It more like that only thing hacker could do. They find api that can update ingame image, and since it not sensitive data, I think Nexon have low security for those api
You can do a lot more disturbing things than just what the hacker did though.
It feels like a prank now that most people will probably laugh about and tell legends about. Like it is part of the game lore now. Similar to how Summer Jeanne crashed the servers in GBF.
Again, we don't know the truth. But as a game company dev, my company has several security layers to access game data handled by different teams within company.
But as a product team, sometimes we make an api to access some non-sensitive things with just one layer like simple company vpn or a company account with acl rule. Like to hot fix, fast change event banner or offer pack config.
Of course, there's still possible very skillful hacker can bypass all Nexon's security, but I think the rate is low.
What I meant is not that the hacker chose to do basically what amounts to a fun prank rather than do anything really nasty. In short, what I mean the harm could have been way worse even from what we can see as outsiders.
It mentions there was links to youtube, which opens up all kinds of potential malicious stuff beyond that. And what if they could have linked to other stuff directly?
you don't get what the guy is trying to allude to. the hacker could've shared gore/nsfw pictures instead of just NIHAHAHAs. and have malicious sites linked instead of just youtube.
Yea bro, the hacker that broke the whole firewall of the company and the game, the external and internal security, the counter, the alarm and all other measures could only mess with the avatar/img files in the game.
MAYBE some data did get breached, but nexon isn't saying the full picture to not cause any unrest among players and to dodge responsibility incase they are questioned. But someone who can go through the toughest of securities of the game can DEFINITELY mess with the more internal, sensitive parts of the game files.
The hardest part of a coconut is its outer layer, while the inside is soft.
I don’t usually like correcting others like this since usually I’m not knowledgeable enough to correct others but you DEFINITELY don’t know how these things work (and that’s totally fine). Comparing it to a coconut would be fair if you explained that there are two coconuts and this sensei managed to get his hands on the first one.
While there was some danger the only real damage he could cause by my understanding was the fact he could link random or malicious webpages and luckily was based enough to just put the Koyuki YouTube channel there. Basically, he didn’t get through the “toughest of securities”, that would be user data and payment info. (Which Nexon would be completely unable to cover up)
Nexon is lucky that the hackers did something that was largely harmless since this seemed like a massive vulnerability. 9/10 times if it was done by other hackers they would have done much more damage to the game.
It depends, some do and alert companies to strength their systems because they're consumers themselves. Usually the ones that cause harm are teens who learned how to hack and want money or to make people mad for fun.
Yeah if it was something more nefarious, they'd be so much shit. Imagine if they completely cleared everyone's account. These companies take snapshots of accounts usually before each major update, so at worst, a few weeks worth of progress would be gone, and tens of thousands of transactions would need to be redone.
Yuuka lost a lot of hair after this incident, legends say that Koyuki is now locked up in the maximum security Seminar prison in a cell surrounded by top class Millennium drones and cameras in the room
Together with Noa, who's punishing her as we speak.
I'm surprised they gave a full detail of how it happened.
Knowing Nexon's reputation, I would have thought they would have just said "sorry, we're going to increase our security, here are rewards." but they gave more information
For this game they really go all out regarding explanations on things like this. It's sometimes to the point where you'd think they are over explaining something.
Tbf the sudden massive maintenance coupled with the fact that a lot of players witnessed the Koyuki incident firsthand. I have a feeling they were pretty much forced to make such a statement, whether they wanted to or not
The last 5 years or so of Nexon have been very different from the Nexon we all knew if from the mmorpg era. They are quite different atleast in the na/global division
I think Nexon just saw how Blue Archive fans took down a government organization and made a mental note to never upset or disappoint them.
Cause just recently they've been doing shit like stealing other influencers' faces with AI to advertise their game. If something like this happened to BA, the players might straight up kill them.
I'm guessing Google and Apple wouldn't be satisfied by a basic "we're sorry" message and they had to make a very detailed report (much more than what we got).
it is importance to be transparent in this situation for trust factor. this is like a bank informing you that your saving acct isnt affected from the vulnerabilities.
Transparency here is a good thing. "Servers got hacked" undermines trust in the company's payment processing. Did your CC info get leaked? If you replace your credit card, should you spend money on their game again?
