3 ms·

> Based on the investigation, the attacker bypassed multiple layers of authentication and gained unauthorised access to an administrative panel provided by one

by shazow 11y ago

> Based on the investigation, the attacker bypassed multiple layers of authentication and gained unauthorised access to an administrative panel provided by one of our infrastructure providers. Sounds like a VPS provider screwed up? If that's the case, would love to know which one it was. :/

thaumaturgy 11y ago
They have a couple of subdomains hosted with AWS, in the us-west region looks like. Not really definitive, but AWS is common infrastructure for a lot of startups these days, and it wouldn't be the first time that someone managed to find their way into an AWS admin panel.
- deleted 11y ago
  [deleted]
- ryanlol 11y ago
  Linode seems like the more likely culprit here.
  - thaumaturgy 11y ago
    Given Linode's past history, I'd regrettably have to agree. I didn't see evidence of Linode infrastructure when I posted my earlier comment. It's frustrating that PagerDuty can't / won't share that information. I can't see how that's helping law enforcement's investigation, and it's potentially putting a lot of other people at risk depending on the nature and severity of the compromise.
fsaintjacques 11y ago
Or maybe they had a weak password for their administrative account@VPS?
cddotdotslash 11y ago
It does not immediately mean that. If it were AWS, there are ten thousand things PagerDuty could have done wrong: lost an access key, made an IAM role too permissive and lost access to the instance, turned off key-based ssh, made the ports open to the public, hard coded credentials, simply used a weak password for their console, not enabled TFA, lost the root credentials somewhere, allowed a privilege escalation by giving one key the ability to create more keys and attach permissions. The list goes on. Plug: I'm working on an open-source and hosted project called CloudSploit that can scan for these kinds of things. Check it out at https://cloudsploit.com https://cloudsploit.com

by shazow 11y ago

thaumaturgy 11y ago

They have a couple of subdomains hosted with AWS, in the us-west region looks like. Not really definitive, but AWS is common infrastructure for a lot of startups these days, and it wouldn't be the first time that someone managed to find their way into an AWS admin panel.

deleted 11y ago
[deleted]
ryanlol 11y ago
Linode seems like the more likely culprit here.
- thaumaturgy 11y ago
  Given Linode's past history, I'd regrettably have to agree. I didn't see evidence of Linode infrastructure when I posted my earlier comment. It's frustrating that PagerDuty can't / won't share that information. I can't see how that's helping law enforcement's investigation, and it's potentially putting a lot of other people at risk depending on the nature and severity of the compromise.

fsaintjacques 11y ago

Or maybe they had a weak password for their administrative account@VPS?

cddotdotslash 11y ago

It does not immediately mean that. If it were AWS, there are ten thousand things PagerDuty could have done wrong: lost an access key, made an IAM role too permissive and lost access to the instance, turned off key-based ssh, made the ports open to the public, hard coded credentials, simply used a weak password for their console, not enabled TFA, lost the root credentials somewhere, allowed a privilege escalation by giving one key the ability to create more keys and attach permissions. The list goes on. Plug: I'm working on an open-source and hosted project called CloudSploit that can scan for these kinds of things. Check it out at https://cloudsploit.com https://cloudsploit.com