Fur Affinity Back Online
We would like to thank the users of the site for being understanding and patient with us. We’ve been reading your posts on Facebook, Twitter, Reddit, and the FA forums. We appreciate your words while we worked to fix the issues. We understand your frustration, and will be continuing to work to improve the site.
As many of you know Fur Affinity has recently been subjected to an attack. We have managed to recover from the attack and restore the deleted submissions, user profiles, and watches from our most recent backup. Unfortunately the backup was from May 11th. This means the users that have registered, submissions that have been uploaded, and new watches that have been made on user accounts since then are now lost. Other information, such as journals and notes, remain untouched.
**We would like to stress that while we have no hard evidence to believe that user account data has been compromised, the nature of the attack made it technically possible. We encourage users of the site to change their passwords as a precautionary measure.**
The attack stemmed from an exploit in ImageMagick, one of the most widely used image processing libraries available. The exploit was used to initially download our source code and plant the means by which the second attack (the one that forced us to take the site offline) was carried out. This occurred before we discovered and patched the exploit earlier this month.
**Timeline of Events**
**May 4th:** The first incident took place when attackers used a recent vulnerability in the ImageMagick library to gain access to the Fur Affinity application server and download the site’s source code. We were not aware of the breach at this time.
**May 5th:** We were made aware of the existence of the exploit and immediately applied the recommended patch to ImageMagick to fix the issue.
**May 17th:** At 1:00AM EST (1AM) we were notified that individuals were passing out USB drives containing copies of the Fur Affinity source code at a convention. Shortly thereafter we secured a zip file containing a copy of the USB drive’s contents and began to analyze them. We had to determine whether or not the code was real or a hoax, and whether it was code from the live servers, old code, or code which had existed from other projects.
At roughly 11:44AM the site was attacked a second time which caused the complete deletion of the submissions, watch, and user data. The moment we realized what had occurred we took the site offline and began to perform steps to mitigate further damage.
It took some time but we found out how the attackers have been accessing our server and shut them down. Since then we have been performing security audits to the code and server environment to track down potential further issues. We have also been making backups.
In the process we have identified and closed several holes in the code. Server contents have been scanned to identify and remove any leftovers of the original attack. IMVU lended a hand in providing technical assistance with the process.
**May 18th:** The site has been brought back online. We’re continuing to monitor and look for issues and will be working to continue securing the site.
At this time we do not know who executed the attacks on this site. An analysis of the attack vector used suggests these individual(s) were experienced attackers and not casual bystanders.
**Where Do We Go From Here?**
We have been working on a complete re-code of the site for some time. At this point the project is roughly 80% complete. We are working to bring in additional help to complete the project and get FA upgraded to a new code base.
In the meantime we will be continuing to analyze site security and take proactive steps to track down any existing issues which could pose a threat.
If anyone has information as to who perpetrated the attack or distributed the USB flash drives please contact Dragoneer privately at [email protected] or via Trouble Ticket on FA.
**Known Issues**
* Users’ message centers may not show the correct number of notifications. This will re-calculate once you remove any new or existing notifications of that type (note: remove them manually instead of using the nuke option). * Multiple counters such as the number of comments made and received, number of favorites, and so on may have gone out of sync for many users. A script at a later date will be written to re-sync these counters globally. * Comments left by users that no longer exist have been hidden as opposed to having been removed. This was done to prevent comment trees from breaking. These comments will be shown as having been “Hidden by the Administration” to avoid confusion. * Message center notifications for content uploaded by the no longer existing users will be shown as if that content has been removed by the users in question. * Any changes you have made to your account since May 11th (changing your email address, updating your password, new watches, blocking users, faved content, etc) have been reverted as part of the restoration.
**Special Thanks**
We would like to thank the staff of BLFC. Their security team was essential in helping us get copies of the flash drive and alerting us to the existence of the problem.
**FAQ**
**Q: What info was affected?**
**A:** In addition to the site’s code being leaked, all user accounts, submissions, and watches were deleted from the database. We have restored this information from our most recent backup (as of May 11th).
**Q: Exactly when did we patch the exploit?**
**A:** The exploit which lead to the initial attack was patched on May 5th. At the time we were not aware there had been an intrusion.
**Q: What sort of changes will we be making to decrease the chances of this happening again?**
**A:** As previously stated, the new code is roughly 80% complete. We’ve added additional staff to the coding project. In addition we are working on bringing the site up to modern standards with an emphasis on security and ease of use.
**Q: Does FA encrypt passwords?**
**A:** Yes. All passwords are hashed and salted. We are still encouraging users to change their passwords as a precautionary measure.
**Q: Why doesn’t FA have daily or incremental backups?**
**A:** Our current backup and storage solution is nearing capacity. We have been working to procure a new server with ample storage as well as look into long term storage solutions. We aim to have the server implemented within the next few weeks.