Hacker News

points by SamyPesse 4 days ago | 0 comments

GitBook’s CTO here

We have been dealing with a security attack since yesterday. Our team has been all hands on deck since the start, and we took a large portion of our services offline to prioritize user security.

Our service is progressively coming back online (most of it already is), and we are actively monitoring the situation.

We’ll continue to actively keep our users updated through emails, Slack, and our status page as we monitor the situation and learn more.

[–] xmcp123 4 days ago

Nice to see someone not fucking up outreach during a security incident.

Good work.

[–] throwrioawfo 4 days ago

Did you read the body of this post?

[–] john_strinlai 4 days ago

>Nice to see someone not fucking up outreach

it is sort of funny to see this on a post submitted by a gitbook user that starts off by saying "We have yet to see any official customer communication or breach notification.", and where the company's status page (https://www.gitbookstatus.com/incidents/01M6FXDDGQRWHMYYWXY2...) doesn't mention the customer data that was potentially accessed by the attackers or mention that credentials/tokens should be rotated.

in fact, that status page (which is linked to at the top of the gitbook site) still says "You don’t need to do anything right now."

[–] michaelscott 2 days ago

Experienced this with a client as well, all my thoughts to you guys and the team. One thing we struggled with was determining the effective blast radius of compromised credentials. Blocking access was one thing, but the other critical component was whether activity could be reconstructed from independent logs (for this event and in future). Intereseted in whether the postmortem covers how you guys have established those boundaries, would make for some good learnings in general.

Feels like a new normal

[–] gkoberger 4 days ago

Good luck... this isn't easy, so best of luck to you and the team.

[–] gk1 4 days ago

Classy response.

With the spate of attacks on infra providers over the past few weeks, it's been interesting to see how different competitors respond. The confidence some of the founders seem to have that they won't/can't be next is telling.

[–] latchkey 4 days ago

After turning on 2FA, the page doesn't update to say it is turned on. It still has a configure button. Reloading the page fixes this.

[–] MrZander 4 days ago

> GitBook has been the target of a sophisticated, highly targeted attack using AI agents

Serious question: How do you know it was using AI agents? What logs distinguish it from a human?

I see this claim a lot and while I don't doubt AI is being used for this, I have a hard time believing every breach has a smoking gun showing it to be an AI assisted attack.

[–] ipsum2 4 days ago

My guess is the speed of exfiltration/exploration of the environment is probably impossible for a human, or even a small team. But I'm also curious what their evidence is.

[–] michaelscott 2 days ago

Generally the speed of breaking through components of the tech stack. They chain exploits and they move through the system at a rate that's far faster than even a team of humans could pull off

[–] conartist6 4 days ago

Maybe there was a level-of-stupidity tip-off, like trying to break in and access something that's already public...