[Resolved][Severity: Critical][Phishing][Credential abuse]

Classi: attackers used credentials phished from a developer to break into the school platform and leak the IDs and encrypted passwords of all 1.22 million users

Attackers phished a developer's GitHub login, used an AWS key found in the code to reach the database, and the IDs and encrypted passwords of all users later surfaced on a forum.

Disclosed

2020-04-13

Organizations involved

Leaked or at risk

1.2M

1,220,000

Downtime

Unknown

What happened

2020-04-05 13:30
A developer was phished and lost their GitHub credentials. The attacker took the service's source code from GitHub, along with an AWS access key with developer rights that was inside it. [4]
2020-04-05 14:06
With the stolen key, the attacker set up a server for the intrusion. [4]
2020-04-05 14:44
The attacker reset the database server password and got in. The change stopped the service, and an alert made staff aware of the problem. [4]
2020-04-05 16:19
After the audit logs showed outside activity, the misused key was disabled and the intruder's server was stopped. [4]
2020-04-05 16:48
To guard against a second attack, all servers were stopped until safety could be confirmed. [4]
2020-04-06 19:30
After talks with outside experts, the service reopened once a basic level of safety was judged to be in place. [4]
2020-04-13
The company disclosed that the IDs and encrypted passwords of all users may have been seen. [1] [2]
2020-07-24
An outsider reported that data that looked leaked had been posted on a foreign forum dealing in illegal information. [4]
2020-07-28
The data was removed from the forum. [4]
2020-07-30
The company confirmed the data had been stolen in the April intrusion and disclosed the leak. [3]
2021-05-11
The company published its first response and the security work done since. [4]

Impact

IDs and encrypted passwords of about 1,220,000 users, all users of the service, and 2,031 public self-introductions written by teachers leaked. Users whose ID is an email address were warned to watch for suspicious mail. [1] [2] [3]

The forum claimed about 10 million records. The company said this was the 1.22 million current users plus about 8.9 million expired, demo and unused system-generated accounts. [4]

Cause and response

Multi-factor authentication was in use, but defenses against suspicious sites were weak, so the credentials were phished. An AWS key had been left in the source code. [4]

All user passwords were changed. The key was removed from the code and reissued with narrower rights. The company added GitHub access limits with single sign-on, checks that stop keys entering code, and alerts on database password changes. [3] [4]