"Grafana Labs disclosed that hackers broke into its development environment, exfiltrated a copy of its codebase, and demanded a ransom to prevent the code from being released. The company said no, and the codebase is already open source. Grafana’s statement on X confirmed that the attackers obtained a stolen token credential, which gave them access to the company’s GitHub environment used for code development. The token did not provide access to customer records, customer systems, or financial data."
"The mechanics are the part that matters. Grafana’s own statement on X confirmed that the attackers obtained a stolen token credential, which gave them access to the company’s GitHub environment, which Grafana uses for code development. The token did not, on the company’s account, provide access to customer records, customer systems, or financial data. The token has since been invalidated, and additional security controls have been layered on top."
"The Hacker News reports that the root cause was a recently enabled GitHub Action containing a 'Pwn Request' misconfiguration, in which a pull_request_target workflow granted external contributors access to production CI secrets, and that the intrusion was caught by one of Grafana’s deployed canary tokens, triggering an internal alert. The attackers, identified across Register and HelpNet coverage as a data-extortion group calling itself CoinbaseCartel, framed the leverage as a release-or-pay choice."
"Grafana cited the FBI’s long-standing advice that paying ransoms doesn’t guarantee you or your organization will get any data back, 'offers an incentive for others to get involved in this type of illegal activi'. The company’s response, in its own words: 'The attacker attempted to blackmail us, demanding payment to prevent the release of our codebase.'"
Hackers broke into Grafana’s development environment, exfiltrated a copy of its codebase, and demanded payment to prevent release. The codebase was already open source. The attackers used a stolen token credential to access Grafana’s GitHub environment used for code development. The token did not provide access to customer records, customer systems, or financial data. The token was invalidated and additional security controls were added. Reports attribute the intrusion to a misconfigured GitHub Action, where a pull_request_target workflow granted external contributors access to production CI secrets. The intrusion was detected by canary tokens that triggered an internal alert. The attackers, identified as CoinbaseCartel, framed the demand as release-or-pay blackmail, and Grafana refused payment citing FBI advice that ransom payments do not guarantee data recovery and incentivize further crime.
Read at TNW | Data-Security
Unable to calculate read time
Collection
[
|
...
]