Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Sega Europe suffers major security breach

vpnoverview.com

Post reply on HN
Print view View original

81–90 of 108 posts

Re: Sega Europe suffers major security breach

#81

Post by ff7c11 »

ljm wrote: post #45
politelemon wrote: post #36

If I'm understanding correctly, a whole bunch of credentials, like IAMs, DB passwords, Steam keys, and MailChimp keys were lying around in S3 buckets. But I don't understand the use case, what would be the purpose of uploading those details into S3 buckets? Or I suppose I'm trying to reverse engineer the situation where the dev/ops team decided to do this.

One can only speculate but I can't imagine how many companies will avoid investing in security here, because they think that the secrets in their git repos and S3 buckets are perfectly safe, and they allow some people to skip 2FA because it's too inconvenient for them, and some people have root access on AWS because it's easier, etc. Maybe even giving the job to people who don't have much experience in the field and…

Also, if you don't have a public access block in place, a private bucket can contain public files! Even if you can't list the files in the bucket, there are tools which try to guess common file names from guessed bucket names e.g. sega-secret-sauce.s3.amazonaws.com/.env - if someone uploaded a file there without setting the ACL correctly there could be an unprotected file in the private bucket.

Re: Sega Europe suffers major security breach

#82

Post by rectang »

voakbasda wrote: post #78
rectang wrote: post #62

Earlier quoted context omitted.

The "person suffering the attack" is not the only party who suffers from an attack — the individuals whose information gets leaked also suffer when a company hoards toxic data and it inevitably spills. From the perspective of those individuals, there is a dramatic difference between black hats who exploit their data and grey hats who humiliate the toxic data hoarders.

Do you think those individuals will see the difference? Also, I would argue there is no gray. A white that breaks the law cannot be trusted, because they become indistinguishable from a black hat that is pretending to be a white hat. This all comes down a matter of trust, and breaking the law does not build trust in anyone except other criminals. If anything, it erodes trust by demonstrating the willingness to skirt…

> Do you think those individuals will see the difference?

No more or less than an individual whose home was not robbed because a crime was prevented unbeknownst to them.

However, I believe that the toxic data hoarding companies collectively don't see any difference, and so they don't care if individuals suffer. The suffering of individuals when data is leaked is an externality, and it is only when forced to pay for that externality that companies would start to care.

In this regard, the black hats and the toxic data hoarders both contribute towards undermining the common good. Companies don't care if money disappears mysteriously from the bank accounts of individuals who happen to be their customers — companies just don't want to be embarrassed, as it isn't their money being stolen.

But the grey hats disrupt this state of affairs. They are truly antagonistic to the toxic data hoarders, because they humiliate them, rather than merely use them to steal from somebody else.

This status quo of companies operating unsafely, creating massive but dispersed and plausibly deniable harm, is perfectly legal. But should the public trust these companies? Should the public trust individuals who work hard at these companies to build toxic data stockpiles and cover up intrusions, rather than those who expose the harms these practices bring? Who are the "good guys"?

Re: Sega Europe suffers major security breach

#83

Post by batch12 »

thr0wawayf00 wrote: post #22
batch12 wrote: post #15

So the breach referenced was a breach by the researchers, not a malicious third party (that we know of)? I would have called it exposure or a vulnerability since breach has a specific meaning that I am not sure this fits. Maybe I am being pedantic.

"Breach" is a legal term, and although IANAL, it seems semantically correct here. When anyone outside of your organization gains access to sensitive information in your systems, regardless of their intent, that is a breach and these guys accomplished that. PCI and all of those other security protocols and programs don't draw the line at white-hat access vs black-hat access.

I agree mostly. I don't think an unsanctioned assessment that goes this deep is pure white hat. It seems firmly gray to me.

> PCI and all of those other security protocols and programs don't draw the line at white-hat access vs black-hat access.

PCI mandates penetration tests. A white hat finding as a pentest isn't reportable as a breach. This one may be unless some gymnastics are used to call it an authorized test.

Re: Sega Europe suffers major security breach

#84

Post by batch12 »

throwoutway wrote: post #80
burnished wrote: post #66

Earlier quoted context omitted.

Strong disagree (not about the law claims, I'll leave that to the law-knowers), but the moral implications of 'crossing a line'. It reads like they revealed security vulnerabilities that had the possibility to harm others. I think they can be allowed some leeway in their methods.

Nope. That can come after responsible disclosure. Did they try the responsible path first? Looks like they notified and then kept going for another 10 days

> kept going for another 10 days

This is the problem I have. They kept going without permission. Leaving your key in the door doesn't give someone the moral authority to go through your house and look for other issues.

Re: Sega Europe suffers major security breach

#85

Post by batch12 »

rectang wrote: post #27
voakbasda wrote: post #18

Earlier quoted context omitted.

Not sure why my comment got downvoted, but it very much feels like HN is defending this kind of behavior. This is why we can’t have nice things.

