⚽️ Matchday! ⚽️ BVB, Hectorians are with you! 🖤💛
We are sure our ticket giveaway winners will see an exciting match!
Hectorians, Yesterday it came to our attention that our servers were not functioning correctly, immediately diving deeper it became clear that we were the victim of a hack across several servers. We caught the hack in progress and while we were determining the extent of the damage several other servers were compromised.
Let us be very clear: no user funds or protocol funds are at risk or have been affected.
All reward distributions within the protocol go through a smart contract. The dApp is just an interface, there could be some delays from the lambda bot not connecting but it should all be stored in the smart contracts. We expect the rewards to be distributed correctly once we are live again.
Our delegated funds are safe on the blockchain. The target is infrastructure and validator servers with the express purpose of ransoming us for the key to release them. If we choose not to pay the ransom we can rebuild the servers internally but this is of course several days, if not weeks of work.
Hackers have found a vulnerability in the ESXi VMware servers, and were able to gain access and encrypt files. Only the files needed to run the EXSi servers were infected. This is problematic as it’s impossible to access data or even restart the servers without those files.
This probably has to do with a zero day vulnerability, below an explanation on this:
A zero-day vulnerability is a vulnerability in a system or device that has been disclosed but is not yet patched. An exploit that attacks a zero-day vulnerability is called a zero-day exploit.
Because they were discovered before security researchers and software developers became aware of them—and before they can issue a patch—zero-day vulnerabilities pose a higher risk to users for the following reasons:
- Cybercriminals race to exploit these vulnerabilities to cash in on their schemes
- Vulnerable systems are exposed until a patch is issued by the vendor.
Zero-day vulnerabilities are typically involved in targeted attacks; however, many campaigns still use old vulnerabilities.
Be assured that our infrastructure is updated daily to prevent running into these vulnerabilities. We are not the only server system that has been hit in the last several hours, indicating this is indeed a zero day vulnerability hack.
Unfortunately also our backup servers were infected with the ransomware. This prevents us from simply rebooting the systems ourselves. Either the ransom must be paid (risky, since there is no guarantee they will release the key once we’ve paid), or the servers will need to be rebuilt from scratch, a time consuming process, leaving aspects of our infrastructure offline for some time.
As soon as everything is back online again, we are going to take extra security measurements to ensure that we can always restore backups, no matter what happens.
Links to information about the way of hacking:
https://www.trendmicro.com/en_us/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.htmlhttps://unifiedguru.com/new-linux-based-ransomware-targets-vmware-servers/https://www.techtarget.com/searchsecurity/news/365529992/Horizon3ai-releases-POC-exploit-for-VMware-vulnerabilities
