Canva網站遭受網路攻擊

Canva團隊在2019/5/30寄來一封信件， 2019 年 5 月 24 號時，Canva團隊系統遭受網路攻擊。

點圖放大 ↓：

Canva的團隊正不眠不休地嘗試解決此問題：





此事件的 FAQ 頁面： https://support.canva.com/contact/customer-support/may-24-security-incident-faqs/
原文：

Canva Security Incident – May 24 FAQs Incident Status Update Page Updated June 1, 10:13 AEST Following an investigation with cyber security experts, we now have a better understanding of the impact of the attack and want to provide as much context as we can to our community. On Friday 24th May 2019, we detected a malicious attack on our systems, which we stopped as it was occurring. Our first response was to lock down Canva, then notify authorities and users that the breach had occurred. Because the intruder was interrupted mid-attack they also took a different tactic to most security incidents and tweeted about the attack, which required a rapid communication response. Since then we have worked with cyber security experts and authorities, such as the FBI, to help protect our users, and are communicating the latest information below. What did the attacker do? They accessed information from our profile database for up to 139 million users. The profile database contains usernames, names, email addresses, country, and optionally, user-supplied data about their city and/or homepage URL which was available through their public profile. They accessed cryptographically protected passwords (these were individually salted and hashed with bcrypt) for any of those users with username/password logins. They claimed to have obtained OAuth login tokens for users who signed in via Google. Our OAuth tokens are encrypted with AES128 and the encryption keys are securely stored elsewhere. We have found no evidence they downloaded the OAuth tokens or tried to access the keys. They briefly viewed files with partial credit card and payment data. We found no evidence these files were stolen. Files contained partial credit card data from before September 28, 2016 (name, expiry date, last 4 digits, card brand and card country), and payment histories from before September 16, 2017 that contained transaction dollar amounts, dates, and IDs for some payments for users and contributors. These limited card details cannot be used for payments. Canva never stores full credit card details. Designs and images are securely stored in seperate systems. There has been no indication that any user designs or images have been accessed. What is Canva doing about it? We continue to invest heavily in security. We intend to publish a technical post mortem of the incident once our investigations are complete. Our first priority, though, is to protect our users. Here’s what we’re doing: Notifying our users: We want our users to know that they’ve been affected. We’ve directly contacted users via email, but some users have out-of-date or incorrect email details so we have also used in-app notifications and the press to alert users to the breach. We are following up on our initial notification with individual emails to each user outlining what data was accessed. Prompting users to change passwords: We’ve asked all users who had passwords set before the attack to change them, and are adding rules to help users set stronger ones. Resetting OAuth tokens: We’ve worked with our partners to make sure all active login tokens that existed prior to the breach are reset. These users will be prompted to reconnect their Canva account. Coordinating with partners: We are working with partner agencies to share information about the attack, identify the risk to users, and coordinate responses. For example, we’re alerting the email abuse teams of major providers to make it harder for attackers to phish our users. Partnering with 1Password: While we recommend that our users use different passwords for each site they use, we know that’s hard. We have partnered with 1Password to offer a year free to Canva users who don’t already use their service. What can Canva users do? Change your password: If you have a password on Canva and haven’t done so already, we are recommending that everyone change their password on Canva [https://www.canva.com/account/reset/], and if you used the same password on other sites you should change those too. Report suspicious emails: As a precaution, we’re encouraging everyone to be wary of suspicious emails. Attackers often use creative methods to trick you into handing over your personal information. If you do receive any emails that you believe are suspicious, do not click on them and do not respond. We encourage you to flag them with your email provider. Use a password manager: We recommend you use a password manager such as 1Password or Google Chrome to generate and remember a unique, secure password for each site you use. Update your Google/Facebook login if we’ve disconnected it: If you sign in using Facebook or Google we may have reset your login. Just login again to get back into your Canva account. Update your contact details: Once you have logged in to Canva, please add or update your contact details so we can always contact you about your account. A final word We are deeply sorry that this has happened. Everyone at Canva has been on the receiving end of updates like this, and at a personal level we know how upsetting it can be. We want to rebuild and regain the trust you have given us, and will work hard to earn it. Sebastian Welsh Head of Security, Canva

此事件的 FAQ 頁面： https://support.canva.com/contact/customer-support/may-24-security-incident-faqs/
翻譯：

