Why did Solidi decide to go offline?
On investigation, it quickly became clear to us that the PHP2Shell vulnerabilities were an unusually serious security incident.
Given the potential scale of the problem, we decided to act preemptively and take our platform offline, in order to protect customer funds.
Why was this incident so bad?
It was a zero-day exploit. The attack vector was in our standard web traffic, and would be virtually impossible to distinguish from legitimate customer activity. Any use of this exploit would be contained within the PHP system and would not be very detectable on the server – standard intrusion-detection systems and server monitoring systems would have been unlikely to see it.
What is PHP2Shell, exactly?
PHP2Shell is the name given to two critical security vulnerabilities discovered in PHP, a programming language used by approximately 70% of the world’s websites.
Successful exploitation of these vulnerabilities could allow attackers to take control of affected servers and steal sensitive data.
More technical information available here:
https://www.akamai.com/blog/security-research/understanding-php2shell-everything-you-need-to-know
How did it affect Solidi?
Solidi uses PHP within several of our older systems, including accounting, customer support, banking integrations, and engineering tooling. Additionally, many of our third-parties use PHP in their systems, including blogging software, banks, cloud storage platforms, and marketing partners.
What did Solidi do during the 38-hour shutdown?
- Following initial research, we took the decision to disable withdrawals.
- Our security team conducted an in-depth analysis of the problem, the attack vectors, the detection mechanisms, and the long-term implications.
- We determined that this situation was potentially one of the most serious security incidents we had ever analysed, and determined that the only correct course of action was to take our platform offline, in order to be certain that customers’ assets were protected.
- We then audited all relevant systems within our platform. All affected systems were patched and upgraded, and in some cases we chose to replace the relevant servers entirely.
- Once we were satisfied with our security upgrades, we brought the platform back online.
Did attackers gain access to Solidi’s systems?
To the best of our knowledge, no.
Customer funds have not been withdrawn. This is the most critical aspect of security for a crypto exchange.
90% of customer funds are held offline in cold storage. Even if an attacker were able to gain access, almost all funds would remain safe.
Do customers need to take any action?
No.
Could something like this happen again?
Security is a constant threat and we remain diligent.
Our cold-storage-first approach is the only real defense against the evolving threat landscape on the internet.
We are proud of our response to this situation and we will do the same in the future if necessary. At the end of the day, our the security of our customers’ funds is the most important thing.
Regards,
StJohn Piano
CTO @ Solidi Exchange
