money 'Roblox' worker sold user data access to a hacker
It was ostensibly meant to challenge the studio's security.
Hackers don’t necessarily need to break into networks to compromise game companies — sometimes, it’s just about coercing the right people. An anonymous attacker talking to Motherboard has revealed that they bribed a Roblox customer support representative to get access to the customer support panel for the online game platform. The intruder could see email addresses, change passwords, strip two-factor authentication and even ban users.
This was done solely to “prove a point,” the hacker claimed. As evidence, they provided photos showing details of a handful of players, including high-profile examples. However, this wasn’t a strictly virtuous act — the perpetrator changed passwords for two accounts, sold items and updated two-factor settings once it became clear an attempt to claim a bug bounty (for a non-existent flaw) wasn’t going to work.
Not surprisingly, the studio wasn’t pleased. A spokesperson said that it rushed to “address the issue” and alert affected customers. It also reported the culprit to the HackerOne bug bounty program for an investigation.
The incident did little damage, but underscores the growing risks of social engineering attacks (that is, preying on workers with access to key controls). This, SIM swapping and similar schemes frequently exploit lax verification processes and low-paid customer service reps to get access they wouldn’t otherwise have. Unless a company finds ways to discourage staff from taking bribes, you could easily see incidents like this in the future.
