Utopian.io Hack - May 3rd - May 4th 2018. No Wallets Or Keys Compromised.
Due to a recent attack on Utopian services, flaws in our system have been exploited, allowing for full disruption of one of our main production servers and partial loss of data.
[EDIT]
Rewards from this post will be donated to Busy.org / SteemConnect for their help in stopping the attack.
The Attack
The attack started yesterday. It was initially identified as a service disruption only, but it appears that wasn’t the case.
- Our main production server was completely erased.
- Our CDN, which contained files and backups, was erased .
- SteemConnect Tokens were leaked from our DB and today used to bulk downvote/upvote random posts.
NO WALLETS OR KEYS WERE COMPROMISED OR WERE EVER IN DANGER OF BEING COMPROMISED DURING THE ATTACK.
The incident was resolved and all the tokens were permanently revoked.
Was my wallet or private keys compromised?
No. No private data was leaked and your wallet was not at risk at any point.
What can one do with a SteemConnect token?
Only basic actions like posting and voting, but never transfers of funds, delegations etc.
Can this happen again if I use SteemConnect to login another app?
The Utopian application database was leaked due to a successful hacking attempt on company servers. The leak was not caused by any security issue in SteemConnect and you are totally safe to use SteemConnect in the future.
For more information: https://steemit.com/steemconnect/@busy.org/automated-votes-abuse-on-steemconnect
Do I have to change my password?
No passwords or keys are stored by SteemConnect or Utopian. This attack does not demand you change your keys or passwords.
Is the issue over? Can my account be misused to vote random posts?
Yes the issue was resolved and existing SteemConnect tokens revoked. No other operations can be broadcasted with the leaked tokens.
Is the hacker or hackers responsible being traced?
We are making efforts to trace and investigate the source of the attack and are checking all possible leads. Working in cooperation with the team at SteemConnect, our hosting service providers, and making use of all available forensic tools, we hope to pinpoint the source of the leak and take legal action against the perpetrator.
What Now?
To ensure your account was not misused, and to undo whatever actions were taken with the use of your token, please go to https://steemd.com/@youraccount and check if any vote was broadcasted without your consent. If so, please revert the vote/downvote.
Within the next few days, we will publish interim guidelines on contributing to Utopian while we restore normal operations.
We thank you for your patience and continued support and apologize for any inconvenience caused.
in case if anyone would like to revoke authorities given through SteemConnect, and if someone is afraid that now it has to use password/active or owner key on SteemConnect website to do that... here I described a way, how to revoke those authorities without using SteemConnect (with Python Steem):
https://steemit.com/utopian/@noisy/7nw1oeev
https://v2.steemconnect.com/revoke/@utopian.app
You still need your ACTIVE key to revoke it. Then change your password and keep it safe.
Thanks @noisy. As for this case all tokens were revoked and utopian.app proxy deleted.
yes. That is what I also said in my video :)
Don't want to rub salt in the wound, but shouldn't a huge project like Utopian, juggling with millions of SP and thousands of users, have a top notch secured servers? To me, there's no excuse for incidents like that.
You are very right @drakos they have to take care about that and they don't have any exuses because we trusted them our keys and hackers downvoted very powerful people from my account because of that, yes I removed the downvote, but what if I wasn't home ? What if I had a vacanccy or something ? Will I comaback after a few days and see that a flagging war started against me ? utopian have to share the reward of the post not just with busy and steem connect , even with those who was touched by this hack, I am working hard on steemit for about a year to take care about my reputation, not to be flagged because someone didn't take care about security, I used utopian a few months ago and I am not using it anymore because if their hard moderation, I forget to revoke them before, I hope that wil not happen with other platforms as well.
@drakos we had our servers secured and backups in place. Who did this knew where to act. We are verifying with those who had the possibility to work on our servers directly if there was anything that may have opened a security breach. Literally anything can be hacked. Today was our turn. We are not looking for any excuse. We have been plain honest on what happened here.
When there's no server handling tokens or keys, and that your website build is hashed and verified, then there's nothing to hack. Hackers would need to hack individual users.
@heimindanger we had background processes in place to broadcast actions required for our system to work on behalf of the users. Without having an offline token for that, I don't see how could we have achieved such functionalities. Do you have a suggestions for this?
