec 30, 2021, 7:48 PM UTC

EGreg wrote: post #47

dragontamer wrote: post #40

Earlier quoted context omitted.

> Sega deserved to be punished The store owner was gone on vacation, and thus the side of his store was riddled with graffiti. He deserved to get graffiti because he didn't take basic security precautions.

So the store owner can just leave all his customers’ credit card information lying around and ignore PCI compliance etc. because anyone who would possibly use it for nefarious purposes is a criminal? How would you prevent such negligence

Two wrongs don't make a right

Re: Sega Europe suffers major security breach

#52

Post by 123pie123 » Thu, Dec 30, 2021, 7:51 PM UTC

dragontamer wrote: post #40

ff7c11 wrote: post #19

By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punis…

> Sega deserved to be punished The store owner was gone on vacation, and thus the side of his store was riddled with graffiti. He deserved to get graffiti because he didn't take basic security precautions.

they don't deserve to get graffiti, but it is expected

they should be punished by legal means (legal proceedings or lawsuits) and by reputational damage

Re: Sega Europe suffers major security breach

#53

Post by tentacleuno » Thu, Dec 30, 2021, 7:55 PM UTC

aaronwp wrote: post #8

phnofive wrote: post #6

Earlier quoted context omitted.

Is it common, now or historically, to follow up a notification of compromise with self-directed PoC and privilege escalation exercises on the resources of a company with which you're not under contract? My naïve take is that this was a series of well-intentioned but possibly criminal actions used to illustrate a lesson we could all be reminded of from time to time. Also, the HackerOne page doesn't appear to be claime…

Yes, if PII is involved it's common to run an audit like this. In addition to the access keys on the server image, Sega also accidentally published a database export containing PII. In order to write a comprehensive disclosure I have to investigate thoroughly. And yeah, there's no branding or information on HackerOne. Even if this had been in scope, I would have thought twice about submitting anything. Our publishing…

> Even if this had been in scope, I would have thought twice about submitting anything.

Sorry, I don't understand. Why would you be hesitant to responsibly disclose it to HackerOne?

Re: Sega Europe suffers major security breach

#54

Post by dragontamer » Thu, Dec 30, 2021, 7:56 PM UTC

EGreg wrote: post #47

dragontamer wrote: post #40

Earlier quoted context omitted.

> Sega deserved to be punished The store owner was gone on vacation, and thus the side of his store was riddled with graffiti. He deserved to get graffiti because he didn't take basic security precautions.

So the store owner can just leave all his customers’ credit card information lying around and ignore PCI compliance etc. because anyone who would possibly use it for nefarious purposes is a criminal? How would you prevent such negligence

> How would you prevent such negligence

The ones who are damaged by the negligence sues for negligence.

Similarly: those people who act recklessly can get sued for more, or even criminally prosecuted. Finally, someone who acts out with malicious intent can be sued / criminally charged with the highest crimes.

-----------

So in this "Sega" case: Sega can sue their security for the negligence.

Then, the hackers can be sued for something between recklessness and malicious intent.

Yeah, the law is flexible. "Justice" as a concept in the Western world revolves around both actions + intent. (With intent / state of mind in roughly 3 states: negligence, recklessness, and malice in that order).

Its a flexible system, albeit sometimes imperfect... but just applying it in a textbook manner to this case results in acceptable results IMO.

Re: Sega Europe suffers major security breach

#55

Post by rectang » Thu, Dec 30, 2021, 7:57 PM UTC

ajmurmann wrote: post #46

rectang wrote: post #27

Earlier quoted context omitted.

You can't have nice things because you aggressively criminalized the white hats, thus were never warned by them before a black hat took your nice things away. > Why should I believe that you have not installed a rootkit or other tech that you did not subsequently disclose? Because doing that and also disclosing your identity would be incredibly stupid?

> You can't have nice things because you aggressively criminalized the white hats voakbasda even proposed giving a bounty. Is defacing a website and spearfishing the users (as is claimed higher up in the thread) needed for white hats to do their thing? I'm surprised that we aren't all in agreement that this isn't at least grey hat behavior.

It's unclear to me where the line is being drawn and a zero-tolerance policy applied with maximum criminal penalties pursued.

The whole world sucks: the companies who are slovenly with our data, the criminals who exploit that data when it is inevitably leaked, the grey hat hackers who "joyride to prove they found your keys" to use the memorable metaphor from elsethread, the circumstances which make probing for vulnerabilities incredibly risky because one misstep gets you a prison sentence. the resulting feast of vulnerabilities ripe for criminal exploitation....

