According to ME News, on October 19 (UTC+8), the decentralized off-chain computing infrastructure Phala Network released a report stating that between October 8 and 12, attackers exploited a vulnerability in the dstack guest-agent to read container logs and environment variables of a small number of customer applications on Phala Cloud. On one of the host nodes, the attackers also exploited a network isolation flaw between the Confidential Virtual Machine (CVM) and the host management service to steal the gateway admin token and alter the gateway’s certificate management configuration.
Phala stated that TEE keys, KMS keys, customer disks, and host nodes were not affected; the vulnerability originated from the platform and is unrelated to customer configurations. The platform fix was completed on October 15. Phala has individually notified affected customers, who must rotate keys stored in environment variables. All customers must upgrade their CVMs to the patched dstack OS image (v0.6.1 or v0.5.12) by November 19. Starting November 20, the platform will automatically batch-upgrade unupdated CVMs, and CVMs running v0.3.x will be deactivated on the same day. (Source: Foresight News)
Phala Cloud Suffers Attack, Some Customer Logs and Environment Variables Exposed
KuCoinFlashShare
Summary
On October 19, Phala Network shared on-chain news that attackers exploited a flaw in the dstack guest-agent between October 8 and 12, gaining access to container logs and environment variables on Phala Cloud. A network isolation vulnerability also enabled attackers to steal a gateway admin token on one node. Phala confirmed that TEE keys, KMS keys, disks, and host nodes were not compromised. The platform resolved the issue by October 15, and affected users are urged to rotate keys stored in environment variables. All customers must apply the patched dstack OS image (v0.6.1 or v0.5.12) before November 19. An automatic network upgrade will be deployed for unpatched CVMs starting November 20, with version v0.3.x being deprecated on the same day.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.