Prompt and competent response, as expected from bunny.
"Last week, one of our infrastructure providers reported unauthorized access involving third-party server management software. One of our CDN nodes, located in Armenia, was hosted on a server supplied by this provider.
After receiving the alert from the affected provider, our engineering team took immediate action. Within 20 minutes, we stopped routing traffic through the server. We then reviewed and preserved the relevant security logs for investigation, securely wiped the server, and revoked its access to our other systems. The affected server has been permanently removed from our infrastructure."
It looked like competent,but some of the events look really bad for the company. Especially the fact that TLS certificates that customers entrusted bunny now need to be revoked by the customers themselves. This detail was at the very last of the email I got and it was the only part I did not like, because it means customer secrets were indeed compromised. I hope they followed up with all the customers on revoking those certificates.
> No action is required from customers using managed certificates. We will post a further update on our status page once this process is complete.
> If you manage your own TLS certificates, we recommend revoking and reissuing them with new private keys as a precaution.
Only if you manage them yourself. If Bunny is managing them for you, they'll roll them for you.
> because it means customer secrets were indeed compromised.
It does not mean secrets were compromised. It means: If there is a risk customer secrets were compromised, the right thing to do is to assume they were and refresh everything. Even if there's no evidence of it.
> Especially the fact that TLS certificates that customers entrusted bunny now need to be revoked by the customers themselves. This detail was at the very last of the email I got and it was the only part I did not like, because it means customer secrets were indeed compromised.
It does not mean that at all, it’s sane risk management. There was an opportunity for someone to steal customer secrets so the safe thing to do is assume everything was compromised and revoke/reissue certificates even if nothing was stolen.
Someone who never should have been their vendor, due to closeness to Moscow. It's too bad, but I will probably look elsewhere.
https://news.ycombinator.com/item?id=50311862
it looks like they are doing automatic renewal of certificates, the only ones that customers have to do themselves is the ones the customers uploaded themselves
Which reads like the CA key got compromised - the customer's keys are fine
Bunny is not a CA and doesn’t have those keys.
no it reads as if all individual private keys got compromised, hence requesting custom ssls to be updated
> Prompt and competent response, as expected from bunny.
Call me pathologically unbiased, but I doubt this same article written by Cloudflare would get this response.
Cloudflare's incident response usually gets high praise from HN. Look at the remarkable lack of hate here:
https://news.ycombinator.com/item?id=45973709
At least the statement is not competently written.
They write that TLS certificates have potentially be exposed. That doesn't make sense. TLS certifcates are public. Probably they mean private server keys have been potentially be exposed. And after that the certificates are not only useless but dangerous (if the private is really in the hands of the attacker).
They write they have been revoked, OK. But they continue to be served until new ones are in place. Hmm? Well, no browser checks revocation anyway I guess.