Internet Archive breached again via stolen access tokens
The Internet Archive (IA) has suffered yet another security breach, with attackers targeting its Zendesk email support platform, exposing sensitive user data.
The Internet Archive, the world’s most famous digital library, suffered a series of cyberattacks earlier this month, temporarily disabling its site, including the Wayback Machine, and exposing the data of 31 million users. On October 8, founder Brewster Kahle confirmed that the site was hit by a DDoS attack, which was resolved hours later.
According to cybersecurity news outlet BleepingComputer, over the weekend multiple individuals who in the past contacted Internet Archive support received a warning apparently from a person responsible for the compromise that the organization has been breached yet again via the Internet Archive’s Zendesk instance.
“It's dispiriting to see that even after being made aware of the breach weeks ago, IA has still not done the due diligence of rotating many of the API keys that were exposed in their GitLab secrets.” One email further reveals that the attackers were able to gain access to over 800,000 support tickets, including data sent to the popular address, info@archive[.]org, dating back to 2018.
The support tickets range from general inquiries to requests for content removal from the Wayback Machine. Some users may have uploaded personal identification documents as part of their removal requests. If the attackers had full access to Zendesk's API, they could potentially have accessed and downloaded these sensitive attachments.
The authenticity of these emails is further confirmed by the fact that they pass all DKIM, DMARC, and SPF authentication checks, proving they were sent from an authorized Zendesk server.
While no official attribution has been made regarding who carried out the breach, a pro-Palestine hacktivist group called BlackMeta (also known as SN_BlackMeta or DarkMeta) has claimed responsibility for a recent DDoS attack on the Internet Archive. However, it appears that another group is behind the actual hacking.
Latest Posts
Russian cyber spies target Georgia’s government and critical infrastructure
In addition to espionage, Moscow gained the capability to sabotage Georgia’s power and communications networks.
Internet Archive breached again via stolen access tokens
The attackers reportedly were able to gain access to over 800,000 support tickets.
Cisco confirms security incident after hacker offers to sell data
Cisco said that a small number of files, which were not intended for public download, had been accessed and potentially published.