6 ms·

Data from Atlassian dumped online after apparent hack

145 points by gjvc 4y ago

hn_throwaway_99 4y ago
> multiple current employees’ data, including names, email addresses, work departments and other information. What was the hack, scraping LinkedIn? In all seriousness, I feel like we need some different language or a color-coded system (ugh, kinda hate that after I just typed this) for the severity of information in hacks. All of this information listed is semi-public anyway. Birthdates/SSNs/private info I can understand getting up in arms about. But names and email addresses? Wait until younger folks hear about this giant book phone companies used to deliver that had nearly everyone's name and phone number in it!
- layer8 4y ago
  > What was the hack, scraping LinkedIn? I feel like we need some different language or a color-coded system for the severity of information in hacks. No, we just need to read the article.
  - re-thc 4y ago
    Often the hardest part /s
- tyingq 4y ago
  They had access to a visitor management system, which may turn out to be fairly interesting. Not the crown jewels, but who is visiting, and how often can be sensitive.
- IncRnd 4y ago
  > In all seriousness, I feel like we need some different language or a color-coded system (ugh, kinda hate that after I just typed this) for the severity of information in hacks. There already is language for this, but what we often have on HN are people posting random and old links to online newpaper articles that don't convey enough information about the vulnerability, its root cause, or its effect. In this case, there isn't a vulnerability score, because there isn't a disclosed vulnerability or exploit. However, there may be some risk that people outside Atlassian are unaware. CVSS scoring is used in many places. There are calculators that score a vulnerability in the context of a base score, temporal score, or environmental score. [1] Here is NIST's NVD page. [2] At the bottom are some of the most recently scored vulnerabilities. If we search for Atlassian tagged vulnerabilities at the NVD site[3], we see that the most recent vulnerability, CVE-2023-26256[4], actually is ranked high at 7.5 on the v3.1 CVSS scoring. There is an actual description. Plus there are references to advisories/solutions/tools, the CWE, a listing of affected software configurations, and a change history. [1] https://www.first.org/cvss/calculator/3.1 https://www.first.org/cvss/calculator/3.1 [2] https://nvd.nist.gov/ https://nvd.nist.gov/ [3] https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=atlassian&search_type=all&isCpeNameSearch=false https://nvd.nist.gov/vuln/search/results?form_type=Basic&res... [4] https://nvd.nist.gov/vuln/detail/CVE-2023-26256 https://nvd.nist.gov/vuln/detail/CVE-2023-26256
VoidWhisperer 4y ago
The title of the post seems a little bit disingenuous - Atlassian themselves wasn't hacked, nor was the vendor that the data ended up coming from for that matter.. It was a case of an employee accidentally posting credentials for Atlassian's Envoy setup in a public repository, which they apparently use for in-office resources, hence why it has basic employee information and floor plans.
- awill 4y ago
  >> Atlassian themselves wasn't hacked...It was a case of an employee accidentally posting credentials for Atlassian's Envoy setup in a public repository It doesn't matter how credentials were leaked.
  - shevis 4y ago
    Disagree. “Hack” typically implies malicious intent so it kind of does matter. “Leak” probably would have been more appropriate since this appears to have been the result of negligence rather than malice.
    - deleted 4y ago
      [deleted]
    - kodah 4y ago
      I have never in my life heard that hack comes with malicious intent. To me hacking is a generalized term for successful unauthorized computer system access.
      - shevis 4y ago
        After giving this some more thought I think you’re right. I would even broaden your definition to include using authorized access in ways that weren’t originally intended by the computer system’s designers. I was trying to distinguish between breaches that result from intentional exploitation (malicious or otherwise) and breaches that result from negligence. Having thought about it a bit more, these things are not actually mutually exclusive. Many intentional exploitations take advantage of dumb mistakes (e.g. posting credentials in a public repo). As such, I take back my earlier disagreement: this is a valid use of the word “hack”.
RomanPushkin 4y ago
Atlassian alternatives: https://bye-bye-server.com/ https://bye-bye-server.com/
deleted 4y ago
[deleted]
Zetice 4y ago
Their permissions system is a complete mess on their actual platform; if you create a support request it generates a Jira ticket, but depending on how access is set up, you may get access to the entire support "project" which means you can see other customer's support tickets (I'm being a little vague because I don't want to give the whole thing away, there is more to it than this, but I currently can see every open support ticket). Not at all surprised this happened, and more will invariably come.
- tharkun__ 4y ago
  That's like saying AWS's permissions system is a mess and depending on how you set it up you may get access to all of someone's S3 buckets ;)
  - Zetice 4y ago
    It'd be more like if Amazon hosted customer support tickets in a heavily customized S3 bucket, but didn't lock that S3 bucket down.
    - tharkun__ 4y ago
      It's called an analogy. Systen A with permissions: Jira System B with permissions: AWS This is the only property the two systems used in the analogy are required to have. In fact they don't even need to have the exact same property. Of course more similarities between the two make the analogy closer to each other but that is not required. Obligatory - if somewhat far fetched - car analogy: Tesla's app is a complete mess! Depending on how you set up access, anyone with permissions to your car could just drive off with it!
      - Zetice 4y ago
        …what? Atlassian uses Jira (a product they own) to manage their support tickets, and they have not configured it to only allow the customer who created the ticket to access their ticket. The analogy is that Amazon is to AWS as Atlassian is to Jira.
c7DJTLrn 4y ago
The Atlassian engines stalled long ago but somehow they continue to defy gravity. Bitbucket is years behind GitHub. The last time I used it, it was extremely unreliable. Jira is an ugly and laggy mess. Confluence is crap. How are they still alive?
- jagged-chisel 4y ago
  Jira. Who else has the complexity of Jira?
  - 1letterunixname 4y ago
    Phabricator fork we use is way more comprehensive and usable than JIRA.
  - vxNsr 4y ago
    servicenow, asana, moday.com even
  - chakintosh 4y ago
    Linear
- tharkun__ 4y ago
  Actually Github only recently gained one of the best features bitbucket has always had, which is a file explorer on the left in PRs. I have no idea how people could use Github without that. Now one thing that Github has is integration. You get lots of stuff integrated for free where Atlassian offerings are separate products. And you don't have to configure much. You can't compare Github to just bitbucket. You have to compare it to a combination of bitbucket, bamboo with Elastic agents and Jira. With a competent admin this is all easily set up and administered. And especially if you are a largish company Jira is the killer vs. Github issues. Especially if said company is somewhat process heavy which Jira is just the best at. So configurable and extensible. Of course a small startup or open source project will prefer the zero fuss Github. And of course as devs we don't care much about those parts. But you did ask why they are still alive.
tonfreed 4y ago
SiegedSec's announcement of it with the uwu buoys my spirit a little bit that the original irreverent hacker spirit isn't completely dead.

