aaronwp
Re:Huobi's Leaky Bucket Risked Crypto Breach
on Wednesday June 28, 2023 @09:43AM (#36506350)
Another S3 breach, same as all the rest, except this time it risked a ton of crypto assets
Tripvalet.com Leaks Passwords and Stripe Credentials
Re:Tripvalet.com Leaks Passwords and Stripe Credentials
on Tuesday June 20, 2023 @12:41PM (#36406713)
This is the first Stripe breach I've found where the vendor didn't even bother to set a host password. All of their money was at risk. It's a good thing I'm so handsome and honest. They also leaked a bunch of plaintext passwords in an especially galaxy-brained way.
Re:Sega Europe suffers major security breach
on Thursday December 30, 2021 @01:09PM (#29739385)
stay tuned
Re:Sega Europe suffers major security breach
on Thursday December 30, 2021 @01:07PM (#29739346)
Yes, if PII is involved it's common to run an audit like this. In addition to the access keys on the server image, Sega also accidentally published a database export containing PII. In order to write a comprehensive disclosure I have to investigate thoroughly.
And yeah, there's no branding or information on HackerOne. Even if this had been in scope, I would have thought twice about submitting anything. Our publishing standards match HackerOne ethical disclosure standards.
Re:Sega Europe suffers major security breach
on Thursday December 30, 2021 @12:03PM (#29738441)
Sega Europe left AWS S3 creds laying around in a server image on downloads.sega.com. I was able to use them to enumerate a bunch of storage, dig out more keys, and mock up a spear phishing attack against the Football Manager forums.
All the keys and services are secure and the breach is closed.
Sega Europe suffers major security breach
Re:Ask HN: Do you contribute to open source? Why? Why not?
on Friday December 13, 2019 @04:50AM (#21780353)
if anything my terrible merges usually detract from it