InfoSecBulletin Cybersecurity for mankind
Cloudflare disclosed that its internal Atlassian server was breached by a suspected ‘nation-state attacker’. The attacker gained access to Cloudflare’s Confluence wiki, Jira bug database, and Bitbucket source code management system.
Eight New ICS Advisories released by CISA
Authority Denies
Hacker claim ransomware attack on Indonesia’s state bank BRI
London-based company “Builder.ai” reportedly exposed 1.2 TB data
(CVE-2024-12727, CVE-2024-12728, CVE-2024-12729)
Sophos resolved 3 critical vulnerabilities in Firewall
“Workshop on Cybersecurity Awareness and Needs Analysis” held at BBTA
CVE-2023-48788
Kaspersky reveals active exploitation of Fortinet Vulnerability
U.S. Weighs Ban on Chinese-Made Router TP-Link: WSJ reports
Daily Security Update Dated: 18.12.2024
CISA released best practices to secure Microsoft 365 Cloud environments
Data breach! Ireland fines Meta $264 million, Australia $50m
The attacker first accessed Cloudflare’s self-hosted Atlassian server on November 14, and then accessed the company’s Confluence and Jira systems after gathering information.
“They then returned on November 22 and established persistent access to our Atlassian server using ScriptRunner for Jira, gained access to our source code management system (which uses Atlassian Bitbucket), and tried, unsuccessfully, to access a console server that had access to the data center that Cloudflare had not yet put into production in São Paulo, Brazil,” said Cloudflare CEO Matthew Prince, CTO John Graham-Cumming, and CISO Grant Bourzikas,
Using stolen access credentials from a previous breach linked to Okta’s compromise in October 2023, the attackers gained unauthorized entry by utilizing one access token and three service account credentials. Cloudflare failed to update these credentials, which were leaked alongside thousands of others during the Okta breach.
Cloudflare detected malicious activity on November 23. They blocked the hacker’s access on the morning of November 24. Their cybersecurity forensics team started investigating the incident on November 26, three days later.
Cloudflare’s staff took several security measures in response to the incident. They changed over 5,000 production credentials and separated the test and staging systems. They also investigated 4,893 systems, reimaged and rebooted all systems on the global network, including Atlassian servers and machines accessed by the attacker.
The hackers tried to break into Cloudflare’s data center in São Paulo, but they failed. All equipment in the center was sent back to the manufacturers to make sure it was completely secure.
Remediation efforts ended on January 5th. The company’s staff is still working on strengthening software, managing credentials, and vulnerabilities.
The company assures that this breach did not affect any customer data or systems of Cloudflare. Additionally, their services, global network systems, and configuration were not impacted either.
“Even though we understand the operational impact of the incident to be extremely limited, we took this incident very seriously because a threat actor had used stolen credentials to get access to our Atlassian server and accessed some documentation and a limited amount of source code,” said Prince, Graham-Cumming, and Bourzikas.
