Decentralized physical infrastructure network (DePIN) Io.net recently faced a cybersecurity breach targeting its GPU metadata. Malicious actors exploited a vulnerability in an API to access user IDs and leveraged them to gain unauthorized access to the worker API. This access allowed them to modify device metadata within the network, fortunately, without compromising the actual GPU hardware itself due to robust permission layers in place.
Io.net’s chief security officer, Husky.io, took swift action to address the breach. They implemented remedial actions and security upgrades to fortify the network’s defenses. The incident highlights the evolving tactics of attackers who, in response to aggressive security patching, are shifting to more sophisticated methods. This underscores the need for continuous security reviews and improvements to stay ahead of potential threats.
Io.net acknowledges that a vulnerability in their API used for displaying content in the input/output explorer inadvertently exposed user IDs when searching by device IDs. This information was exploited by attackers who compiled a database of these IDs weeks before launching the attack. They then used a valid universal authentication token to gain access to the worker-API and alter device metadata without requiring individual user authentication.
So – we fucked up.
On 4/25/24 user(s) were able to use previously exposed user ID tokens to perform a SQL injection attack and mess with device metadata.
To prevent this in the future, we accelerated a deployment of auth zero authentication (OKTA) at the device level, which… https://t.co/PXdthHMU81
— hushky.io (@0xHushky) April 28, 2024
While the attack didn’t impact the core functionality of the GPUs, it raises concerns about data security and the importance of robust access control mechanisms. Io.net is likely to face scrutiny from users and industry players regarding the incident. Their response and the effectiveness of the implemented security measures will be crucial in regaining user trust.
