After-Action Report: Flashpoint Remediation of 0-Day Exploit on Our Public-Facing Website
By Chris Camacho
Today, researcher Dancho Danchev published a blog post that incorrectly reported that Flashpoint’s public-facing website (flashpoint-intel.com) was “serving malware.”
Flashpoint’s public-facing website is not and was never serving malware. We’re happy to shed light on exactly what happened below.
- • The blog post published today references an April 12-13 incident in which flashpoint-intel.com was hit with a 0-day exploit on a specific WordPress plugin.
- • No PII or customer information was breached, and our public-facing website is segregated from all other systems and production environments.
- • The attack wasn’t targeted at Flashpoint specifically. It was an automated attack that picked up our site and injected the vulnerability.
Upon notification of the incident on April 14, Flashpoint security immediately took our public-facing website offline to remediate. The team also notified internal teams to address any inquiries. We also have the technical specifications of the attack which we can share upon request.
When it started / ended:
The earliest confirmed compromised time was April 13 at 01:24 EDT. The last known time the site was not compromised was April 12, 23:43 EDT. Flashpoint assesses with high confidence that flashpoint-intel.com was attacked between April 12th 23:44pm EDT and April 13th 01:24 EDT.
Official remediation efforts started on April 14, 13:42 EDT and the incident was remediated and confirmed by Flashpoint on April 14 at 13:58pm EDT.
Who it affected:
- 2. Anyone who clicked through a pop-up on the redirected site downloaded the malware (downloading the malware did not execute the malware)
Actions we have taken:
- 1. Our security team immediately removed the malicious plugin.
- 2. We have audited all of our plugins and removed any that are not critical to the functionality of our website.
- 3. We increased the frequency of our thorough scanning and auditing procedures to decrease the time from detection to remediation.
- 5. Sent a communication to our FPCollab community immediately after notification of the blog post, as well as a direct Flash report to all of our users.
Our security team has hardened our public-facing website and has further web application security improvements scheduled to both improve notification and response times and mitigate these types of attacks in the future.