Gitbook 数据泄露
4 分•作者: punchmesan•2 天前
我们就 Gitbook 的可用性问题联系了支持部门，并收到了以下回复。我们尚未看到任何官方客户沟通或违规通知。抱歉格式不佳，这是从手机上复制粘贴的，我已经尽力了。
<p>更新：<p>GitBook 安全事件更新
您好 <$name>，
GitBook 应用、GitBook API 和已发布的文档现已恢复可用。部分服务在我们完成所有服务的全面恢复过程中可能仍会降级。<p>*事件经过*
GitBook 成为了一次复杂的、高度针对性的、利用 AI 代理发起的攻击的目标。
欧洲中部时间 11 月 2 日 19:00，攻击者未经授权访问了我们的一些基础设施凭证。我们立即检测到此次攻击并迅速采取行动，阻止了进一步的损害。
为了确保我们的基础设施完全安全，我们随后将 GitBook 应用和已验证的文档网站下线。我们尽可能长时间地保持公开已发布的内容在线，利用缓存数据。<p>*我们立即采取的措施*
* 阻止了攻击者并关闭了涉及的漏洞
* 更换了我们基础设施中的所有凭证和密钥
* 在我们确信服务安全后才恢复服务
* 使我们平台上的所有客户 API 令牌失效<p>*您的数据*
我们的调查显示，攻击者可能已访问以下内容：
* Git Sync 密钥。
* GitBook API 令牌。
* 用于将外部工具连接到 GitBook 的第三方 API 令牌。
* 您的网站访问者向 GitBook Assistant 提出的问题。<p>在此阶段，我们未发现任何证据表明您在 GitBook 中的任何内容被修改。<p>*您现在需要做什么*
* 轮换任何现有的 GitBook API 令牌。我们在事件期间撤销了所有个人 API 令牌。
* 轮换您用于将其他工具连接到 GitBook 的任何第三方 API 令牌或密钥。
* 如果您已发布使用密钥的集成，请轮换这些密钥。
* 如果您使用 GitBook MCP 服务器，请重新对其进行身份验证。
请联系您 GitBook 组织的管理员协助完成此过程。<p>*我们的后续行动*
* 监控情况，以防范进一步的攻击。
* 在我们的平台中引入进一步的安全措施。
* 撰写一份完整的事件复盘报告，并将很快发布，其中包含有关此次事件的更详细信息。
* 如果您有任何其他问题，请联系您的客户经理或我们的支持团队。您也可以访问 status.gitbook.com 获取更新。<p>感谢您的耐心等待，我们再次为此次中断表示歉意。
GitBook 团队
查看原文
We opened a ticket with support about Gitbook availability issues and got this in reply. We have yet to see any official customer communication or breach notification. Apologies for the formatting, did the best I could as it's a mobile paste.<p>Update:<p>GitBook security incident update
Hey <$name>,
The GitBook app, the GitBook API, and published docs are available again. A few services may still be degraded as we finish restoring everything to full performance.<p>*What happened*
GitBook has been the target of a sophisticated, highly targeted attack using AI agents.
At 19:00 CET, November 2, the attacker gained unauthorized access to some of our infrastructure credentials. We detected the attack immediately and acted swiftly to block further impact.
To make sure our infrastructure was fully secure, we then took the GitBook app and authenticated docs sites offline. We kept publicly published content live for as long as possible, using cached data.<p>*What we did immediately*
* Blocked the attacker and closed the vulnerabilities involved
* Replaced every credential and secret across our infrastructure
* Brought services back only once we were confident they were secure
* Invalidated every customer’s API tokens on our platform<p>*Your data*
Our investigation shows that the attacker may have accessed the following:
* Git Sync secrets.
* GitBook API tokens.
* Third-party API tokens used to connect external tools to GitBook.
* Questions asked to GitBook Assistant by your site visitors.<p>At this stage, we have found no evidence that any of your content in GitBook was modified.<p>*What you need to do now*
* Rotate any existing GitBook API tokens. We revoked all personal API tokens during the incident.
* Rotate any third-party API tokens or secrets you use to connect other tools to GitBook.
* If you have published integrations that use secrets, rotate those secrets.
* If you use the GitBook MCP server, re-authenticate it.
Please contact your GitBook organization’s admin to assist with this process.<p>*What we are doing next*
* Monitoring the situation in case of further attacks.
* Introducing further security measures to our platform.
* Writing a full post mortem that will be published soon with more detailed information about the incident.
* If you have any further questions, please reach out to your account manager or our support team. You can also check status.gitbook.com for updates<p>Thank you for your patience, and we apologize again for the disruption
The GitBook team