InfoSecBulletin Cybersecurity for mankind
Cloudflare disclosed that its internal Atlassian server was breached by a suspected ‘nation-state attacker’. The attacker gained access to Cloudflare’s Confluence wiki, Jira bug database, and Bitbucket source code management system.
CVE-2024-51503
Trend Micro released updates for Deep Security Agent RCE
Apple Releases Patch for two Actively Exploited Zero-Day
Maxar Space Data Leak, Company admit, Investigation ongoing!
GitHub CLI Vulnerability Could Allow RCE
“Sarcoma” ransomware group
Hacker to disclose “Popular Life Insurance” 36 GB of stolen data
BugHunt 2024: A Milestone Cyber security Competition held at Dhaka
TP-Link DHCP Vulnerability Allow Attackers Takeover Routers Remotely
WSJ reports
T-Mobile hacked in massive breach of telecom networks
Palo Alto Networks Confirms critical RCE zero-day actively exploited
CISA, FBI Warns
Hacker compromised multiple teleco network at US
The attacker first accessed Cloudflare’s self-hosted Atlassian server on November 14, and then accessed the company’s Confluence and Jira systems after gathering information.
“They then returned on November 22 and established persistent access to our Atlassian server using ScriptRunner for Jira, gained access to our source code management system (which uses Atlassian Bitbucket), and tried, unsuccessfully, to access a console server that had access to the data center that Cloudflare had not yet put into production in São Paulo, Brazil,” said Cloudflare CEO Matthew Prince, CTO John Graham-Cumming, and CISO Grant Bourzikas,
Using stolen access credentials from a previous breach linked to Okta’s compromise in October 2023, the attackers gained unauthorized entry by utilizing one access token and three service account credentials. Cloudflare failed to update these credentials, which were leaked alongside thousands of others during the Okta breach.
Cloudflare detected malicious activity on November 23. They blocked the hacker’s access on the morning of November 24. Their cybersecurity forensics team started investigating the incident on November 26, three days later.
Cloudflare’s staff took several security measures in response to the incident. They changed over 5,000 production credentials and separated the test and staging systems. They also investigated 4,893 systems, reimaged and rebooted all systems on the global network, including Atlassian servers and machines accessed by the attacker.
The hackers tried to break into Cloudflare’s data center in São Paulo, but they failed. All equipment in the center was sent back to the manufacturers to make sure it was completely secure.
Remediation efforts ended on January 5th. The company’s staff is still working on strengthening software, managing credentials, and vulnerabilities.
The company assures that this breach did not affect any customer data or systems of Cloudflare. Additionally, their services, global network systems, and configuration were not impacted either.
“Even though we understand the operational impact of the incident to be extremely limited, we took this incident very seriously because a threat actor had used stolen credentials to get access to our Atlassian server and accessed some documentation and a limited amount of source code,” said Prince, Graham-Cumming, and Bourzikas.
