原文摘录:
TL;DR: An attacker gained access to the servers hosting Matrix.org. The intruder had access to the production databases, potentially giving them access to unencrypted message data, password hashes and access tokens. As a precaution, if you're a matrix.org user you should change your password now.
The matrix.org homeserver has been rebuilt and is running securely; bridges and other ancillary services (e.g. this blog) will follow as soon as possible. Modular.im homeservers have not been affected by this outage.
这是一次拖库事件,黑客利用服务器上的漏洞,获得了服务器数据的访问权限。事实上如果采用了tor上网和端到端加密,黑客能获得的信息相当有限。
这次事件并非matrix协议的缺陷或者运维故意为之,甚至也不是matrix软件的漏洞。原文是这样的:
We were using Jenkins for continuous integration (automatically testing our software). The version of Jenkins we were using had a vulnerability (CVE-2019-1003000, CVE-2019-1003001, CVE-2019-1003002) which allowed an attacker to hijack credentials (forwarded ssh keys), giving access to our production infrastructure. Thanks to @jaikeysarraf for drawing this to our attention.
是服务器运维使用的第三方软件的问题。
这事件反而证明了matrix的安全性,在全程使用tor和端到端加密的情况下,即使服务器不能信任,也是足够安全的。(实际上匿名上网就是基于不信任原则)。
相反如果是telegram,discord服务器被拖库,或者迫于政府压力交出数据(应该时刻注意这一点),IP地址、电话号码、聊天记录就一览无余了。



