Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sega Europe suffers major security breach

vpnoverview.com

Post reply on HN
Print view View original

61–70 of 108 posts

Re: Sega Europe suffers major security breach

#61

Post by phnofive »

aaronwp wrote: post #8
phnofive wrote: post #6

Earlier quoted context omitted.

Is it common, now or historically, to follow up a notification of compromise with self-directed PoC and privilege escalation exercises on the resources of a company with which you're not under contract? My naïve take is that this was a series of well-intentioned but possibly criminal actions used to illustrate a lesson we could all be reminded of from time to time. Also, the HackerOne page doesn't appear to be claime…

Yes, if PII is involved it's common to run an audit like this. In addition to the access keys on the server image, Sega also accidentally published a database export containing PII. In order to write a comprehensive disclosure I have to investigate thoroughly. And yeah, there's no branding or information on HackerOne. Even if this had been in scope, I would have thought twice about submitting anything. Our publishing…

Did Sega agree to this public disclosure?

Referring to the HackerOne standards, it appears your team violated a couple:

> Respect privacy. Make a good faith effort not to access or destroy another user's data.

> Do no harm. Act for the common good through the prompt reporting of all found vulnerabilities. Never willfully exploit others without their permission.

Re: Sega Europe suffers major security breach

#62

Post by rectang »

voakbasda wrote: post #59
rectang wrote: post #55

Earlier quoted context omitted.

It's unclear to me where the line is being drawn and a zero-tolerance policy applied with maximum criminal penalties pursued. The whole world sucks: the companies who are slovenly with our data, the criminals who exploit that data when it is inevitably leaked, the grey hat hackers who "joyride to prove they found your keys" to use the memorable metaphor from elsethread, the circumstances which make probing for vulner…

Do you understand that, from the perspective of the person suffering an attack, there is absolutely zero difference between a good guy that breaks in without a contract, permission, or other sort approval and an actual bad guy? The act of committing a crime actively destroys trust. Come to me with a list of potential vulnerabilities that I can detect and investigate with an open source scanner, and we can talk. Come…

The "person suffering the attack" is not the only party who suffers from an attack — the individuals whose information gets leaked also suffer when a company hoards toxic data and it inevitably spills.

From the perspective of those individuals, there is a dramatic difference between black hats who exploit their data and grey hats who humiliate the toxic data hoarders.

Re: Sega Europe suffers major security breach

#63

Post by dc-programmer »

watermelon0 wrote: post #23
0xbadcafebee wrote: post #17

A good example of how the usability of your product directly affects security. AWS has multiple forms of credentials. IAM Users (static keys tied to a specific user identity) are one form. But you can also authenticate via SAML or OIDC. If you use SAML/OIDC, you can enforce temporary IAM credentials, audit who authenticated, expire credentials, enforce password rules & MFA, etc. Because IAM Users are the easiest thin…

When allowing 3rd parties to access your AWS resources, IAM keys are in most cases the only way to achieve this. For example, most CI/CD systems don't support OIDC yet, so you have to add IAM keys to them. GitHub Actions is a notable exception here.

If the third party has their own IAM users, you can create a cross-account trust relationship where you allow their IAM entity to assume a (scoped-down) role in your account. Then they are able to retrieve temporary credentials to assume this role.

Re: Sega Europe suffers major security breach

#64

Post by ricardobayes »

tomrod wrote: post #50
walrus01 wrote: post #29

Earlier quoted context omitted.

it seems like there's a couple of hundred consumer-facing VPN service providers, all with slick looking marketing websites to sell you a $5/mo service. lots of them are nothing more than 1 or 2 people and some rented 1U servers or dedicated servers somewhere on whatever ISP that can find with cheap IP transit / DIA rates. maybe a part time website design/graphic arts person they found via fiverr to make things look c…

Who are reputable in the space?

protonmail

Re: Sega Europe suffers major security breach

#66

Post by burnished »

ff7c11 wrote: post #19

By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punis…

Strong disagree (not about the law claims, I'll leave that to the law-knowers), but the moral implications of 'crossing a line'. It reads like they revealed security vulnerabilities that had the possibility to harm others. I think they can be allowed some leeway in their methods.

Re: Sega Europe suffers major security breach

#67

Post by Enginerrrd »

walrus01 wrote: post #56
tomrod wrote: post #50

Earlier quoted context omitted.

Who are reputable in the space?

mullvad, the company mozilla recently partnered with. not much else... I am biased because I do my own VPN so all of them seem shady to me.

Tangential to the thread, but I've never understood what people mean when they say this.

Do you run all your personal traffic through a VPS or something? That's not really offering the same thing as most VPN's. It hides your traffic from your ISP so they can't sell your data and snoop on you, but doesn't accomplish some of the anonymizing that an actual multi-user VPN can provide by adding additional traffic under the same IP.

So, what do YOU mean when you say you "do your own VPN"?

Re: Sega Europe suffers major security breach

#68

Post by __turbobrew__ »

walrus01 wrote: post #56
tomrod wrote: post #50

Earlier quoted context omitted.

Who are reputable in the space?

mullvad, the company mozilla recently partnered with. not much else... I am biased because I do my own VPN so all of them seem shady to me.

Seconded mullvad. The only vpn provider which accepts cash by mail as a payment method.

No email needed for sign up either.

Re: Sega Europe suffers major security breach

#69

Post by wwtrv »

dragontamer wrote: post #40
ff7c11 wrote: post #19

By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punis…

> Sega deserved to be punished The store owner was gone on vacation, and thus the side of his store was riddled with graffiti. He deserved to get graffiti because he didn't take basic security precautions.

To me this situation seems more like a store owner forgetting to lock the door the somebody noticed, came inside put up a sign on the front window saying that the store owner is too stupid to lock his own door and then calling the owner to tell him about this.
Post reply on HN