Hacker News Reader

Comment by dgrin91 | Hacker News Reader

Does it really count as a 'hacker' if it was just a straight up bribe? Where is the hacking here?

I’d categorize this under social engineering, so... probably counts.

But the terminology issue seems like a surface detail. The attack vector (bribing an insider with front door access to customer data) is a pretty big and actively exploited class of organizational vulnerabilities, so it’s a security problem anyway.

It is a security problem but it’s not hacking. Default passwords are security problems but they’re also not hacking. Overhearing conversations in an airport or bar or whatever where sensitive information is disclosed is a security risk but also isn’t hacking.

These are all examples of hacking. Finding a way in is the goal it can be a clever way but sometimes doing the obvious is more clever.

So is torturing a password out of someone hacking? I suppose if the torture method involves a hacksaw.

Yes, depending on the purpose and use of gaining the password, that qualifies as a horrible, horrible portion of a hack.

Hacking imho implies a workaround or circumvention that has a certain degree of cost-effectiveness and an indirect angle of attack (e.g. many types of remote exploits). For example, I don't know if I'd consider a brute force calculation of a password to be "hacking", if the cost and time of computing resources outweighed the potential gain. And while hacking a user's arm off might be more "cost-effective" (to put it coldly) than brute forcing their password, it essentially requires the resources and opportunity to have very direct physical access – in the same way that blowing off a bank vault door with explosives doesn't feel like "hacking".

But in any case, I don't think bribery as an effective attack vector for a service as big as Roblox is so self-evident that it lacks cleverness or insight. It's not just the work of finding someone with access privileges (could be as "easy" as searching LinkedIn for people listing Roblox as an employer), but also knowing what to bargain for (e.g. account credentials versus "give me the password of the richest Roblox player"), and having the confidence that the system would allow me essentially unfettered access (i.e. weak access-control policies and threat detection).

Logically, if bribery is such a straightforward and cost-effective attack, then people would be going hard all the time bribing insider employees at a bank. Yet if I had the money and time and willingness for illegal behavior, I'm not at all certain what unauthorized access I could get from any bank employee, nevermind how far I'd get undetected.

To put it another way, "legitimate" hacks usually reveal major substantive ways that a system can/should be hardened. I think it's pretty obvious how Roblox's access-control and auditing should be hardened after this kind of intrusion. How would a company realistically improve its security after learning a user's own account was compromised after the user was tortured into giving away their credentials?

Hacking almost always involves a decisive understanding of weaknesses general and specific to a system. Most of us know what default passwords are but don't have the initiative or ability to find an opportunity and actually exploit it. Similarly, just because I know what a bribe is doesn't mean I think it's trivial to bribe someone successfully and gain useful escalated privileges to a very large system.

Overhearing something accidentally isn't, but purposefully putting yourself in proximity so you have a chance for that is espionage and possibly social engineering (depending on whether you're just near or playing yourself off as part of a similar group).

In many ways, this is close to the original term of hacking, which is less about computers and more about circumvention of restrictions and security.

Fair enough. I could get on board with your way of delineating it.

The way I see it is that modern day "hacking" and "espionage" form a venn diagram, and that particular distinction isn't important anymore when it comes to attacking and protecting businesses in digital space. Espionage based tactics for digital intrusion, including getting physical access to the digital assets, are usually fair game for pentesting and are often within the scope of the blue team.

How do you define "hacker"? This site changed its name from "Startup News" to "Hacker News" [0], but I don't think it signaled a complete shift in userbase and topics.

In any case, the article says the person "changed the password for and stole items from Roblox users". Would you say it's wrong for those users to describe their accounts as being "hacked"?

edit: moreover, no matter the method of intrusion, it shows how basic/non-existent the auditing and access-control is for a system that services 100 million active monthly users, which is most definitely the kind of security issue that traditional technical hacks reveal.

[0] https://web.archive.org/web/20080220095541/https://www.ycomb...

It must take some skill in developing relationships -- Who has access to the information? Who is willing to take a bribe? What amount to bribe? Who can actually follow through? Who can do it tactfully enough to not get caught in the act? Etc. Maybe not "computer hacker", but "organizational hacker" sure

Does Social Engineering count too?

I don't think so. If I bribed (or "lobbied") a congressman to vote for my bill, did I really hack the US federal government?

I think the difference of opinion is whether or not you think on-paper democracy includes lobbying as a natural mechanism for law making and whether or not lobbying is, respectively, a workaround.

Unauthorized use of a computer system. Yeah, fits one definition.

On the "hacker's" resume for a security job? No, it doesn't count.

From the user's perspective who had their data leak? Of course it counts.

Reply on news.ycombinator.com