Re: Sega Europe suffers major security breach

#56

Post by walrus01 » Thu, Dec 30, 2021, 8:03 PM UTC

tomrod wrote: post #50

walrus01 wrote: post #29

Earlier quoted context omitted.

it seems like there's a couple of hundred consumer-facing VPN service providers, all with slick looking marketing websites to sell you a $5/mo service. lots of them are nothing more than 1 or 2 people and some rented 1U servers or dedicated servers somewhere on whatever ISP that can find with cheap IP transit / DIA rates. maybe a part time website design/graphic arts person they found via fiverr to make things look c…

Who are reputable in the space?

mullvad, the company mozilla recently partnered with.

not much else...

I am biased because I do my own VPN so all of them seem shady to me.

Re: Sega Europe suffers major security breach

#57

Post by ta3927590 » Thu, Dec 30, 2021, 8:10 PM UTC

ta3927590 wrote: post #25

phnofive wrote: post #6

Earlier quoted context omitted.

Is it common, now or historically, to follow up a notification of compromise with self-directed PoC and privilege escalation exercises on the resources of a company with which you're not under contract? My naïve take is that this was a series of well-intentioned but possibly criminal actions used to illustrate a lesson we could all be reminded of from time to time. Also, the HackerOne page doesn't appear to be claime…

Historically, definitely. Currently? Fairly common. However, what's both historically and currently uncommon is having the sense to not do so while also identifying yourself. For the h4x0r cred, or whatever. Which is of course childishly idiotic, but makes my job a whole lot easier. In my experience, if you're not under any such contract and even if you are going to report such a compromise in complete good faith and…

No post body was provided.

Re: Sega Europe suffers major security breach

#58

Post by Fnoord » Thu, Dec 30, 2021, 8:13 PM UTC

dragontamer wrote: post #40

ff7c11 wrote: post #19

By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punis…

> Sega deserved to be punished The store owner was gone on vacation, and thus the side of his store was riddled with graffiti. He deserved to get graffiti because he didn't take basic security precautions.

You don't need to break security to spray the side of a store. You do need to break security to deface a website.

Analogies are analogies, they're unnecessary in this case (nowadays). Because we got law to punish people who deface a website, and the law stands on its own.

Its akin to people who call 'copyright infringement' 'theft'. Its not the same, its a different mechanic, damages are different, and... different laws apply. That doesn't mean one's right or wrong or anything like it; like I said: the laws stand on their own, respectively.

Re: Sega Europe suffers major security breach

#59

Post by voakbasda » Thu, Dec 30, 2021, 8:17 PM UTC

rectang wrote: post #55

ajmurmann wrote: post #46

Earlier quoted context omitted.

> You can't have nice things because you aggressively criminalized the white hats voakbasda even proposed giving a bounty. Is defacing a website and spearfishing the users (as is claimed higher up in the thread) needed for white hats to do their thing? I'm surprised that we aren't all in agreement that this isn't at least grey hat behavior.

It's unclear to me where the line is being drawn and a zero-tolerance policy applied with maximum criminal penalties pursued. The whole world sucks: the companies who are slovenly with our data, the criminals who exploit that data when it is inevitably leaked, the grey hat hackers who "joyride to prove they found your keys" to use the memorable metaphor from elsethread, the circumstances which make probing for vulner…

Do you understand that, from the perspective of the person suffering an attack, there is absolutely zero difference between a good guy that breaks in without a contract, permission, or other sort approval and an actual bad guy? The act of committing a crime actively destroys trust.

Come to me with a list of potential vulnerabilities that I can detect and investigate with an open source scanner, and we can talk. Come to me after you've already broken in, and you will never be grated the trust required to work on security systems.

I think this whole scenario effectively is perjury. Once someone has been proven to lie, everything associated with that lie needs to be vetted (or simply thrown out), because you have demonstrated that this person cannot be trusted to tell the truth. Does anyone here think that perjury is moral or ethical? Is the scenario presented here really that different?

Re: Sega Europe suffers major security breach

#60

Post by phnofive » Thu, Dec 30, 2021, 8:21 PM UTC

tentacleuno wrote: post #53

aaronwp wrote: post #8

Earlier quoted context omitted.

Yes, if PII is involved it's common to run an audit like this. In addition to the access keys on the server image, Sega also accidentally published a database export containing PII. In order to write a comprehensive disclosure I have to investigate thoroughly. And yeah, there's no branding or information on HackerOne. Even if this had been in scope, I would have thought twice about submitting anything. Our publishing…

> Even if this had been in scope, I would have thought twice about submitting anything. Sorry, I don't understand. Why would you be hesitant to responsibly disclose it to HackerOne?

They didn't know about it beforehand, but even if you visit the page, it says that SEGA Sammy hasn't claimed it, so it appears unofficial.