Hackers Exploited a PC Driving SIM to Pull Off Disney Data Breach
Hackers exploited a mod for BeamNG.drive to breach Disney's data, downloading over one terabyte of sensitive information. The incident underscores risks of third-party mods in gaming as malware vectors.
Read original article
Hackers exploited the popular driving simulator BeamNG.drive to execute a significant data breach at Disney. The group, known as Nullbulge, created a mod for the game that contained a Trojan, allowing them to gain remote access to computers where the mod was installed. A Disney software development manager, who was a fan of the game, inadvertently installed the mod on a computer that also had access to the company's Slack channels. This breach enabled the hackers to download over one terabyte of sensitive data, including personal information of employees and assets related to unreleased video games, before the manager noticed and halted the data transfer.
The hackers claimed their actions were motivated by a desire for revenge against Disney for the 2017 shutdown of the children's game Club Penguin and for the company's attempts to secure perpetual rights to performers' likenesses. However, the motivations appear inconsistent, as convincing a tech-savvy individual to install malware seems less plausible than simply using a game mod to distribute it. The incident highlights the risks associated with third-party mods in gaming, as they can serve as vectors for malware, regardless of the game's inherent security.
Related
Snowflake breach snowballs as more victims, perps, come forward
The Snowflake data breach expands to include Ticketek, Ticketmaster, and Advance Auto Parts. ShinyHunters claim involvement, Snowflake enforces security measures. CDK faces ransomware attack, Juniper and Apple vulnerabilities identified. Jetflicks operators convicted.
Microsoft tells yet more customers their emails have been stolen
Microsoft notifies customers of email theft by Russian criminals, expanding breach scope. Compromised accounts' correspondents informed. US auto dealers face disruptions from cyber incident linked to CDK software. Rabbit R1 AI devices' security flaw disclosed. EU sanctions Russians for cyber attacks.
Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data
A hacktivist group, NullBulge, breached Disney's Slack system, leaking 1.1 TiB of data to protect artists' rights. The group's origins are unknown, possibly linked to the LockBit ransomware gang. Disney faces criticism for not compensating artists fairly. Recent breaches at AT&T and Ticketmaster highlight cybersecurity challenges.
Disney Hackers dox their inside man
Hackers target Disney, expose alleged "inside man" with threats to leak personal data. 1 Tebibyte of stolen data includes unreleased games. Disney yet to comment on incident. Ongoing cybersecurity threat emphasized.
A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub
Cybersecurity researchers discovered a network of 3,000 fake GitHub accounts, "Stargazer Goblin," spreading malware like ransomware. The operation manipulates GitHub tools, targeting Windows users seeking free software.
14 commentsI can add some context on how this (likely) happened.
BeamNG.drive runs a Lua scripting engine, in which they also run a large amount of their own game / simulation code. This Lua scripting engine uses LuaJIT[3], which includes C FFI functionality. This whole scripting environment is sandboxed, but the C FFI is obviously needed to allow optimizations between the game's Lua logic and the game engine (C++).
People I know personally have found various ways around this sandbox, which effectively allows any mod (which can contain Lua scripts), to bypass the sandbox. These were always disclosed immediately to BeamNG GmbH itself, sometimes against payment, sometimes entirely for free. These people continue to find and report ways to break the sandbox, and BeamNG GmbH is very quick to fix these issues before they ever get found and exploited.
The following is my opinion, and not that of BeamMP Ltd. or BeamNG or anyone but me: I think the BeamNG developers would do well with hiring or otherwise working towards fixing their sandbox. These issues have been in the sandbox for such a long time that it's almost emberassing that they still exist -- I won't go into detail, but some of the exploits found (and fixed) are incredibly trivial. Add to that the possibility that a lot of players run the game as Administrator when it errors in any way, and you have admin permissions on random foreign Lua code that is barely sandboxed.
Of course the blame is on the hackers, but I can't help but feel like at least the more common hacks could be prevented. By hiring a security engineer or two, or not (occasionally) ghosting people who do this work for free, for example.
We (BeamMP, not affiliated with BeamNG.drive or BeamNG GmbH in any way, as they ignore any attempt we make at talking to them), are working actively to make sure players know that they cannot trust mods, especially mods from servers they join. But, sadly, we can't help them fix their game or their sandbox.
[1]: https://beammp.com and https://github.com/BeamMP
[2]: https://news.ycombinator.com/item?id=40955693
[3]: https://luajit.org/
The issue here is the IT department allowing employees to install personal software or games on work computers, or access work-related materials on personal machines directly, without a VPN or similar security measures.
Did they impersonate the software development manager in order to steal credentials? Did Disney integrate their sensitive data storage with Slack?
IT here. My developers like to think that knowing how to code gives them some kind of zenlike understanding of all things computer. But they still make the same boneheaded mistakes that all my other users do. And they're actually a bigger pain to deal with due to their overconfidence.
The group’s motivations, however, don’t really add up, especially given how the mod was likely delivered.
Convincing a tech professional with computer literacy that presumably far exceeds the average person’s to install a piece of software seems like a hard sell.
What seems very likely to me: A group of coders - some being familiar with remote access code and deploying payloads - found each other thru the furry community and formed a working group.
No.. that's actually very believable actually.
You wouldn't download a car...
For sure I wouldn't install a downloaded game mod (or...a game) on a PC with access to anything, but come on -- the probability that some user is going to install some compromised application, or view some video that has an exploit for the video codec, is 1.0. So you can't design a system that depends on that probability being 0.0
Related
Snowflake breach snowballs as more victims, perps, come forward
The Snowflake data breach expands to include Ticketek, Ticketmaster, and Advance Auto Parts. ShinyHunters claim involvement, Snowflake enforces security measures. CDK faces ransomware attack, Juniper and Apple vulnerabilities identified. Jetflicks operators convicted.
Microsoft tells yet more customers their emails have been stolen
Microsoft notifies customers of email theft by Russian criminals, expanding breach scope. Compromised accounts' correspondents informed. US auto dealers face disruptions from cyber incident linked to CDK software. Rabbit R1 AI devices' security flaw disclosed. EU sanctions Russians for cyber attacks.
Disney's Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data
A hacktivist group, NullBulge, breached Disney's Slack system, leaking 1.1 TiB of data to protect artists' rights. The group's origins are unknown, possibly linked to the LockBit ransomware gang. Disney faces criticism for not compensating artists fairly. Recent breaches at AT&T and Ticketmaster highlight cybersecurity challenges.
Disney Hackers dox their inside man
Hackers target Disney, expose alleged "inside man" with threats to leak personal data. 1 Tebibyte of stolen data includes unreleased games. Disney yet to comment on incident. Ongoing cybersecurity threat emphasized.
A Hacker 'Ghost' Network Is Quietly Spreading Malware on GitHub
Cybersecurity researchers discovered a network of 3,000 fake GitHub accounts, "Stargazer Goblin," spreading malware like ransomware. The operation manipulates GitHub tools, targeting Windows users seeking free software.