You can't have nice things because you aggressively criminalized the white hats, thus were never warned by them before a black hat took your nice things away. > Why should I believe that you have not installed a rootkit or other tech that you did not subsequently disclose? Because doing that and also disclosing your identity would be incredibly stupid?

>You can't have nice things because you aggressively criminalized the white hats

This isn't how a white hat should behave. At the first issue, they should have stopped, reported, and waited. At the very least, a responsible disclosure, followed by a reasonable time, then maybe public disclosure-- or just move on. Continuing to dig and steal information because someone didn't reply is unacceptable.

Re: Sega Europe suffers major security breach

#86

Post by batch12 »

wwtrv wrote: post #73
phnofive wrote: post #61

Earlier quoted context omitted.

Did Sega agree to this public disclosure? Referring to the HackerOne standards, it appears your team violated a couple: > Respect privacy. Make a good faith effort not to access or destroy another user's data. > Do no harm. Act for the common good through the prompt reporting of all found vulnerabilities. Never willfully exploit others without their permission.

Public disclosing it seems to clearly fall under the ‘ Act for the common good through the prompt’ since SEGA’s user are the real victims in this situation and have the right to known that SEGA us incapable of keeping their data safe.

This sounds similar to justification used by ransomware groups.

Re: Sega Europe suffers major security breach

#87

Post by rectang »

batch12 wrote: post #85
rectang wrote: post #27

Earlier quoted context omitted.

You can't have nice things because you aggressively criminalized the white hats, thus were never warned by them before a black hat took your nice things away. > Why should I believe that you have not installed a rootkit or other tech that you did not subsequently disclose? Because doing that and also disclosing your identity would be incredibly stupid?

>You can't have nice things because you aggressively criminalized the white hats This isn't how a white hat should behave. At the first issue, they should have stopped, reported, and waited. At the very least, a responsible disclosure, followed by a reasonable time, then maybe public disclosure-- or just move on. Continuing to dig and steal information because someone didn't reply is unacceptable.

I cede the point. It's incredibly frustrating because the harm done is minuscule in comparison to the unsafe business practices exposed. The toxic data hoarder will skate, the messenger will be shot, and the public will continue to be victimized by black hats exploiting toxic data stockpiles.

Re: Sega Europe suffers major security breach

#88

Post by twistedpair »

watermelon0 wrote: post #23
0xbadcafebee wrote: post #17

A good example of how the usability of your product directly affects security. AWS has multiple forms of credentials. IAM Users (static keys tied to a specific user identity) are one form. But you can also authenticate via SAML or OIDC. If you use SAML/OIDC, you can enforce temporary IAM credentials, audit who authenticated, expire credentials, enforce password rules & MFA, etc. Because IAM Users are the easiest thin…

When allowing 3rd parties to access your AWS resources, IAM keys are in most cases the only way to achieve this. For example, most CI/CD systems don't support OIDC yet, so you have to add IAM keys to them. GitHub Actions is a notable exception here.

I'd push back on that norm.

I listened to a vendor pitch for a product that would need access to my cloud assets. They wanted me to export auth keys as strings and hand them over, with super high access rights. I laughed and pointed out OIDC, Workload Identity Federation, cross account user identities... etc as more secure methods that didn't require handing over any secrets.

Multi-billion dollar vendor; their engineer just gave me a blank stare as if the notion was completely novel. It's not. None of the products/integrations I build require a customer to share their cloud creds to work w/ their cloud assets.

2020 is calling...

Re: Sega Europe suffers major security breach

#89

Post by matheusmoreira »

dragontamer wrote: post #40
ff7c11 wrote: post #19

By temporarily defacing the Sega website and modifying files I think they have crossed the line. Enumerating what access they have, rooting through S3 and reporting it is OK, but by messing around like script kiddies they can no longer claim good faith. Publicising that you've illegally defaced the website is a little silly. Of course, Sega should not have got themselves so completely owned. Sega deserved to be punis…

> Sega deserved to be punished The store owner was gone on vacation, and thus the side of his store was riddled with graffiti. He deserved to get graffiti because he didn't take basic security precautions.

It's more like a store owner who left all his customer's names, addresses, credit cards, purchasing history and everything else just lying out there in the open. Public embarrassment is too light a punishment for the inevitable day when someone else comes and takes it. The real victims are all the people harmed by their negligence.

Re: Sega Europe suffers major security breach

#90

Post by rectang »

batch12 wrote: post #86
wwtrv wrote: post #73

Earlier quoted context omitted.

Public disclosing it seems to clearly fall under the ‘ Act for the common good through the prompt’ since SEGA’s user are the real victims in this situation and have the right to known that SEGA us incapable of keeping their data safe.

This sounds similar to justification used by ransomware groups.

Only under the most carelessly superficial analysis.

Is there any limit to the vast, systemic negligence and enabled criminality which can be excused away into nothingness because the circumstances under which they were made public were problematic?

This isn't a criminal prosecution of the company who was irresponsible with user data. If the people who exposed the negligence screwed up, that doesn't mean we have to act as though that the negligence ever happened.

Demonizing the messenger while remaining silent about the message is a choice.

Post reply on HN