This Postmortem and technical timeline follows the public announced communication by CEO Allan Mørch on Monday, May 27, describing the fraudulent take-over on a sub-domain in AskCody, and its impact on AskCody Customers. You can see the full response to the cyber-attack from AskCody CEO Allan Mørch here.
On May 24-27 2024, AskCody experienced a DNS incident impacting our European domains. This incident involved unauthorised redirection of traffic to unwanted content. Our internal teams conducted thorough investigations and quickly identified and resolved the issue.
This report outlines the timeline, technical investigation, and measures taken to prevent future occurrences. All data and application layers, customer data and access, are intact and untouched with no customer or personal data being compromised. Also, during the attack, no applications or customer data was compromised as the attack only lead to unusual, fraudulent content appearing on app.onaskcody.com based on hijacked redirects in the network.
On May 24, 2024, at 13:29 CEST, our team noticed unusual content appearing on app.onaskcody.com. This content was not consistent with our services and was also found on other European subdomains such as eu.onaskcody.com and portal.onaskcody.com. Our US domains remained unaffected. For a full overview of the incident in details, we refer to your statuspage where all updates were provided during the incident, or to the previously mentioned announcement from our CEO.
The root cause of the incident was a bad actor exploiting a naming convention mistake in a public IP resource. This mistake allowed DNS requests intended for the West Europe cluster to be directed to a service hosted by the bad actor.
May 24, 13:29 CEST: Detected unusual content on European domains
May 24, 14:00 CEST: Our development team began investigating the nature of the attack, considering possibilities such as cross-site scripting or DNS manipulation
May 24, 14:30 CEST - May 25, 04:30 CEST: Investigation of network traffic using tools like Wireshark. We monitored DNS queries and packet sniffing but did not find immediate discrepancies.
May 24, 15:30 CEST: Verified third-party integrations and redeployed services to ensure no malicious content was being served from our systems.
May 25, 11:00 CEST: Created a new subdomain to redirect traffic and monitor the situation while mitigating customer impact.
May 25, 12:30 CEST: Noticed redirection to a sports streaming site, flagging it as unwanted content.
May 25, 18:10 CEST: Identified a misconfigured public IP resource due to a naming error during deployment, leading to unauthorised traffic redirection.
May 25, 19:55 CEST: Corrected the misnamed public IP resource, ensuring all traffic was properly routed to AskCody servers. Continuous monitoring was maintained to ensure stability.
May 27, 09:32 CEST: Confirmed full resolution of the incident and notified stakeholders.
To prevent similar incidents in the future, we have:
This DNS incident was significant event that we managed with urgency and thorough investigations. We apologize for any inconvenience caused and assure you that our systems are now stable and secure. We remain committed to maintaining the highest security standards, following Microsoft best practices and will continue to take proactive measures to safeguard our services.
If you have any questions or need further information, please do not hesitate to contact our support team.
Thank you for your understanding and continued trust in AskCody.
Sincerely,
AskCody