145 points by gjvc 4y ago

> multiple current employees’ data, including names, email addresses, work departments and other information. What was the hack, scraping LinkedIn? In all seriousness, I feel like we need some different language or a color-coded system (ugh, kinda hate that after I just typed this) for the severity of information in hacks. All of this information listed is semi-public anyway. Birthdates/SSNs/private info I can understand getting up in arms about. But names and email addresses? Wait until younger folks hear about this giant book phone companies used to deliver that had nearly everyone's name and phone number in it!

layer8 4y ago
> What was the hack, scraping LinkedIn? I feel like we need some different language or a color-coded system for the severity of information in hacks. No, we just need to read the article.
- re-thc 4y ago
  Often the hardest part /s
tyingq 4y ago
They had access to a visitor management system, which may turn out to be fairly interesting. Not the crown jewels, but who is visiting, and how often can be sensitive.
IncRnd 4y ago
> In all seriousness, I feel like we need some different language or a color-coded system (ugh, kinda hate that after I just typed this) for the severity of information in hacks. There already is language for this, but what we often have on HN are people posting random and old links to online newpaper articles that don't convey enough information about the vulnerability, its root cause, or its effect. In this case, there isn't a vulnerability score, because there isn't a disclosed vulnerability or exploit. However, there may be some risk that people outside Atlassian are unaware. CVSS scoring is used in many places. There are calculators that score a vulnerability in the context of a base score, temporal score, or environmental score. [1] Here is NIST's NVD page. [2] At the bottom are some of the most recently scored vulnerabilities. If we search for Atlassian tagged vulnerabilities at the NVD site[3], we see that the most recent vulnerability, CVE-2023-26256[4], actually is ranked high at 7.5 on the v3.1 CVSS scoring. There is an actual description. Plus there are references to advisories/solutions/tools, the CWE, a listing of affected software configurations, and a change history. [1] https://www.first.org/cvss/calculator/3.1 https://www.first.org/cvss/calculator/3.1 [2] https://nvd.nist.gov/ https://nvd.nist.gov/ [3] https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=atlassian&search_type=all&isCpeNameSearch=false https://nvd.nist.gov/vuln/search/results?form_type=Basic&res... [4] https://nvd.nist.gov/vuln/detail/CVE-2023-26256 https://nvd.nist.gov/vuln/detail/CVE-2023-26256

