alt Hacker NewsPrompt and competent response, as expected from bunny.
"Last week, one of our infrastructure providers reported unauthorized access involving third-party server management software. One of our CDN nodes, located in Armenia, was hosted on a server supplied by this provider.
After receiving the alert from the affected provider, our engineering team took immediate action. Within 20 minutes, we stopped routing traffic through the server. We then reviewed and preserved the relevant security logs for investigation, securely wiped the server, and revoked its access to our other systems. The affected server has been permanently removed from our infrastructure."
Replies
At least the statement is not competently written.
They write that TLS certificates have potentially be exposed. That doesn't make sense. TLS certifcates are public. Probably they mean private server keys have been potentially be exposed. And after that the certificates are not only useless but dangerous (if the private is really in the hands of the attacker).
They write they have been revoked, OK. But they continue to be served until new ones are in place. Hmm? Well, no browser checks revocation anyway I guess.
> Prompt and competent response, as expected from bunny.
Call me pathologically unbiased, but I doubt this same article written by Cloudflare would get this response.
It looked like competent,but some of the events look really bad for the company. Especially the fact that TLS certificates that customers entrusted bunny now need to be revoked by the customers themselves. This detail was at the very last of the email I got and it was the only part I did not like, because it means customer secrets were indeed compromised. I hope they followed up with all the customers on revoking those certificates.