They didn’t actually give a full explanation though, they left out one of the most important parts. The cafe student data is not stored in the CDN, but instead is stored with all the other user data, and they have provided no explanation to how that was changed besides the fact that no game databases were affected (according to them).
Lol so hacker, I didnt get into the specifics but, the hacker clowned around, displayed some memes of their favorite character, and then did nothing else? And everyone got rewards for it? That sounds kinda... fine? Am i missing something?
I feel like these hackers also help Nexon patch game exploits before actual damage could be done. I am grateful for the hacker not being a pos either way 🙏
I mean, there's also the fact that companies are smarter about storing/securing their data or at least should be. Just because a company gets hacked, doesn't mean they can access important information.
It's possible this was always the hacker's goal, but also maybe it was the only thing they could do.
Imagine that instead of creating Koyukis and such, they distribute CP throughout the game, or some disturbing gore scenes. that certainly doesnt touch any of the game data, but what do you think it would do to the game?
They said they the databases weren’t affected, not that they couldn’t have been. If the hacker was actually malicious, they most likely would be able to gain access to and steal from some of, if not all of them.
Nope, immediately fix, compensation and now newfound meme in the community with Koyuki hacking irl.
If it happens again though will be a problem with copycats (with actual vile intentions) and seeing as they're laying everything out from this post, maybe they're confident
This hacker is most likely "Script Kiddies" level which is equal to "beginners" if we use video games ranked.
This is actually a huge issue if these kinds of hackers already can access that level of server? Who knows what else can happen if the game gets an eye on by more malice professional hackers.
This is actually pretty huge if you care about Cyber Security or working in a profession related to it.
This, exactly. As someone who's focusing on that field for their career, this seems like a really bad case in terms of what it means for the strength of their system.
If my understanding is correct, its more akin to a site that keeps all their accounts in-house, but has all their images stored third-party. Someone can hack the third-party and change all the pictures, but the accounts themselves were never at risk. If I'm understanding correctly.
In either case, it's bad. Maybe just not catastrophically so. EDIT: I agree it does represent a poor level of network security, so hopefully that was limited to just the CDN.
I see this a lot in this case. Like they need to thank the hacker, he had all the tools to nuking the server and make modifications to the we don't know many accounts at his disposal. Nexon needs to tighten his security and make real changes to his cyber security department. An "innocent" joke to the community could probably be a warning to the future.
This is most probably an user who found the exploit and tried to contact them about it without success, them used the exploit to warn them about it in a more direct way, and It worked flawlessly, they even stated that theyre gonna start a bug bounty in the future to help it with tighten security.
Well it's a good thing that the person who did this was seemingly just a memer and not malicious, but nevertheless the fact that someone was able to do this is a bad look for their security. We're very lucky it wasn't someone with more sinister motives that did this, but this is already a bad proof of concept for the future that it is doable.
It seems with the improvement of the new translators that don't fuck with text as much, they also got great EN PR person because this mess definitely was communicated well to us
I'm assuming the hacker tried reporting the vulnerability and got no response, so they did this to force their hand. Hopefully they don't get in trouble.
People who say that what Hacker did was harmless, do you really expect a company to truthfully tell if hacker got some important information, especially if it's about user's private details? Maybe things really were harmless, maybe Nexon is hiding something, we will never truly know. But I wouldn't trust a company's statement.
This is most probably an user who found the exploit and tried to contact them about it without success, them used the exploit to warn them about it in a more direct way, and It worked flawlessly, they even stated that theyre gonna start a bug bounty in the future to help it with tighten security.
The use of Koyuki for the memes, The CEO/Suzumi/Hatsune Miku birthday to do it, the long detailing on the statement and the way it moved Nexon to tighten their security and even start a bug bounty program, is actually a good ending for all of this. And the whitehat hacker wouldnt involve the Internet Security Department of Korea for nothing, he could be hunted for the Korea police for just putting Koyuki in the frontpage if he doesnt come clear and said what exploit he found
797
u/KnightMareValtiel Sep 01 '25
Im honestly surprised how the Hacker really did something "harmless" as to put Koyukis everywhere and nothing else lol Pretty fit for our pink gremlin