Date of Report: June 30, 2023
Incident Overview
On June 29, 2023, the Numbers Discord server was compromised in a hacking event. The intrusion commenced at 13:53 UTC, with a suspicious message reported by moderators. This escalated to unauthorized actions, including the deletion of channels, removal of administrators, and possible access to sensitive information.
Timeline of Events
June 29
- 13:53 UTC: Moderators detected and reported a suspicious message.
- 13:56 UTC: We attempted to communicate with the compromised account; all channels were deleted soon after.
- 13:57 UTC: All server admins were forcibly removed.
- 16:05 UTC: The rebuilding process for the Discord server commenced.
- 18:12 UTC: Major channels were restored, and moderators returned to duty.
June 30
- 10:00 UTC: Rebuilt process is done, all channels are fully recovered to the Discord server, announce the investigation report
Incident Investigation and Analysis
Despite all admin accounts being secured with 2FA and strong passwords, the attack’s success highlights potential vulnerabilities within the Web 2.0 infrastructure. An investigation is underway in conjunction with Discord’s security team to identify the root cause.
The nature of traditional Web 2.0 servers and services being centralized inherently leaves control and responsibility for data and account security in the hands of the service provider. In the event of a breach, as witnessed, sensitive data can be manipulated, destroyed, or stolen without the knowledge or consent of the data owner.
Implications and Learnings
The hacking event underscores the inherent risk and insecurity of relying on centralized systems, impacting both personal privacy and business confidentiality.
Web 3.0 and protocols like Numbers Protocol are indicative of a shift towards decentralization and user ownership of data. The principles of Web 3.0, while not perfect, decentralize data across a network of nodes controlled by users, rather than placing it under the control of a single vulnerable server.
Future Perspective
Numbers Protocol, embodying this shift, aims to ensure data authenticity and traceability by attaching immutable metadata to digital content, thereby rendering it tamper-proof and traceable in a decentralized network. Although current operational activities like communication and emailing still rely on the Web 2.0 infrastructure, we anticipate a future where data management is improved, and the control over our online identity and data is returned to individuals.
While we continue to engage with Discord and relevant authorities to investigate this breach, our focus will be on exploring and implementing stronger security measures and raising awareness of the vulnerabilities of current infrastructures. As we navigate these events, we remain committed to ensuring the safety and integrity of our community and services.
