Atlassian's Hipchat Hacked — Users' Information May Convey Been Compromised

Atlassian's grouping chat platform HipChat is notifying its users of a information breach afterward some unknown hacker or grouping of hackers broke into 1 of its servers over the weekend in addition to stole a pregnant sum of data, including grouping chat logs.

What Happened?

According to a security notice published on the company's website today, a vulnerability inwards a "popular third-party" software library used past times its HipChat.com service allowed hackers to intermission into its server in addition to access client concern human relationship information.

However, HipChat did non nation just which programming blunder the hackers exploited to larn into the HipChat cloud server.

What type of Information?

Data accessed past times the hackers include user concern human relationship information such equally customers' names, e-mail addresses in addition to hashed password information.

Besides information, attackers may direct maintain obtained metadata from HipChat "rooms" or groups, including room lift in addition to room topic. While metadata is non equally critical equally direct messages, it's nonetheless plenty to position information that's non intended to live on public.

Worse yet, the hackers may too direct maintain stolen messages in addition to content inwards chat rooms, simply inwards a small-scale issue of instances (about 0.05%). There has been no sign that over 99% of users' messages or room content was compromised.

Fortunately, there's no bear witness that the attackers direct maintain accessed anyone's credit bill of fare or fiscal information.

Who are non affected?

HipChat users non connected to the affected third-party software library are non affected past times the information breach.

Other Atlassian properties too are safe, equally the fellowship claimed that at that spot is no bear witness to suspect that other Atlassian systems or products similar Jira, Confluence, or Trello direct maintain been affected past times the hack.

To Worry or Not to Worry?

There's no bespeak to panic, equally the passwords that may direct maintain been exposed inwards the breach would too live on hard to crack.

Atlassian Chief Security Officer Ganesh Krishnan noted that HipChat hashes all passwords using the bcrypt cryptographic algorithm, alongside a random salt.

The information is hashed alongside bcrypt, which transforms the passwords into a develop of random-looking characters, in addition to makes the hashing procedure in addition to thus irksome that it would literally accept centuries to brute-force all of the HipChat concern human relationship passwords.

For added security, HipChat too "salted" each password alongside a random value earlier hashing it, adding additional protection against possible decryption.

However, information breaches similar this are made worse past times the fact that at that spot direct maintain been in addition to thus many breaches prior to it, in addition to secondly, that bulk of users brand purpose of the same or similar passwords for their multiple accounts.

So, it doesn't accept much for hackers to cross reference a user's username or e-mail address inwards a database from a previous breach in addition to respect an former password, placing users at greater adventure of a hack.

How Many victims?

HipChat did non nation how many users may direct maintain been affected past times the incident, simply the fellowship is taking several proactive steps to secure its users.

What is HipChat doing?

As a precaution, HipChat has invalidated passwords on all potentially affected HipChat-connected accounts, in addition to emailed password reset instructions, forcing every user to reset their concern human relationship password.

The fellowship is too attempting to rails downward in addition to cook the safety vulnerability inwards the third-party library used past times its service that allowed for the breach.

In reply to the attack, the fellowship is too updating its HipChat Server that volition live on shared alongside its customers direct through the criterion update channel.

HipChat has too isolated the affected systems in addition to unopen whatsoever unauthorized access.

HipChat rear fellowship Atlassian is too actively working alongside police line enforcement on the investigation of this matter.

What Should You Do Now?

For the Obvious reasons, all HipChat customers are highly recommended to modify their passwords equally shortly equally possible.

You should too especially live on warning of the Phishing emails, which are unremarkably the adjacent stride of cyber criminals afterward a breach. Phishing is designed to fob users into giving upwards farther details similar passwords in addition to banking concern information.

Share This :