Re:Hackers used Slack to break into EA Games
by fierro on Friday June 11, 2021 @11:29PM
(#27481251)
sounds like it's a simple software token. Hackers needed an account for this, which they got by paying 10$ for stolen cookies lol. So now they can log into some random employees account, then get an admin issued 2FA code. Never seen these "bypass" codes before, but that's my best guess.
[ Parent
| on HN ]
Re:Hackers used Slack to break into EA Games
by bredren on Friday June 11, 2021 @11:54PM
(#27481390)
The stolen cookies imply full access to one of the employees machines.
How is something like this advertised on forums?
Valid auth token for employee at EA Games for sale? Does it list the expiration? Refunds if it isn’t valid at time of sale?
Re:Hackers used Slack to break into EA Games
by fierro on Saturday June 12, 2021 @09:10PM
(#27488904)
nah not to the full machine. This is just a Slack token. Someone basically had the employee click on something with XSS or some other way to steal cookies (idk there's a bunch of ways you can steal cookies out of someone's browser)