What could have been a damaging breach in one of Sega’s servers appears to have been closed, according to a report by security firm VPN Overview. The misconfigured Amazon Web Services S3 bucket contained sensitive information which allowed researchers to arbitrarily upload files to a huge swath of Sega-owned domains, as well credentials to abuse a 250,000-user email list.

The domains impacted included the official landing pages for major franchises, including Sonic the Hedgehog, Bayonetta and Total War, as well as the Sega.com site itself. VPNO was able to run executable scripts on these sites which, as you can imagine, would have been quite bad if this breach had been discovered by malicious actors instead of researchers. 

An improperly stored Mailchimp API key gave VPNO access to the aforementioned email list. The emails themselves were available in plaintext alongside associated IP addresses, and passwords that the researchers were able to un-hash. According to the report, “a malicious user could have distributed ransomware very effectively using SEGA’s compromised email and cloud services.”

So far there’s no indication that bad actors made use of this vulnerability before VPNO discovered and helped Sega to fix it. Sega Europe was not available for comment.

Misconfigured S3 buckets are, unfortunately, an extremely common problem in information security. Similar errors this year have impacted audio company Sennheiser, Senior Advisor, PeopleGIS, and the government of Ghana. Sega was the target of a major attack in 2011 which led to the exfiltration of personally identifiable information pertaining to 1.3 million users. Thankfully, this misconfigured European server didn’t result in a similar incident.

Source: Engadget – Sega left one of its European servers wide open

It wouldn’t be CES season without at least a couple of offbeat robots showing up. Yukai Engineering, the maker of the Qoobo robotic cat tail pillow, has revealed a soft robot that nibbles on a user’s fingertip. The company hopes the “somewhat pleasing sensation” will brighten up your day.

Amagami Ham Ham has an algorithm called a “Hamgorithm” that selects one of two dozen nibbling patterns, so you’ll never be sure exactly what you’ll feel when you shove your digit into the robot’s maw. Yukai designed the patterns — which include Tasting Ham, Massaging Ham and Suction Ham — to replicate the feeling of a baby or pet nibbling on one’s finger.

“Amagami” means “soft biting” and “ham” means “bite” in Japanese. Yukai based the look of the robot on a character from Liv Heart Corporation’s Nemu Nemu stuffed animal series. There’ll be a couple of finger-munching models to choose from: Yuzu (Calico Cat) and Kotaro (Shiba Inu).

“Most people like the nibbling sensation but know they need to teach their children or pets to stop it, because kids and animals will otherwise bite them with full force eventually,” said Yukai Engineering CMO Tsubasa Tominaga, who invented the robot at a hackathon earlier this year. “Amagami Ham Ham is a robot that frees humankind from the conundrum of whether ‘to pursue or not to pursue’ the forbidden pleasure.”

Pricing hasn’t been determined, but Yukai and Liv Heart plan to run a crowdfunding campaign in the spring. In the meantime, those braving CES can check out Amagami Ham Ham at the show, and perhaps leave Yukai’s booth with a slightly more tender finger.