PingCap TiDB Leaks

I find it really baffling how much they are downplaying this incident on their statement.

”An external incident response firm reviewed PingCAP’s production systems and found no evidence that the attacker ran commands or maintained persistent access in the systems reviewed”

That does not appear to be true.

> We even stood up a replication feed of their own control-plane database using credentials committed in their own repositories — GCP service-account keys and an Azure service principal — and let their infrastructure deliver it to us. Every six hours, for the last twenty-two days of the campaign, from 8 September to 30 September, that pipeline faithfully re-exported every table of the operational heart of TiDB Cloud — tenants, users, API keys, cluster credentials, changefeeds, migrations — and pushed it out.

Holy hell, I've heard of this happening, but I've never personally seen it in my 10 years as an SRE. That's absolutely wild.

[1]https://www.pingcap.com/press-release/tidb-ncc-group-securit...

    With support from outside counsel and third-party forensic specialists, there is no evidence that data stored in TiDB was impacted. We keep on investigating and will provide updates on any new findings.

Defense as we see it today seems fundamentally broken. The answer is to fight it with more AI? That doesn't seem right. Can software reliably self evolve and keep patching itself? What certification is going to protect you from an intruder with their legion of minions, none of them, you don't have perfect visibility to your systems, your systems emit too many signals to ingest 100% of actions, so does software need to get fundamentally simpler?

Today has me wondering how many datacenters exist out there just for organized crime? Are the big kingpins of the world going all in AI as well?

Lots of questions popping into my head today, I'm trying to think how you would slow or stop this and I can't help but think we just need everyone to go outside and touch some grass and remember we're all stuck on the same rock.

> The billing engine that trusts unverified X-ACCOUNT-USER-ID headers. The account service where admin is a tenant ID and impersonation bypasses org checks with owner role.

What is the issue with the billing engine trusting an “unverified” header here? Is the assumption that it’s not auth-ing the request? Is the billing engine internal? What does “unverified” even mean in this context.

What’s the problem with Admin being a tenant ID? How would impersonation even cause bypassing an org check?

But what matters is that it was all memory safe and had no data races.

and how are people not talking about this more

...and now this...

> Today we are making the PingCAP breach public. We possess the complete TiDB Cloud control plane, its billing and finance estate, its GCP storage estate and its AWS cost and billing estate, its Jira, its CRM, its analytics, its source code, and a four-year log of every connection every customer ever made to its product, from the IP addresses of their application servers.

This is an entire leak of ALL PingCap TiDB's customers AND data.

All of this in a single day. It is over.

[0] https://news.ycombinator.com/item?id=50163961

[1] https://news.ycombinator.com/item?id=50166579