OneBookShelf, DMsGuild security breach update.

[darjr]

In dealing with this security breach, we learned that the hack was instigated by a “white-hat” hacker who had not followed proper protocols.

Details

The hacker found a PDO buffer overflow vulnerability that caused a SQL query to be truncated in a way that altered the price of all titles instead of just one.

The hacker also uncovered a vulnerability in a particular publisher-facing tool that would let a user enable or disable any title on site.

No customer or publisher data was accessed or compromised.

I can’t seem to find the original thread, for some reason. If some kind forumite who has it would post it here I’d appreciate it.

 

[Alzrius]

I can’t seem to find the original thread, for some reason. If some kind forumite who has it would post it here I’d appreciate it.

Here you go:

One Bookshelf hacked "no evidence that any customer account data was compromised"

Regardless of headline, probably best practice to update DriveThru and DMs Guild passwords.

www.enworld.org

 

[Bravesteel25]

I'd be interested to know if that white hat was brought in by One Book Shelf to do penetration testing. If so, it's strange that they didn't do the penetration test on the test version of the site that I'm sure they have.

 

[Daraniya]

a 'white hat' hacker is not someone who fails to follow disclosure protocols...

Signed,
25 years in infosec

P.S. Change your passwords, especially if you use that password on other sites... typical PR response is to state "no customer data was accessed". you can bet your a** that customer data was probably accessed and we'll see an update once they do a full accounting of the extent of the breach. Also, regenerate your API keys if you're using the local desktop App...

 

[darjr]

a 'white hat' hacker is not someone who fails to follow disclosure protocols...

Signed,
25 years in infosec

P.S. Change your passwords, especially if you use that password on other sites... typical PR response is to state "no customer data was accessed". you can bet your ass that customer was probably accessed and we'll see an update once they do a full accounting of the extent of the breach. Also, regenerate your API keys if you're using the local desktop App...

I have a lot of trust for Drivethru but this is a good idea regardless, change your passwords and do not reuse em. I have zero trust for their breacher.

 

[Daraniya]

Also not happy that I'm finding out about the breach today, 14ish days after the fact. They should be notifying people via email, even if the breach 'did not affect customer data'.

 

[Daraniya]

I have a lot of trust for Drivethru but this is a good idea regardless, change your passwords and do not reuse em. I have zero trust for their breacher.

Would like to see them implement some additional security, like OAuth logins (google/apple/microsoft logins) and/or 2FA capabilities. Some of us have several thousand dollars of merchandise in there and would be painful or impossible to recover if lost.

 

[darjr]

Would like to see them implement some additional security, like OAuth logins (google/apple/microsoft logins) and/or 2FA capabilities. Some of us have several thousand dollars of merchandise in there and would be painful or impossible to recover if lost.

I can’t agree more.