Rendered at 16:39:13 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
SamyPesse 2 days ago [-]
GitBook’s CTO here
We have been dealing with a security attack since yesterday. Our team has been all hands on deck since the start, and we took a large portion of our services offline to prioritize user security.
Our service is progressively coming back online (most of it already is), and we are actively monitoring the situation.
We’ll continue to actively keep our users updated through emails, Slack, and our status page as we monitor the situation and learn more.
michaelscott 9 hours ago [-]
Experienced this with a client as well, all my thoughts to you guys and the team. One thing we struggled with was determining the effective blast radius of compromised credentials. Blocking access was one thing, but the other critical component was whether activity could be reconstructed from independent logs (for this event and in future). Intereseted in whether the postmortem covers how you guys have established those boundaries, would make for some good learnings in general.
Feels like a new normal
xmcp123 2 days ago [-]
Nice to see someone not fucking up outreach during a security incident.
Good work.
john_strinlai 2 days ago [-]
>Nice to see someone not fucking up outreach
it is sort of funny to see this on a post submitted by a gitbook user that starts off by saying "We have yet to see any official customer communication or breach notification.", and where the company's status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...) doesn't mention the customer data that was potentially accessed by the attackers or mention that credentials/tokens should be rotated.
in fact, that status page (which is linked to at the top of the gitbook site) still says "You don’t need to do anything right now."
throwrioawfo 2 days ago [-]
Did you read the body of this post?
gkoberger 2 days ago [-]
Good luck... this isn't easy, so best of luck to you and the team.
gk1 2 days ago [-]
Classy response.
With the spate of attacks on infra providers over the past few weeks, it's been interesting to see how different competitors respond. The confidence some of the founders seem to have that they won't/can't be next is telling.
MrZander 2 days ago [-]
> GitBook has been the target of a sophisticated, highly targeted attack using AI agents
Serious question: How do you know it was using AI agents? What logs distinguish it from a human?
I see this claim a lot and while I don't doubt AI is being used for this, I have a hard time believing every breach has a smoking gun showing it to be an AI assisted attack.
michaelscott 9 hours ago [-]
Generally the speed of breaking through components of the tech stack. They chain exploits and they move through the system at a rate that's far faster than even a team of humans could pull off
ipsum2 2 days ago [-]
My guess is the speed of exfiltration/exploration of the environment is probably impossible for a human, or even a small team. But I'm also curious what their evidence is.
conartist6 2 days ago [-]
Maybe there was a level-of-stupidity tip-off, like trying to break in and access something that's already public...
latchkey 2 days ago [-]
After turning on 2FA, the page doesn't update to say it is turned on. It still has a configure button. Reloading the page fixes this.
FastDeep 2 days ago [-]
Good that they rotated all the tokens themselves instead of just telling users to do it, seen too many incidents where that step gets skipped.
FearNotDaniel 1 days ago [-]
> sophisticated, highly targeted attack
I love the way all incident reports tell you the attack was sophisticated and highly targeted, as if those words actually mean anything. Nobody wants to admit they were DDOSed by a script kiddie just randomly trying exploits. The subtext is: well, we expected hackers; just not really good ones.
SamyPesse 1 days ago [-]
A quick update to this thread that the incident is resolved, and we'll be publishing a post-mortem in the next 24 hours covering what happened, the impact it had, what we did to resolve, and what'll we do next. You can get an update when this is out on GitBook status page.
I think the timing is perfect for someone to create a simple, clean, breach link aggregator site.
ahoog42 2 days ago [-]
I built this incident tracker a few years ago [1] but currently focus on SEC, State AG, and HHS posted incidents. There's a lot of noise if you go with news, blog, and company posts but I process them occasionally.
"GitBook has been the target of a sophisticated, highly targeted attack using AI agents."
Add it to the list, I guess.
nsoam 2 days ago [-]
Is this what they mean when they talk about accountability laundering?
