Vandalism in Jira

[daniel-beck]

Service(s)

Jira

Summary

https://issues.jenkins.io/secure/ViewProfile.jspa?name=chsonu_5 and https://issues.jenkins.io/secure/ViewProfile.jspa?name=bablo_515 took a bunch of actions that should be reverted.

Reproduction steps

No response

[dduportal]

For info: related to #4224 and #4223

[dduportal]

I've blocked bablo_515 in JIRA on short term

[dduportal]

For info, since @MarkEWaite did enable the circuit breaker, we've had some GH helpdesk issues asking for account confirmation:

• I've been blocked #4230
• Jenkins Account #4227

[dduportal]

@daniel-beck I don't know how to revert changes in JIRA. Do we have prior runbook or something?

Last "big set of unwanted changes", we reverted to a previous backup which made us lost days of legit changes. If we have to do this know, I would rather do it quickly. WDYT?

[dduportal]

I guess it is also a good trigger for #2232: our accountapp is really weak and easy to batch-create stuff on it.

Switching to another system would help limiting the impact of such things (note: it would NOT prevent a user to deface JIRA)

[MarkEWaite]

I reverted the "close" actions of those two spammers by reopening each of the issues that were closed. I did not attempt to undo the other actions because they seemed too small to be worth the time to interactively repair the damage.

[daniel-beck]

I don't know how to revert changes in JIRA. Do we have prior runbook or something?

I don't think anything convenient exists. I'd look at the changes, do the opposite.

If we have to do this know, I would rather do it quickly. WDYT?

I don't think this rises to the same level. FWIW we've removed "Bulk Change" permission from regular Jira users.

[mawinter69]

What I noticed is that the users bablo_515, chsonu_512 and chsonu_5 have the same email [email protected].
Is there a way to block users based on email?

[timja]

Is there a way to block users based on email?

there's a hardcoded list, 👉 jenkins-infra/account-app#397

[dduportal]

Are there more actions required on this one?

[MarkEWaite]

I'm not aware of any further actions that are needed. I will continue to monitor Jira for issue spam and will block users that are detected creating spam comments and spam changes.

[dduportal]

Thanks! I'm closing the issue then.