Popular online game Roblox has suffered a security breach after a hacker bribed a company employee to gain access to the company's back end customer support panel.
This allowed them to lookup other users' personal information and give out virtual in-game currency, with the hacker able to see other users' email addresses, change their passwords, remove two-factor authentication from their accounts, ban users and more. The hacker shared screenshots with the news outlet which included the personal information of some of Roblox's most high profile users including YouTuber Linkmon99.
While the hacker could have looked up information on many users, they only accessed a handful of accounts. In an online chat with Motherboard, the hacker said that “I did this only to prove a point to them”.
- Here's how one company is teaching children to code and program
- Bug bounties have made these hackers millionaires
- These are the best e-learning apps for your children
Gaining access to other user's online accounts and in-game items through social engineering and bribery is bad enough but the fact that many of Roblox's users are children complicates things even further.
Roblox hack
In addition to viewing user data, the hacker was also able to reset passwords and change other user data as well based on the screenshots of the customer support panel shared with Motherboard. According to the hacker, they changed the password for two accounts and sold their items.
The hacker first began their infiltration of Roblox's platform by paying an insider to perform data lookups for them. However, this progressed a step further when the hacker targeted a customer support representative for even greater access to the company's systems.
The hacker even went as far as to try and claim a bug bounty from Roblox which was denied as they didn't actually find a vulnerability but instead used social engineering and bribery to access its systems.
Following the hack, Roblox addressed the issue and individually notified the small number of users who were affected. The company also reported the hacker's actions to the bug bounty platform HackerOne as an additional measure.
- We've also highlighted the best antivirus software
Via Motherboard