VoidWhisperer 4y ago

The title of the post seems a little bit disingenuous - Atlassian themselves wasn't hacked, nor was the vendor that the data ended up coming from for that matter.. It was a case of an employee accidentally posting credentials for Atlassian's Envoy setup in a public repository, which they apparently use for in-office resources, hence why it has basic employee information and floor plans.

awill 4y ago
>> Atlassian themselves wasn't hacked...It was a case of an employee accidentally posting credentials for Atlassian's Envoy setup in a public repository It doesn't matter how credentials were leaked.
- shevis 4y ago
  Disagree. “Hack” typically implies malicious intent so it kind of does matter. “Leak” probably would have been more appropriate since this appears to have been the result of negligence rather than malice.
  - deleted 4y ago
    [deleted]
  - kodah 4y ago
    I have never in my life heard that hack comes with malicious intent. To me hacking is a generalized term for successful unauthorized computer system access.
    - shevis 4y ago
      After giving this some more thought I think you’re right. I would even broaden your definition to include using authorized access in ways that weren’t originally intended by the computer system’s designers. I was trying to distinguish between breaches that result from intentional exploitation (malicious or otherwise) and breaches that result from negligence. Having thought about it a bit more, these things are not actually mutually exclusive. Many intentional exploitations take advantage of dumb mistakes (e.g. posting credentials in a public repo). As such, I take back my earlier disagreement: this is a valid use of the word “hack”.

RomanPushkin 4y ago

Atlassian alternatives: https://bye-bye-server.com/ https://bye-bye-server.com/

deleted 4y ago

[deleted]

Zetice 4y ago

Their permissions system is a complete mess on their actual platform; if you create a support request it generates a Jira ticket, but depending on how access is set up, you may get access to the entire support "project" which means you can see other customer's support tickets (I'm being a little vague because I don't want to give the whole thing away, there is more to it than this, but I currently can see every open support ticket). Not at all surprised this happened, and more will invariably come.

tharkun__ 4y ago
That's like saying AWS's permissions system is a mess and depending on how you set it up you may get access to all of someone's S3 buckets ;)
- Zetice 4y ago
  It'd be more like if Amazon hosted customer support tickets in a heavily customized S3 bucket, but didn't lock that S3 bucket down.
  - tharkun__ 4y ago
    It's called an analogy. Systen A with permissions: Jira System B with permissions: AWS This is the only property the two systems used in the analogy are required to have. In fact they don't even need to have the exact same property. Of course more similarities between the two make the analogy closer to each other but that is not required. Obligatory - if somewhat far fetched - car analogy: Tesla's app is a complete mess! Depending on how you set up access, anyone with permissions to your car could just drive off with it!
    - Zetice 4y ago
      …what? Atlassian uses Jira (a product they own) to manage their support tickets, and they have not configured it to only allow the customer who created the ticket to access their ticket. The analogy is that Amazon is to AWS as Atlassian is to Jira.

c7DJTLrn 4y ago

The Atlassian engines stalled long ago but somehow they continue to defy gravity. Bitbucket is years behind GitHub. The last time I used it, it was extremely unreliable. Jira is an ugly and laggy mess. Confluence is crap. How are they still alive?

jagged-chisel 4y ago
Jira. Who else has the complexity of Jira?
- 1letterunixname 4y ago
  Phabricator fork we use is way more comprehensive and usable than JIRA.
- vxNsr 4y ago
  servicenow, asana, moday.com even
- chakintosh 4y ago
  Linear
tharkun__ 4y ago
Actually Github only recently gained one of the best features bitbucket has always had, which is a file explorer on the left in PRs. I have no idea how people could use Github without that. Now one thing that Github has is integration. You get lots of stuff integrated for free where Atlassian offerings are separate products. And you don't have to configure much. You can't compare Github to just bitbucket. You have to compare it to a combination of bitbucket, bamboo with Elastic agents and Jira. With a competent admin this is all easily set up and administered. And especially if you are a largish company Jira is the killer vs. Github issues. Especially if said company is somewhat process heavy which Jira is just the best at. So configurable and extensible. Of course a small startup or open source project will prefer the zero fuss Github. And of course as devs we don't care much about those parts. But you did ask why they are still alive.

tonfreed 4y ago

SiegedSec's announcement of it with the uwu buoys my spirit a little bit that the original irreverent hacker spirit isn't completely dead.