Untitled

Received-SPF: pass (google.com: domain of support@gitlab.com designates 192.161.153.72 as permitted sender) client-ip=192.161.153.72;
Auto-Submitted: auto-generated
Content-Transfer-Encoding: 7bit
Content-Type: multipart/alternative; boundary="--==_mimepart_5c5dc9a29515b_db943fa2ae2bcf601060bc"; charset=utf-8
Date: Fri, 08 Feb 2019 18:25:38 +0000
From: "Security Team (GitLab Support)" <support@gitlab.com>
In-Reply-To: <CAAjerbKo1JZuVtV_Onc3WupGG4orKAbT=3Pt0rKC3_+BhkUKzg@mail.gmail.com> <XZVE8Z2GDO_5c5d76ff9d272_1712e3ffb77ebcf5088618_sprut@zendesk.com>
Message-Id: <XZVE8Z2GDO_5c5dc9a2ee37_db943fa2ae2bcf601059cf_sprut@zendesk.com>
Mime-Version: 1.0
References: <XZVE8Z2GDO@zendesk.com> <XZVE8Z2GDO_5c5d76ffa8c1c_1e5883fdae68bcf582693d0_sprut@zendesk.com> <XZVE8Z2GDO_5c5d74793b54d_fe6f3f97414bcf5427294f_sprut@zendesk.com> <XZVE8Z2GDO_5c57c44dea19c_32793feeb3cbcf501560d5_sprut@zendesk.com> <XZVE8Z2GDO_5c57d0be4803d_d2dd3fe6ef2bcf58799b9_sprut@zendesk.com> <CAAjerbKo1JZuVtV_Onc3WupGG4orKAbT=3Pt0rKC3_+BhkUKzg@mail.gmail.com> <CAB64wYHKyj27nLtR_LBPijz5onvzd2kXC9j5wYzK8if0quQBUg@mail.gmail.com>
Reply-To: GitLab Support <support@gitlab.com>
Subject: [GitLab, Inc.] Re: compromised account
To: Dave Murphy <davem@devkitpro.org>

----==_mimepart_5c5dc9a29515b_db943fa2ae2bcf601060bc
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

##- Please type your reply above this line -##

Your request (113388) has been updated. To add additional comments, reply t=
o this email.
----------------------------------------------

Security Team, Feb 8, 13:25 EST

Hi Dave

My name is Paul Harrison, the Senior Security Engineer who investigated thi=
s incident.  I'm sorry for the delayed investigation and response, =
and I am now leading an effort to improve the end-to-end handling of securi=
ty engagements so these delays don't occur in the future.

Here is my assessment of the events to answer your questions as best as pos=
sible, some were mentioned by Tom Atkins prior:

- The attacker was seen making a single login attempt, which was successful=
, at 20:23 UTC.

By having no failed attempts and immediately succeeding this would imply th=
e attacker had prior knowledge of the password obtained from another source=
 such as a website/database breach or phishing attack.  Additionally, witho=
ut two-factor authentication being enabled on the account there were no oth=
er barriers to prevent access.

- The password change was performed almost immediately following the succes=
sful login, also at 20:23 UTC.

The password change procedure in GitLab requires the user to enter the exis=
ting password in addition to entering the new password in duplicate.  This =
is to prevent many forms of account takeovers but unfortunately ineffective=
 when the attacker has knowledge of the existing password.

We will investigate ways to improve the password change notification to inc=
lude functionality such as the ability to disable access to an account or a=
 means of urgently notifying us of an issue, as I agree that while the emai=
l notice is valuable it does not provide you with much recourse.  Unfortuna=
tely in this specific circumstance these two suggestions, or the one you pr=
ovided to prevent the change, would not have been adequate to prevent or mi=
tigate the incident due to the delay between the event and when you saw the=
 notice as well as the attackers knowledge of the existing password.

- Between 20:23 UTC and 20:49 UTC the attacker accessed, downloaded, and de=
leted many (if not all) repos while logged in as WinterMute.

I can confirm the attacker downloaded archives of the following projects un=
der WinterMute and devkitpro prior to deleting them.  We are unable to rest=
ore these projects.

<redacted>

We have retained audit and application logs of this event however as they m=
ay contain personal data of third parties we are unable to release this inf=
ormation without a court order or subpoena.

As Tom mentioned in his previous email we recommend all users to use strong=
, unique, passwords and enforce two-factor authentication on all online acc=
ounts.  Had 2FA been enabled the attacker could not have accessed this acco=
unt.

Please let me know if you have any additional questions or comments.

Thank you,
Paul Harrison
Senior Security Engineer, Security Operations | GitLab, Inc.

Security Team
GitLab, Inc.

----------------------------------------------