In plain words
Imagine you have a key to a big building where many shops are located. If someone gets that key, they can get into all the shops. In this case, the key was like a special access to a marketing company called Brevo, and the building was like the internet. The attackers used this access to put bad code into many websites.
What's broken
The specific bug that was exploited is not detailed in the source, but it allowed attackers to use Brevo's access to Cloudflare¹ to inject malware² into websites. This means an attacker could potentially do harmful things to the websites and their visitors.
How it actually works
Here's how it actually works: the attackers first got into Brevo's system by exploiting a vulnerability³. Then they used Brevo's access to Cloudflare, which is like a guard that helps keep websites safe, to put bad code into many websites. This bad code is called malware⁴, and it can do things like steal information or show bad ads.
Proof of concept
It is not clear from the source if there is a public proof-of-concept⁵, but the fact that over 100,000 websites were infected shows that the attack was real and effective. A proof-of-concept would demonstrate that the flaw is real and can be exploited, making it a more urgent issue.
Is it real
The attack was real and happened on September 10. The limiting factor might be that not all websites using Brevo's services were affected, or that the attackers did not use the access to the full potential. It is also not clear if the attackers are still exploiting the vulnerability.
What to do
To fix the issue, the websites affected need to remove the malware and ensure their systems are secure. This might involve updating their software, changing their access keys, or turning off any features that were compromised. The exact fix is not detailed in the source.
Terms
- ¹ Cloudflare
- , A service that helps keep websites safe and fast
- ² malware
- , Bad code that can harm computers or steal information
- ³ vulnerability
- , A weakness in a system that can be exploited by attackers
- ⁴ malware
- , Bad code that can harm computers or steal information
- ⁵ proof-of-concept
- , A demonstration that a flaw can be exploited, making it a more urgent issue