Howdy, Stranger!
Categories
- 4.8K All Categories
- 4.3K Life in Lusternia
- 465 Announce Posts
- 75 Event Posts
- 1.7K Common Grounds
- 589 Q&A
- 83 Combat Overhaul
- 1.5K World Library
- 86 Combat Logs
- 870 Event Scrolls
- 403 Mechanic's Corner
- 329 Ideas
- 314 Last Chance Trading Post
- 478 Life Outside of Lusternia
- 9 Forum News
- 275 The Real World
- 94 Meet and Greet
- 37 The Funnies
- 63 Mafia Hideout
Announce Post #2982: Postmortem - Recent Lag
Last night, while investigating lag occurring across all IRE games, we discovered an unmitigated SQL injection vulnerability in the gamefeed processing on the games' websites, which was being actively used by an attacker. In an abundance of caution, we disabled the gamefeed functionality across all games and sinkholed the vulnerable API endpoint. We have now fixed the faulting code and reenabled the gamefeed.
We are still investigating the full impact of the vulnerability, but at this time it does not appear any customer data was accessed. It appears to have been a blind attack that didn't get beyond an attempt to identify access limitations, so no critical information was accessed whatsoever.
Special thanks to Razmael of Aetolia for identifying the initial impact, and Phaestus of Achaea and Eoghan of Imperian for identifying the SQLi and creating a mitigation.
We are still investigating the full impact of the vulnerability, but at this time it does not appear any customer data was accessed. It appears to have been a blind attack that didn't get beyond an attempt to identify access limitations, so no critical information was accessed whatsoever.
Special thanks to Razmael of Aetolia for identifying the initial impact, and Phaestus of Achaea and Eoghan of Imperian for identifying the SQLi and creating a mitigation.
4
(c) Iron Realms Entertainment 2012.