In September, a teenage hacker who goes by the alias “teapotuberhacker” managed to breach Uber and Rockstar Games at almost the same time. I wrote previously about the Uber hack. The Rockstar hack was smaller in scope – but the implications are potentially much greater.
To quickly review: the hacker used social engineering tactics to convince an Uber employee to give up their login credentials, which the hacker then used to gain access to internal systems and data. We know less about the techniques used in the Rockstar hack, but social engineering was likely involved – especially considering the perpetrator (who has since been arrested) was affiliated with a hacking group called LAPSUS$ known for successfully using social engineering to hack Microsoft, Samsung, Okta, and others. Social engineering is their MO.
In the case of Uber, the hacker gained access to internal systems but does not appear to have stolen, altered, or destroyed any data. In the Rockstar hack, however, he released dozens of videos of unreleased gameplay footage from Grand Theft Auto 6: one of the most hotly anticipated video games in development and a piece of intellectual property worth massive amounts of money (the previous game netted $6+ billion). Details about Grand Theft Auto 6 have been few and far between, so to get so much footage of the game provided interested parties with an avalanche of details to scrutinize and (inevitably) criticize.
Reading Into the Attack
The fact that social engineering was behind this attack and so many others launched against major companies shouldn’t come as a surprise.
We have long known that social engineering – from simple phishing to more sophisticated forms like these attacks – is a major vulnerability in cybersecurity. Arguably, bigger organizations are at greater risk of social engineering since there are so many people and processes happening at once that it’s hard to know what’s “legitimate” and what’s “suspicious.” Uber, Rockstar, and Microsoft all take security seriously, employ elite security teams, and train their employees carefully – and yet all fell victim to social engineering.
Perhaps the lesson is this: we are good at catching “dumb” cyber attacks driven by code, but when an actual person is in the driver’s seat, our defenses are extremely inadequate.
The fact that intellectual property was the target isn’t surprising either. Cyber attacks and corporate espionage are no strangers to one another. Furthermore, this is hardly the first time people have seen a game (or movie, album, novel, etc.) before the creator intended. I still think the Rockstar hack is remarkable, though, given the circumstances: a teenager, using tenacity much more than technology, got access to one of the single most valuable pieces of IP on earth, then released it into the wild for all to see. Many of the videos have been taken down (though plenty remain), but the key details have been written about extensively, and the impact is impossible to undo.
Grand Theft Auto 6 will almost certainly still be a smash hit. But how much will the reaction to the leaked videos change the course of development? No one outside Rockstar can know for sure. But at the very least, the developers have to discuss and defend the game much earlier than they wanted, and do so in a context where people have only seen part of the work in progress. At the very worst, developers may have to make significant changes that delay the release and inflate the development cost. One way or another, the hack has altered the course of Grand Theft Auto 6 – and it wasn’t even particularly hard.
Content creators across the board – but especially media giants like Netflix, Disney, or Electronic Arts – have to feel a little more anxious after the Rockstar hack. What’s stopping someone from releasing unedited footage from an upcoming Marvel movie and sparking a wave of fan backlash in the process? Or leaking Beyonce’s next album months before the carefully planned launch? It appears easier than ever for someone with the right motivation to “pull back the curtain” on whatever piece of IP they want. So what does that mean for the future of artistic production, both from a creative and economic standpoint? And what does it mean for the future of cybersecurity – will IP attacks become a dangerous new threat vector?
I’m curious to hear what the community thinks. Drop your comments below.
#rockstar #hack #socialengineering
About Version 2 Digital
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About VRX
VRX is a consolidated vulnerability management platform that protects assets in real time. Its rich, integrated features efficiently pinpoint and remediate the largest risks to your cyber infrastructure. Resolve the most pressing threats with efficient automation features and precise contextual analysis.
