Sorry about this everyone, I know we messed up a lot of peoples' weekends.
We're working pretty hard to get to the bottom of everything.
Let me know if you have questions, I'll try and answer them all.
We're working pretty hard to get to the bottom of everything.
Let me know if you have questions, I'll try and answer them all.
When I see a local credit union site written in VBScript get hacked, I don't worry too much because it was probably riddled with SQL-injection bugs that any script kiddie can exploit. However, I know that you guys take data security seriously (you and I Skyped a while ago) and yet this happened. That's what worries devs like me the most.
I think it would be very helpful to us all (including many of your tech-savvy users) if you would write a detailed blog entry describing what actually happened and how. I believe you're encrypting tokens now but how did they get exposed in the first place? Was it a framework issue? Unhandled exceptions? Wrong chmod on a log file? New employee hooking up trojan'ed PC to your internal network? Here's hoping you feel comfortable in sharing.