helpdesk
helpdesk copied to clipboard
jenkins-infra
Vandalism in Jira
Service(s)
Jira
Summary
https://issues.jenkins.io/secure/ViewProfile.jspa?name=chsonu_5 and https://issues.jenkins.io/secure/ViewProfile.jspa?name=bablo_515 took a bunch of actions that should be reverted.
Reproduction steps
No response
For info: related to https://github.com/jenkins-infra/helpdesk/issues/4224 and https://github.com/jenkins-infra/helpdesk/issues/4223
For info, since @MarkEWaite did enable the circuit breaker, we've had some GH helpdesk issues asking for account confirmation:
- https://github.com/jenkins-infra/helpdesk/issues/4230
- https://github.com/jenkins-infra/helpdesk/issues/4227
@daniel-beck I don't know how to revert changes in JIRA. Do we have prior runbook or something?
Last "big set of unwanted changes", we reverted to a previous backup which made us lost days of legit changes. If we have to do this know, I would rather do it quickly. WDYT?
I guess it is also a good trigger for https://github.com/jenkins-infra/helpdesk/issues/2232: our accountapp is really weak and easy to batch-create stuff on it.
Switching to another system would help limiting the impact of such things (note: it would NOT prevent a user to deface JIRA)
I reverted the "close" actions of those two spammers by reopening each of the issues that were closed. I did not attempt to undo the other actions because they seemed too small to be worth the time to interactively repair the damage.
I don't know how to revert changes in JIRA. Do we have prior runbook or something?
I don't think anything convenient exists. I'd look at the changes, do the opposite.
If we have to do this know, I would rather do it quickly. WDYT?
I don't think this rises to the same level. FWIW we've removed "Bulk Change" permission from regular Jira users.
What I noticed is that the users bablo_515, chsonu_512 and chsonu_5 have the same email [email protected].
Is there a way to block users based on email?
Is there a way to block users based on email?
there's a hardcoded list, 👉 https://github.com/jenkins-infra/account-app/pull/397
I'm not aware of any further actions that are needed. I will continue to monitor Jira for issue spam and will block users that are detected creating spam comments and spam changes.