Encrypted Messaging Project “Matrix” Suffers Extensive Cyber Attack

Apr 12, 2019

Matrix—the organization behind an open source project that
offers a protocol for secure and decentralized real-time
communication—has suffered a massive cyber attack after unknown
attackers gained access to the servers hosting its official website
and data.

Hackers defaced Matrix’s website, and also stole unencrypted
private messages, password hashes, access tokens, as well as GPG
keys the project maintainers used for signing packages.

The cyber attack eventually forced the organization to shut down
its entire production infrastructure for several hours and log all
users out of Matrix.org.

So, if you have an account with Matrix.org service and do not
have backups of your encryption keys or were not using server-side
encryption key backup, unfortunately, you will not be able to read
your entire encrypted conversation history.

Matrix is an open source end-to-end encrypted messaging protocol
that allows anyone to self-host a messaging service on their own
servers, powering many instant messengers, VoIP, WebRTC, bots and
IoT communication.

Vulnerable Jenkins Allowed Attackers to Access Server

According to a press release ^[1] published today by
Matrix Project, unknown attackers exploited a sandbox bypass
vulnerability in its production infrastructure on 4th April that
was running on an outdated, vulnerable version of Jenkins
automation server.

The Jenkins flaw allowed attackers to steal internal SSH keys,
which they used to access Matrix’s production infrastructure,
eventually granting them access to unencrypted content, including
personal messages, password hashes, and access tokens.

Screenshot Credit: David ^[2]
on Twitter

After being informed of the vulnerability by JaikeySarra ^[3] on 9th April, Matrix.org
identified the full scope of the attack and removed the vulnerable
Jenkins server as well as revoked the attacker’s access from its
servers on 10th April.

The next day, Matrix.org also took its home server down and
started rebuilding its production infrastructure from scratch,
which has now been back online.

Today at around 5 am UTC, the attackers behind the cyber attack
also managed to repoint DNS for matrix.org to a defacement website
hosted on GitHub using a Cloudflare API key, which was compromised
in the attack and theoretically replaced during the rebuild.

Since the latest defacement confirms that the stolen encrypted
password hashes were exfiltrated from the production database,
Matrix.org forced to log out all users and strongly advised them to
change their passwords immediately.

“This was a difficult choice to make. We weighed the risk of some
users losing access to encrypted messages against that of all
users’ accounts being vulnerable to hijack via the compromised
access tokens,” the company says.

“We hope you can see why we made the decision to prioritize account
integrity over access to encrypted messages, but we’re sorry for
the inconvenience this may have caused.”

The company also confirms that the GPG keys used for signing
packages were also compromised, but fortunately, the attackers did
not use it to release malicious versions of the software signed
with the stolen keys.

Matrix project assures that both keys have now been revoked.

The maintainers of the project also say they will shortly start
emailing all affected users to inform them about the incident and
advise them to change their passwords.

References

^{^}
press release
(matrix.org)
^{^}
David
(twitter.com)
^{^}
JaikeySarra
(twitter.com)

The Hacker News Headlines

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

Aug 18, 2023

The Hacker News Headlines

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

Aug 18, 2023

The Hacker News Headlines

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

Aug 18, 2023

OWASP TOP !0

Injection. Injection flaws, such as SQL, NoSQL, OS, and LDAP injection, occur when untrusted data is sent to an interpreter as part of a command or query. The attacker’s hostile data can trick the interpreter into executing unintended commands or accessing data without proper authorization. Broken Authentication. Application functions related to authentication and session management are often implemented incorrectly, allowing attackers to compromise passwords, keys, or session tokens, or to exploit other implementation flaws to assume other users’ identities temporarily or permanently. Sensitive Data Exposure. Many web applications and APIs do not properly protect sensitive data, such as financial, healthcare, and PII. Attackers may steal or modify such weakly protected data to conduct credit card fraud, identity theft, or other crimes. Sensitive data may be compromised without extra protection, such as encryption at rest or in transit, and requires special precautions when exchanged with the browser. XML External Entities (XXE). Many older or poorly configured XML processors evaluate external entity references within XML documents. External entities can be used to disclose internal files using the file URI handler, internal file shares, internal port scanning, remote code execution, and denial of service attacks. Broken Access Control. Restrictions on what authenticated users are allowed to do are often not properly enforced. Attackers can exploit these flaws to access unauthorized functionality and/or data, such as access other users’ accounts, view sensitive files, modify other users’ data, change access rights, etc. Security Misconfiguration. Security misconfiguration is the most commonly seen issue. This is commonly a result of insecure default configurations, incomplete or ad hoc configurations, open cloud storage, misconfigured HTTP headers, and verbose error messages containing sensitive information. Not only must all operating systems, frameworks, libraries, and applications be securely configured, but they must be patched/upgraded in a timely fashion. Cross-Site Scripting XSS. XSS flaws occur whenever an application includes untrusted data in a new web page without proper validation or escaping, or updates an existing web page with user-supplied data using a browser API that can create HTML or JavaScript. XSS allows attackers to execute scripts in the victim’s browser which can hijack user sessions, deface web sites, or redirect the user to malicious sites. Insecure Deserialization. Insecure deserialization often leads to remote code execution. Even if deserialization flaws do not result in remote code execution, they can be used to perform attacks, including replay attacks, injection attacks, and privilege escalation attacks. Using Components with Known Vulnerabilities. Components, such as libraries, frameworks, and other software modules, run with the same privileges as the application. If a vulnerable component is exploited, such an attack can facilitate serious data loss or server takeover. Applications and APIs using components with known vulnerabilities may undermine application defenses and enable various attacks and impacts. Insufficient Logging & Monitoring. Insufficient logging and monitoring, coupled with missing or ineffective integration with incident response, allows attackers to further attack systems, maintain persistence, pivot to more systems, and tamper, extract, or destroy data. Most breach studies show time to detect a breach is over 200 days, typically detected by external parties rather than internal processes or monitoring.

Encrypted Messaging Project “Matrix” Suffers Extensive Cyber Attack

Vulnerable Jenkins Allowed Attackers to Access Server

References

Related Post

New Apple iOS 16 Exploit Enables Stealthy Cellular Access Under Fake Airplane Mode

China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

You missed

Protected: Rotary VI EAST

Protected: BetterCyberCareer Group

Protected: Benin Club 1931 – Official

Protected: Whatsapp AI Automation Group