【Market Update】An administrator token for a gateway was stolen just like that. Phala Cloud’s postmortem today: From October 8 to 12, attackers exploited a dstack guest-agent vulnerability to read container logs and environment variables from some customer applications, then took advantage of a gap in host network isolation to modify the certificate management configuration. Fortunately, TEE keys, KMS keys, and customer filesystems were unaffected, and no evidence was found that any host had been compromised. The fix was completed on October 15, and affected customers have been notified. Everyone talks about decentralization, yet the gateway became a single point of failure. That’s an expensive lesson. Would you still dare to put all your environment variables in cloud containers?
$PHA $DOT $KSM
#PhalaCloud #数据安全 #Polkadot ecosystem
(Source: Wu Says Blockchain)
⚠️Risk warning: The above is shared for market information only and does not constitute investment advice. Investing involves risks; please exercise caution when entering the market.