An analysis of the Internet Archive's data breach via exposed GitLab tokens, compromising user data and personal IDs, highlighting security lapses.
Continue reading
The Internet Archive, a cornerstone of digital preservation, has experienced another significant data breach. This time, the breach occurred through their Zendesk email support platform after threat actors exploited exposed GitLab authentication tokens.
Despite prior warnings, the organization failed to rotate these tokens adequately, leading to unauthorized access to sensitive data.
Beginning last night, numerous individuals reported receiving unexpected emails in response to old support tickets submitted to the Internet Archive. These emails, originating from the organization's official Zendesk server, alerted users to the breach:
>>> _"It's dispiriting to see that even after being made aware of the breach weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their gitlab secrets. As demonstrated by this message, this includes a Zendesk token with perms to access 800K+ support tickets sent to [email protected] since 2018."_
The threat actor emphasized the magnitude of the breach, highlighting access to over 800,000 support tickets submitted since 2018. The authenticity of these emails was verified through email headers that passed all DKIM, DMARC, and SPF authentication checks, confirming they were sent from an authorized Zendesk server.
Compounding the severity of the breach, some users had previously uploaded personal identification documents when requesting the removal of content from the Wayback Machine. Depending on the level of access the threat actor had within Zendesk, these sensitive attachments might now be compromised.
*Email snapshot sent by threat actor to Internet Archive Zendesk (Source: BleepingComputer)*
The Zendesk Attachments API allows users to upload files to support tickets, which are then accessible through links in the agent interface and notification emails. Attachments are represented as JSON objects containing details like file_name, content_type, and content_url. If the threat actor exploited this API, they could have downloaded personal documents submitted by users.
BleepingComputer attempted repetatively to warn the Internet Archive about the exposed GitLab authentication tokens. On October 9th, they reported that the Internet Archive suffered two simultaneous attacks:
While these attacks transpired concurrently, they were perpetrated by different threat actors. Misreporting led many to incorrectly attribute the data breach to SN_BlackMeta, frustrating the actual hacker who then reached out to Secure Blink to claim responsibility and provide details.
*Data Breach Notification on Internet Archive JavaScript Alert (Source: BleepingComputer)*
The initial point of compromise was an exposed GitLab configuration file on one of the Internet Archive's development servers (services-hls.dev.archive.org). This file contained an authentication token that had been exposed since at least December 2022. The threat actor used this token to download the Internet Archive's source code.
*Internet Archive Exposed GitLab Authentication Token (Source: BleepingComputer)*
Within the source code, additional credentials and authentication tokens were discovered, including those for the organization's database management system. This access allowed the hacker to:
Modify the website. The threat actor claims to have exfiltrated 7TB of data, though no samples were provided for verification. The inclusion of API access tokens for the Internet Archive's Zendesk support system in the stolen data further exacerbated the situation.
Negligence in Security Practices
Despite multiple warnings from Secure Blink, the Internet Archive failed to rotate the compromised authentication tokens promptly. The threat actor highlighted this negligence in their communication:
>> _"Whether you were trying to ask a general question, or requesting the removal of your site from the Wayback Machine, your data is now in the hands of some random guy. If not me, it'd be someone else."_
This statement attempts to underscores the critical importance of proactive security measures and timely responses to potential threats.
The Zendesk Attachments API is designed to facilitate the uploading and attaching of files to support ticket comments. Key functionalities include:
Given the potential sensitivity of the uploaded files (e.g., personal IDs), unauthorized access to these attachments poses a significant privacy risk. The API documentation specifies that while files are visible to any authenticated user until the upload token is consumed, once associated with a ticket, visibility is restricted. However, in this breach, the threat actor's access to the Zendesk platform could bypass these restrictions.
The breach has several profound implications:
The Internet Archive's data breach is not just a stark reminder of the vulnerabilities that can arise from lapses in security protocols. In an era where data is a critical commodity, both organizations and users must remain super weary. Proactive security measures, timely response to threats, and user education are critical components in safeguarding against such breaches.
Millions of driver's license records were exposed in a massive data breach, raising identity theft risks and highlighting critical data security failures.