Canva安全事件 - 5月24日常見問題解答 事件狀態更新 Page 6 6月1日，10：13 AEST 在對網絡安全專家進行調查後，我們現在可以更好地了解攻擊的影響，並希望盡可能多地為我們的社區提供上下文。 在2019年5月24日星期五，我們發現了對我們系統的惡意攻擊，我們在系統發生時就停止了攻擊。我們的第一反應是鎖定Canva，然後通知當局和用戶發生了違規行為。由於入侵者在攻擊中被中斷，他們對大多數安全事件採取了不同的策略，並在推特上發布了攻擊，這需要快速的通信響應。 從那時起，我們與網絡安全專家和權威機構（如FBI）合作，以幫助保護我們的用戶，並在下面傳達最新信息。 攻擊者做了什麼？ 他們從我們的個人資料數據庫中訪問了多達1.39億用戶的信息。配置文件數據庫包含用戶名，姓名，電子郵件地址，國家/地區以及可選的用戶提供的有關其城市和/或主頁URL的數據，這些數據可通過其公開個人資料獲得。 對於使用用戶名/密碼登錄的任何用戶，他們訪問了加密保護的密碼（這些密碼都是單獨加鹽並用bcrypt進行哈希處理）。 他們聲稱已經通過Google 登錄的用戶獲得了OAuth登錄令牌。我們的OAuth令牌使用AES128加密，加密密鑰安全地存儲在其他位置。我們沒有發現他們下載OAuth令牌或試圖訪問密鑰的證據。 他們用部分信用卡和付款數據簡要查看了文件。我們沒有發現這些文件被盜的證據。某些文件包含2016年9月28日之前的部分信用卡數據（姓名，有效期，最後4位數，卡品牌和卡國家），以及2017年9月16日之前包含交易金額，日期和ID的付款歷史記錄用戶和貢獻者的付款。這些有限的信用卡詳細信息不能用於付款。Canva從不存儲完整的信用卡詳細信息。 設計和圖像安全地存儲在單獨的系統中。沒有跡象表明已經訪問過任何用戶設計或圖像。 Canva在做什麼呢？ 我們繼續大力投資安全。一旦我們的調查完成，我們打算發布事件的技術驗屍報告。但是，我們的首要任務是保護我們的用戶。這是我們正在做的事情： 通知我們的用戶：我們希望我們的用戶知道他們已經受到影響。我們通過電子郵件直接與用戶聯繫，但有些用戶的電子郵件詳細信息已過時或不正確，因此我們還使用了應用內通知和新聞來提醒用戶注意違規行為。我們正在跟進我們的初始通知，並向每個用戶發送單獨的電子郵件，概述訪問的數據。 提示用戶更改密碼：我們已經要求所有在攻擊前設置了密碼的用戶更改密碼，並添加規則以幫助用戶設置更強的密碼。 重置OAuth令牌：我們與合作夥伴合作，確保在重置之前存在的所有活動登錄令牌都已重置。系統將提示這些用戶重新連接其Canva帳戶。 與合作夥伴協調：我們正在與合作夥伴機構合作，共享有關攻擊的信息，識別用戶的風險並協調響應。例如，我們警告主要提供商的電子郵件濫用團隊，以使攻擊者更難攻擊我們的用戶。 與1Password合作：雖然我們建議用戶為他們使用的每個網站使用不同的密碼，但我們知道這很難。我們與1Password合作，為尚未使用其服務的Canva用戶免費提供一年。 Canva用戶可以做些什麼？ 更改密碼：如果您在Canva上有密碼但尚未使用密碼，我們建議所有人在Canva上更改密碼[ https://www.canva.com/account/reset/ ]，如果您使用過在其他網站上你也應該更改相同的密碼。 報告可疑電子郵件：作為預防措施，我們鼓勵大家警惕可疑電子郵件。攻擊者經常使用創造性的方法誘騙您移交您的個人信息。如果您收到任何您認為可疑的電子郵件，請不要點擊它們，也不要回复。我們建議您使用電子郵件提供商進行標記。 使用密碼管理器：我們建議您使用密碼管理器（如1Password或Google Chrome）為您使用的每個站點生成並記住唯一的安全密碼。 如果我們已斷開連接，請更新您的Google / Facebook登錄信息：如果您使用Facebook或Google登錄，我們可能會重置您的登錄信息。只需再次登錄即可返回您的Canva帳戶。 更新您的聯繫方式：登錄Canva後，請添加或更新您的聯繫方式，以便我們隨時與您聯繫以了解您的帳戶。 最後一句話 我們對此事感到非常抱歉。Canva的每個人都在這樣的更新的接收端，並在個人層面，我們知道它是多麼令人沮喪。我們希望重建並重新獲得您給予我們的信任，並將努力工作以獲得它。 塞瓦斯蒂安威爾士 ，Canva安全負責人