I believe we shouldn't do operations without the users explicitely knowing about it. What type of transactions do you need for utopian where user consent is impossible?
A possible solution would be a mobile app and push notification. It sends a notification and asks user for approval and unlocking his key for forging the transaction. For example
@heimindanger we had a review system in place, where users could make a poll to verify the quality of the post and the final score stored in the blockchain for the original post, among with other similar functionalities. You can't just request for a user consent on every single operation that makes the site functional.
Arguably I have much less need for this type of 'server side' feature. A good example for DTube is the feature to schedule when your video gets published, I've received that one a lot.
Still I believe this ability from SteemConnect to create arbitrary tokens in the name of your users, and giving the power to these tokens to vote or comment or whatever, to be a security issue for the whole network.
So basically you edit the post and put some extra data in it, and for that you need access to the original poster account. You could do that without the user account by using a custom_json operation or inside of a json_metadata of a comment of the post (and using the @utopian-io acc).
Working with compromises is always hard. Any established social media platform has a solid Oauth system in place and we should focus on how we could implement the most secure and customisable tool, while not hurting the user experience. I believe there is room for improvements on that. Hacks happen everywhere and at any level, it is always a question of how you could minify the consequences. Obviously we were not ready for this.
When did you last have a penetration test against the web application?
That sucks. Good luck finding the culprit.
Saya tidak khawatir akan hal seperti ini, karena saya yakin @utopian-io mempunyai sistem keamanan yang bagus, semoga tidak ada newbie yang korban disini.
Utopian is giving flimsy excuses for their incompetence. I suggest everyone should change their passwords. Why allow another body who can't secure or encrypt your password on their servers. Why can't utopian use password salts and encryption. So it means they just stored the user's passwords on a stupid server?? I've looked at the utopian repo, it still has more stupid flaws and must be addressed
@doctorvee honestly you missed the whole point. No passwords are ever stored by any party involved. Everything is explained in this post. Thank you
You don't need to start telling everyone to start changing their passwords. You can if you want, Gho ahead but no passwords were compromised so this si just FUD your spreading now. Your comment seems like you just read the title and are just spreading fear for upvotes. Who told you ANYTHING about storing a users password on a "stupid server" haha who runs tyyhis company stupid brand server? I didn't know you could get a stupid servers I thought all servers were inhgeritly smart?
Anyway lol I'm just jokin around with you, heres an upvote, I hope you can calmd own and realize that you just need to re read the article
also I suspect your knowledge and understanding of how all this works is a lil lacking am I right to suspect that? :D
Even Google and Facebook got hacked. Even if the server is super secure, a hacker with the skills could exploit it if such vulnerability exists (which is pretty common).
Well said, it's actually the point.
Utopian overcame abuses, its not a small matter, but surely utopian will make a Come Back a lot stronger than before.
Thank you for making this statement. Many wondered about it.
There is one point too much ^^
Yes thats why we updated everyone with the info
The bigger any platform or venture becomes, more chances of hacking and exploitation are there. Safety is the main concern and we are happy that on time it was diagnosed and stopped.
just posting to show support @elear - what has happened here has been a clear abuse of trust and I am sad to hear it has happened to utopian. Everyone knows who is behind this and utopian have my full support.
Who was behind it?
Nobody knows. But from the looks of it, he is most likely someone who has had a conflict with haejin. The hacked tokens were used to downvote haejin's posts.
Thank you for your support. We appreciate it a lot.
Thank you.
I don't. If everyone knows, somebody say so. If nobody says what everyone supposedly knows how do we know whether anyone knows the same thing or only thinks they do.
Great respect for owning this and the honest, open response. These things happen and how they are handled determines if you keep your users or lose them.
Thank you for your comment! We appreciate it a lot.
I'm looking forward for the next update if you ever catch the malicious users.
I still support @elear and utopian team despite all this hacking trouble. You can only make it better.
Thank you for the update.
Thank you
Thank you for your honesty with regards to today's events, I hope that @utopian-io will come back stronger because of this.
I have much to thank utopian-io for personally, and will remain in full support of the project.
Thanks you for your support!
Thank you Asher.
I think this is good that you react quickly but we need to change some things:
All in all, I am very happy the harm was limited. Utopian is very important for a lot of people and should be secured accordingly.