Oh, you see, we had the best security ever, but they used AI agents, and there's no defence for that, you can't secure a system against those spooky AI agents.
SamyPesse 2 days ago [-]
This is not what we meant. We will be accountable and will post a complete post-mortem. But it’s important to understand that the attack was a lot more developed than what we’ve been used to with humans, especially in terms of pace and adaptability.
eichin 2 days ago [-]
For a lot of places, handling this kind of incident response was "eating your vegetables" preparation that has just in the last couple of months turned into "for me it was Tuesday"...
manytimesaway 2 days ago [-]
FYI, Gitbook was made by the team behing friendco.de, which they killed without any announcement years ago.
SamyPesse 2 days ago [-]
I’m genuinely sorry the end of friendco.de impacted you. It was 12-13 years ago; the service had little usage at the time, and we probably didn’t handle the end perfectly. I don’t recall exactly, but I can assure you that the team today is more experienced.
manytimesaway 2 days ago [-]
To be fair, I don't recall exactly the end of it either (I did not think it was that long ago!), but I remember being severely disappointed by the sudden disappearance of it (AFAIK I was trying to set it up inside a community project), and as such not trusting GitBook afterwards.
Thanks for the honest answer, nonetheless. Good luck with the incident.
viccis 2 days ago [-]
Not really relevant here.
altbdoor 2 days ago [-]
Mentioned this 5h ago, but this post definitely fleshes out more details.
Note that the summary at the top of https://www.gitbookstatus.com at time of writing does not mention the unauthorized access and the incident details does not mention the contents disclosed above.
tom1337 2 days ago [-]
What's happening currently that every other a day a major service is breached? Is it really just all AI Agents being blasted on those targets?
We have been dealing with a security attack since yesterday. Our team has been all hands on deck since the start, and we took a large portion of our services offline to prioritize user security.
Our service is progressively coming back online (most of it already is), and we are actively monitoring the situation.
We’ll continue to actively keep our users updated through emails, Slack, and our status page as we monitor the situation and learn more.
Feels like a new normal
Good work.
it is sort of funny to see this on a post submitted by a gitbook user that starts off by saying "We have yet to see any official customer communication or breach notification.", and where the company's status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...) doesn't mention the customer data that was potentially accessed by the attackers or mention that credentials/tokens should be rotated.
in fact, that status page (which is linked to at the top of the gitbook site) still says "You don’t need to do anything right now."
With the spate of attacks on infra providers over the past few weeks, it's been interesting to see how different competitors respond. The confidence some of the founders seem to have that they won't/can't be next is telling.
Serious question: How do you know it was using AI agents? What logs distinguish it from a human?
I see this claim a lot and while I don't doubt AI is being used for this, I have a hard time believing every breach has a smoking gun showing it to be an AI assisted attack.
I love the way all incident reports tell you the attack was sophisticated and highly targeted, as if those words actually mean anything. Nobody wants to admit they were DDOSed by a script kiddie just randomly trying exploits. The subtext is: well, we expected hackers; just not really good ones.
https://validator.w3.org/nu/?doc=https%3A%2F%2Fwww.gitbook.c...
And images that are 4x larger than necessary on the main page (nevermind whether the images add value to begin with):
https://webspeedtest.cloudinary.com/results/261104_YiDc1V_1W
There are maybe 10 websites that look good "inside and out" because web design is a broken field run by non-technical people.
The actual status page appears to be hosted on incident.io https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...
[1] https://www.board-cybersecurity.com/incidents/tracker
Add it to the list, I guess.
Oh, you see, we had the best security ever, but they used AI agents, and there's no defence for that, you can't secure a system against those spooky AI agents.
Thanks for the honest answer, nonetheless. Good luck with the incident.
https://news.ycombinator.com/item?id=50351061
Note that the summary at the top of https://www.gitbookstatus.com at time of writing does not mention the unauthorized access and the incident details does not mention the contents disclosed above.
"the attacker gained unauthorized access to some of our infrastructure credentials"
How? Which infrastructure?