Someone Cheated at Roblox and Broke Vercel ![rw-book-cover](https://img.youtube.com/vi/nnzH0eaAFa8/maxresdefault.jpg) 🔗 **Source:** [Someone Cheated at Roblox and Broke Vercel](https://www.youtube.com/watch?v=nnzH0eaAFa8) One person installing Roblox hacks calls for sale to be hacked, possibly compromising all of your projects environment variables, and the hackers want $2 million for the stolen data. Yeah, this is a crazy and scary story, so let's jump in. This is for sale's announcement of the hack saying that they identified a security incident that involved unauthorized access to certain for sale internal systems. These systems could access your non-sensitive environment variables, which most are by default by the way, and also had tons of internal corporate data. This is also the attacker selling that data claiming you could release malicious NPM packages that would infect millions. But, how did the attackers get this information? Well, for that, we need to follow the story of one for sale employee. They're looking for help with their work. They're looking around for the options they have to offload it to AI, and they stumble across a product called context.ai. Specifically, their legacy product called AI office suite, which was a tool to build presentations, documents, spreadsheets, and write emails on the user's behalf. The for sale employee decides to give this a go, and he signs up using his for sale Google workspace account and grants it allow all permissions that gives it full access to that Google Drive and Gmail. Now, you might think that it was a little bit reckless to use a company account and give it allow all permissions. I mean, it kind of was, but context.ai is a legitimate company. This is not the point where his Google account was stolen. For that, we need to go even deeper. We need to go to a highly privileged employee of context.ai. This employee is busy building context.ai trying to keep up with the fast-paced AI world and wants to kick back and take a break. Maybe play a bit of Roblox. Trouble is, I guess they're not very good at the game they were playing, so they wanted to take a shortcut and they start looking for Roblox hacks. Specifically, some auto farm scripts, and I guess they found one and downloaded it all on a company laptop. I genuinely cannot believe this is what happened. It is so dumb. Rather predictably, the Roblox hack that they downloaded had an information stealer in it, one that was known as Lumastealer. It's been a well-known information stealer that was first found in 2022, and once on your machine, it scrapes your live session cookies and corporate credentials. And in the case of our context.ai employee, the logs from his laptop show that it got access to his Google workspace credentials as well as keys and logins for things like Superbase, Datadog, and AuthKit. Anything that he was logged into on his browser was stolen. The attackers then use these credentials to access context.ai's internal AWS environment, and while looking around in there, they hit a jackpot. They found and compromised a database containing the OAuth tokens for users of that legacy AI office suite. And guess whose token was sitting right there ready to be taken? Our for sale employee's. With this token, the attackers can now pivot from context.ai to for sale, taking over the for sale employee's Google workspace account without ever needing a password or triggering a multi-factor authentication prompt. With this account, the attackers got access to a lot of for sale's internal systems like linear, and even a back end that could access non-sensitive environment variables of for sale user projects. If you haven't set environment variables in for sale before, you needed to manually check a box to mark the variable as sensitive. If you did, it would be heavily encrypted and masked from internal systems, but the default was non-sensitive and these can be decrypted to plain text and accessed internally. All of this brings us to April 19th where the attackers, going by the name ShinyHunters, post on breach forums asking for $2 million for the stolen data. They claim they have source code, NPM tokens, GitHub tokens, employee records, and even post a screenshot of the internal for sale enterprise dashboard as proof that they have access. Interestingly, members of the actual ShinyHunters group have denied any involvement in this, meaning it could just be an affiliate or an impostor trying to cash in on their brand. But, regardless of that, all of this cascaded from a Roblox hack. Once for sale was aware of the hack, they started their incident response, and they confirmed that core open source projects like Next.js and Turbopack were completely safe. And they also made it so all new environment variables now are set to sensitive by default. So, that's the overview of the hack. But, if you're a for sale user like me, you probably have a lot of work ahead of you. You need to assume that all non-sensitive environment variables that you had on for sale have been compromised, and you need to actively rotate those keys at the source. You can't just delete the project and move off for sale. Also, if you're a company that's worried that an employee used context.ai, you can go into Google workspace and audit your authorized OAuth apps looking specifically for the compromised context.ai app ID, and I'll leave the link to the info stealer blog post here that has details on what to do. The moral of the story though is that one over-permissioned AI tool and a random employee trying to cheat at Roblox, it's all that it takes to compromise one of the biggest infrastructure platforms on the web. Please, do not download game hacks onto your work laptop, or to be honest, anything that you don't trust. Let me know what you think of all of this in the comments down below. While you're there, subscribe, and as always, see you in the next one., Someone Cheated at Roblox and Broke Vercel, YouTube, 01kptxjdkrpv7vf1tcfpgp1mby.