Ouch -- Amazing how there is this ripple effect happening now that everone is using the cloud and there are so many middle men or service APIs.<p>> <i>In order to protect your data and users, we strongly urge you to secure each of these systems:</i><p><pre><code> > SSH keys uploaded to CircleCI
> API tokens stored in CircleCI env vars
> API/SSH key stored in a GitHub repo accessible from your CircleCI
</code></pre>
Interesting to note that Stripe and Kickstarter are customers. This is a little scary to think their source code could have been exposed, given the $$$ flowing through their systems. So, someone could have used these keys to have much wider access!
Now might be a good time for circleci customers to pick up a code analysis tool such as brakeman and look for obvious security holes in their apps. If the attackers have hundreds or thousands of web apps' source code, I'd expect them to start trawling for vulnerabilities with automated tools.
What happened between the 19th and the 28th? <a href="https://news.ycombinator.com/item?id=6638004" rel="nofollow">https://news.ycombinator.com/item?id=6638004</a><p><pre><code> Hi Justin. To clarify, from what I understand, October 28
is the date MongoHQ detected this. They've provided us
with the logs of database access, and unfortunately the
queries leading to our spam attack on Saturday started as
early as October 19.</code></pre>