Funny to see this after I spent the morning troubleshooting and fixing my crowdsec install on my debian 13 vps. Apparently they stopped supplying a community blocklist to my machine because I'm running the old debian packaged version instead of directly from them (http 500). I had a LLM build a blocklist from publicly available sources rather than tie myself more tightly to their SaaS platform.

  > the Tanstack compromise is very likely to have been the leak vector
  ....appears to have been backdoored to extract an API key with authorization to read the private codebase.
  ...
  >  immediately rotated all required tokens & credentials to prevent further incidents.

Rotating the API key doesn't quite put them in a position to "prevent further incidents" does it? The next PyPI/npm supply chain issue will just get the new key?

I suppose whatever they use that key for should be reviewed and re-scoped if possible?

Does github let you restrict where you can originate requests using a given API key? or are we just not there yet?

On the funny side, reading the website tagline, apparently they claim to know who is attacking you, they just happen to miss out on who attacked them.

Turns out they are not really a security company, just an aggregator of bad IPs. Ideally this kind of aggregator problem is best suited for a trusted not-for-profit company where providing the data needs some level of credibility and querying the data costs you nominal fee to keep the setup floating.

We implemented CrowdSec for bot/scraping mitigation. The architecture is sound, but it ended up having an unacceptable false positive rate for us. This may be an issue with any kind of IP reputation approach. After a couple of months of work getting it ready to go I had to turn it off after a couple of days.

Security firm hacked.

Sounds like an exploit took the credentials needed to extract the code, makes me wonder if a Ubikey + SSL cert for git access would have prevented the entire leak.

Oof, a security company leaking its own source code is quite the look. Hope it's not their latest version of the engine.

Time to scrutinize those CrowdSec deployments even closer. Hopefully, it's nothing critical that gets exploited.

Not to be confused with CrowdStrike, a serious [0] security company

[0] https://en.wikipedia.org/wiki/2024_CrowdStrike-related_IT_ou...

of course... Ask Fable if the private code is valuable or not...

yet another security oriented company that doesn’t practice what they preach.

On the flip side, there was allegedly no PII leaked. But this event is still a red flag as it means their internal ops are absolutely shit. So it’s another vendor receiving a PNG flag.

CrowdSec. CrowdStrike.

[flagged]

[flagged]

[dead]