The developers of the decentralized messaging platform Matrix announced an emergency shutdown of the Matrix.org and Riot.im servers (the main Matrix client) due to the hacking of the project's infrastructure. The first shutdown occurred last night, after which the servers were restored, and the applications were rebuilt from the reference source code. However, just minutes ago, the servers were compromised for a second time.
The attackers posted detailed information about server configuration and data indicating that they possess a database with hashes of almost five and a half million Matrix users. As proof, the hash of the password of the leader of the Matrix project was made publicly available. The altered code of the site has been uploaded to the attackers' repository on GitHub (not in the official matrix repository). Details about the second hacking are currently unavailable.
After the first hacking, the Matrix team published a report stating that the breach was carried out through a vulnerability in an outdated Jenkins continuous integration system. After gaining access to server the Jenkins environment, the attackers intercepted SSH keys and gained access to other servers in the infrastructure. It was reported that the source code and packages were not affected by the attack. The attack also did not impact Modular.im servers. However, the attackers gained access to the main DBMS, which contains, among other things, unencrypted messages, access tokens, and password hashes.
All users were instructed to change their passwords. However, during the password change process in the main Riot client, users encountered missing files with backup keys for restoring encrypted conversations and were unable to access their message history.
The Matrix platform for decentralized communications is presented as a project that utilizes open standards and places great emphasis on the security and privacy of its users. Matrix provides end-to-end encryption based on the proven Signal algorithm, supports search and unlimited viewing of message history, and can be used for file transfer, sending notifications, assessing developer presence online, organizing teleconferences, and making voice and video calls. It also supports advanced features such as typing notifications, read receipts, push notifications, server-side search, synchronization of history and client states, and various identifiers (email, phone number, Facebook account, etc.).
Source: opennet.ru
