Guild Launch hacked and fix coming soon!

[Darkmithoron]

Update:

GL_Support wrote:

Just to give you guys a quick update. The backup files are being loaded right now for this table. Once that's done we run an update query that will take a couple of minutes and we should be back to normal. I've completed my review of the issue that led to this and I'm confident we've fixed it. I'm now reviewing other functionality that is similar in how it works to make sure we haven't made the same mistake in other places. -Stephen

GL_Support wrote:

The character info restoration is underway. They should be updated in 15-20 minutes. -Stephen

***********************************************

Guild Launch wrote:

Greetings, At around 2:30am EST a broken query allowed a SQL Injection that caused an update to be run against the table that stores character data. We have a backup of the table and we are working to restore the data. When the data is ready to be restored we will need to take the site down again for 15-20 minutes while the update runs. In the interim we did not feel it was necessary to have the entire site down since we are confident there is no active security issue. Note: We've disabled automated Armory imports and manual imports until the data is restored. We've found the immediate source of the issue and we've fixed it. Our monitors logged the activity of this user and we will be taking the necessary legal actions. This SQL injection is not an active security issue. The issue effects this query type and this table only. We are going to perform a system review to check for other instances of similar issues. The source of this injection was a poorly formatted query. We've spot checked other functionality related to it and they are not vulnerable to the same issue. We're very sorry for the inconvenience. We have a backup of the table and we are working to restore the data. In the interim we did not feel it was necessary to have the entire site down since we are confident there is no active security issue. Your character names will be back to normal soon and we will post the results of our system review when we are done. -Stephen

GL_Support wrote:

KairaX wrote: Hello Stephen. With the Character names gone, at the moment all the characters on the DKP list/leaderboard seem to be named "test". Does the fix also include the healing of the DKP list names as well? Would be great to have it back up before today's raid. Thanks. That is an excellent question. All instances of the names will be fixed by the same update. -Stephen

[Darkmithoron]

Update:

GL_Support wrote:

Just to give you guys a quick update. The backup files are being loaded right now for this table. Once that's done we run an update query that will take a couple of minutes and we should be back to normal. I've completed my review of the issue that led to this and I'm confident we've fixed it. I'm now reviewing other functionality that is similar in how it works to make sure we haven't made the same mistake in other places. -Stephen

GL_Support wrote:

The character info restoration is underway. They should be updated in 15-20 minutes. -Stephen

***********************************************

[Darkmithoron]

Update 2: Looks like things are getting back to normal, so "de-announcing" this...

[Darkmithoron]

GL_Support wrote:

The characters from the backup file have been restored. If you created a character this morning or yesterday then the data may still be incorrect. This should only be a small handful of characters in relation to the 8.5 million that were restored. We are going to see if we can pull the data forward to more current, but for now a manual update will be required. You can do 3 things: 1. Update the character manually 2. If you have a new site with imports then you can re-import the data with the "sync" option on. The unclaimed incorrect characters will be removed and replace by good ones. 3. Wait for the auto import tomorrow morning which will fix most of them since it always syncs. We appreciate everyone's patience while we repaired this unfortunate and useless act of vandalism. We are going to be performing additional code reviews to protect against similar issues. -Stephen