Apify breached: attackers used a stolen credential to reach customer accounts
Apify Was Hacked
On November 9 and 10, an unauthorized third party used a compromised credential to obtain account credentials and access related Apify accounts. Apify detected the activity on November 11, cut off the access path, and says it has seen no further attacker activity since. It has revoked some OAuth connections, rotated critical internal secrets, notified authorities, and is emailing affected customers directly; a post-mortem will follow.
On 9 and 10 November, an unauthorized third party used a compromised credential to obtain a number of account credentials and accessed related Apify accounts.
- gnabgib
Bleeping Computer's coverage is maybe a bit more detailed Apify rotates API tokens, prompts 2FA resets after breach (https://www.bleepingcomputer.com/news/security/apify-rotates...)
- tptacek
Duplicate, also editorialized title.
- TZubiri
I feel like an asshole posting a criticism of the whole dependency category every time they get a critical vuln.
But if you are building an API service, you don't need an API Management dependency. And it's an additional attack vector. You (as in an engineer or as a company that provides an API service) need to do the actual undelegable job of building an API, just do the work, do the HTTP server, do the rate limiting, do the OAuth integration.
Verdict: Time to uninstall software in the category of API Management. That is, if you want to be the very best. If you want to be mediocre, sure use some middleware that provides API, slap some API into your software so that customers that ask for API have API. Otherwise, engineer an external Application Programming Interface into your systems.