Latest in Gaming

Image credit: Roblox

'Roblox' worker sold user data access to a hacker

It was ostensibly meant to challenge the studio's security.
Jon Fingas, @jonfingas
May 4, 2020
179 Shares
Share
Tweet
Share

Sponsored Links

Roblox characters charging
Roblox

Hackers don’t necessarily need to break into networks to compromise game companies — sometimes, it’s just about coercing the right people. An anonymous attacker talking to Motherboard has revealed that they bribed a Roblox customer support representative to get access to the customer support panel for the online game platform. The intruder could see email addresses, change passwords, strip two-factor authentication and even ban users.

This was done solely to “prove a point,” the hacker claimed. As evidence, they provided photos showing details of a handful of players, including high-profile examples. However, this wasn’t a strictly virtuous act — the perpetrator changed passwords for two accounts, sold items and updated two-factor settings once it became clear an attempt to claim a bug bounty (for a non-existent flaw) wasn’t going to work.

Not surprisingly, the studio wasn’t pleased. A spokesperson said that it rushed to “address the issue” and alert affected customers. It also reported the culprit to the HackerOne bug bounty program for an investigation.

The incident did little damage, but underscores the growing risks of social engineering attacks (that is, preying on workers with access to key controls). This, SIM swapping and similar schemes frequently exploit lax verification processes and low-paid customer service reps to get access they wouldn’t otherwise have. Unless a company finds ways to discourage staff from taking bribes, you could easily see incidents like this in the future.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.
Comment
Comments
Share
179 Shares
Share
Tweet
Share

Popular on Engadget

Engadget's 2020 Back-to-School Guide

Engadget's 2020 Back-to-School Guide

View
Xiaomi unveils a ridiculous see-through TV

Xiaomi unveils a ridiculous see-through TV

View
‘Red Dead Online’ is so broken it’s hilarious

‘Red Dead Online’ is so broken it’s hilarious

View
The last Blockbuster is hosting an Airbnb sleepover in September

The last Blockbuster is hosting an Airbnb sleepover in September

View
Will QLC SSDs make hard drives extinct?

Will QLC SSDs make hard drives extinct?

View

From around the web

Page 1Page 1ear iconeye iconFill 23text filevr