On April 22, bi Bi barrage net (the following abbreviation " B stands " NASDAQ: BILI) the discharge outside encountering code, code of its tiring-room project is uploaded to go up to GitHub of platform of project opening a source, expose this website to be in " activity of rhythm storm lottery " in " affusion " lottery success rate, be suspected of enroach on consumer the problem of legitimate rights and interests, shanghai disappear is protected appoint talked about limited company of science and technology of number of wide amusement of Shanghai of main body of B station operation about for two times from this. After incident happening, b station share price dish before drop 4.07% , the United States is put hold a proof in the palm 16.74 dollars / .
B station expresses, classics interior is checked, affirm this part code belongs to older historical version, at present the website already implemented active defense measure, ensure won't affect website safety and user data safety.
Nevertheless, the personage inside course of study tells " China runs a newspaper " reporter, "If be old version, these code also won't carry user message, but the code that divulges on the net at present has news of a lot of user, not be the government apparently announce in that way. " to this, our newspaper reporter begs public relations of card B station, the other side expresses to do not have a response temporarily.
Source code is divulged
On April 22 afternoon, have explode makings say, b station is whole source of website tiring-room project is divulged, and " many user codes are by hard encode inside code, everybody can be used. Everybody can be used..
That day, opening a source to reach demesne software project is mandatory on platform GitHub, appeared the name is " Bi Bi source of project of Bilibili website tiring-room " project. It is reported, this project by Zhang date " Openbilibili " found, as a result of the property opening a source of the website, entry website person all can use.
Meanwhile, b station source code is divulged, also expose this website to be in " activity of rhythm storm lottery " in " affusion " lottery success rate, be suspected of enroach on consumer the problem of legitimate rights and interests, there is remarks to show in code " lottery also should send barrage not successfully, probability 20% , the false appearance that creates get the winning number in a bond of a kind of a lot of people " . From this, shanghai disappear is protected appoint talked about limited company of science and technology of number of Shanghai wide amusement about for two times.
A personage of familiar direct seeding tells a reporter, "Rhythm storm " it is a specially good effect of direct seeding prop, lottery activity is to point to direct seeding li of user that did not buy this specially good effect, can participate in together, click when them " rhythm storm " when specially good effect, can send a barrage automatically. From click " rhythm storm " in the user of the effect draw-out 100, get free young stage property (this prop is to be used increase to be spent intimately be worth with experience) . Other user is clicked again be not gotten, but also can send barrage automatically, dynamic atmosphere. And always user of win a prize in a lottery, can have the alone clew that play a window.
Afore-mentioned personages disclose, this " rhythm storm " do not involve ready money business, had protected to disappear appoint the explanation is clear. The reporter calls Shanghai disappear to protect with respect to this matter appoint, have not achieve a return up to now.
And when B station public relations accepts a reporter to interview, express, "Designing this function is for active barrage atmosphere, do not involve ready money business; Functional design is put in controversy dot really, we had gotten offline this function rectify and reform. We had gotten offline this function rectify and reform..
Why can be source code divulged
When moxa intermediary seeks advice from analyst Li Songlin to accept a reporter to interview, express, "No matter divulge, is when paragraph version, had caused negative impact to B station. " it is reported, on April 22, b station share price dish before drop 4.07% .
A technical personnel discloses to the reporter, code is divulged have two kinds of possibility. It is the development staff of code, likely a certain programmer is divulged, consciousness is less than the likelihood the security of code, stem from show off wait for a reason, code GitHub.
The 2 safety that are a server appeared problem. "For instance the server was defeated to solve, your server beat on others orders a thing. " this personage explanation says, "Additionally still a few small companies use fictitious space, because make the cost of the server,be very big, and the cost of fictitious space is very low, but security is particularly poor. But security is particularly poor..
If somebody wants to atttack B to stand through back end code, need not undertake converse project guesses again run principle and flaw place, can find a lot of flaw from inside code directly.
The personage inside course of study says, this paragraph of code is likely very at the outset the rock-bottom code that compose proposes B to stand, look now, likelihood the flaw of nature of under cover root, and these flaw are afraid the conference is very difficult repair. And B stands cannot new structural frame, force of time-consuming bad news goes rescripting.
User data privacy is badly in need of protecting
Li Songlin says, to B the station affects the platform of muscularity this kind, code reveals the data that involves an user, can cause impact to user confidence, influence user stands to B the degree of belief of itself. On the other hand, b station serves as appear on the market enterprise, code divulges incident to also can affect its performance on capital market.
"Very intuitionistic is B the station can reveal an a few safe hidden danger. " Li Songlin says, because of this paragraph of time that reveals in source code, very possible code has been copied, and the rock-bottom compose that stands as B is built, they need repair expenditure is longer, if next somebody wants to make the operation of a few minatory sexes in the light of B station, the account safety of the user is browbeaten easily.
In addition, b station has taller enrollment in 2 dimension market user quantity, and user stickiness is opposite taller, so although divulge code version is older, the metropolis is safe to user information cause undesirable effect. Because partial user uses same account code in the habit on Internet, so information divulges the use metropolis to other product to create safe risk.
The reporter inquires moxa intermediary Polaris discovers, the lunar vivid number that B stood in March 2019 is 72.84 million. Among them, the male is occupied than 61.04% , 24 years old reach the following crowd to occupy than 67.02% .
The personage inside afore-mentioned course of study tells a reporter, the enrollment of the user information, for instance the data such as full name, mailbox, mobile phone, "This kind of data can derive library, go the network platform trial and error with big random, registering information because of what have a lot of people is same, cut the account that sees other platform likely, " his citing says, "For instance, a lot of star is in below the case that did not lose any electronic equipment, ICloud account is defeated to solve. ICloud account is defeated to solve..
Recommend read
Click big picture | "43 million send the Stanford on the daughter " incident is newest progress, zhao Yu thinks of a mother to respond to: Suffer person misdirect
Recommend read
Click big picture | Who " kill " died bazaar of China's famousest old brand general merchandise?
