Bilibili's back-end source code leaked with possible user login details

[BananaInSandals]

Yahoo! Taiwan esports (in Chinese)

technode (summary in English, lacks a lot of detail)

Weibo post cited in technode's article with screen shots of (censored) leaked username and password (in Chinese)

 

Summary from technode:

Quote

A repository containing a large number of user names and passwords for Chinese video-streaming site Bilibili was found on open-source software development platform GitHub

The GitHub repository had amassed at least 6,000 stars, a tool for users to bookmark a post, before it was taken down. 

Bilibili responded on Monday that the company had reviewed the leaked codes and found that they were from an older version of the website

“We have taken defensive steps to ensure the accident won’t compromise user data security,” said the company

 

bilibili's official response:

Quote

Translation:

Regarding to "bilibili's partial source code leak" incident statement

Today, we saw part of bilibili's source code has been circulated online. After internal emergency investigation, we have confirmed that those codes are of an older historical version. We have executed some active defensive measure to ensure that this incident will not affect our website and user data's safety.

We have reported the incident immediately and will investigate the source of the leak. Furthermore, bilibili has always has an official source code github. We welcome users who are interested to visit:

https://github.com/bilibili

 

Sample of leaked username and password (censored by poster):

 

Funny side stuff: a list of censored words  

Quote

Some of the words' translation (which I think is interesting  ):

Best actor Xi, Pussy, Fuck til cum, Xi Dada (nickname for President Xi Jinping), Apply for a real diploma, Peng Liyuan (Xi's wife), Sex/SexEd class, Mother Peng, ghost and animal gang rape, fuck me, fuck you, Emperor bun/bread (nickname for Xi, also has the meaning of Emperor idiot), fuck her

 

Rumours: some claims that bilibili is faking viewship, subscription number and gold coins due to the screen shot containing the phrases "作弊播放量" (cheating view number), "作弊收藏量" (cheating subscription number), and "作弊硬幣量" (cheating coin number), in one of the string array.

 

 

Personal thought:

LTT has been uploading onto bilibili with Chinese subtitles. If you're from bilibili, it might be a good idea to change your passwords just in case. Tho imo those are probably from ages ago when bilibili isn't that big yet. I highly doubt they're still using smtp host services from qq...

Also, keep your programmer employees happy. Rumors have it that this was leaked by a disgruntle (and dismissed) programmer from bilibili  They can deal a lot of damages...

[Fnige]

4 minutes ago, VegetableStu said:

come to linustechtups.com . we have cookies.

and shitposters... do we?

[Jurrunio]

4 minutes ago, VegetableStu said:

cookies.

I see what you did there

[Fnige]

7 minutes ago, Jurrunio said:

I see what you did there

Ahhhh... Now I see what he did there

[Bcat00]

Oh man whoever leaked this must have one hell of a grudge against the site

[williamcll]

Thanks for the reminder. I haven't seen any system messages on the site about the leak however.

[Neftex]

7 minutes ago, williamcll said:

Thanks for the reminder. I haven't seen any system messages on the site about the leak however.

its china, they censored it

[BananaInSandals]

27 minutes ago, williamcll said:

Thanks for the reminder. I haven't seen any system messages on the site about the leak however.

They claimed that the leaked codes (and presumably the passwords as well) are "historical". I guess they don't think it's that big a deal. I'll admit those hard coded passwords sound a lot like testing accounts to me. 

[Gullerback]

Them searchin for some freaky ass porn

[rcmaehl]

Quote

 

Xi Dada

 

Kinky ( ͡° ͜ʖ ͡°)

[colonel_mortis]

In the DMCA notice [1], they said

Quote

such as secret key,database address,very important api key and so on

There doesn't seem to be any suggestion that I can find that any user credentials were leaked. Instead, the leak appears to just be the site's source code, which included credentials to identify Bilibili to other services, such as API keys and security tokens.

 

Although it's not clear where the leak has come from, this should be a reminder that you don't want to upload private credentials to source control, even if your repository is private, just in case someone clones the repository and leaks it. Ideally, you want to use something like AWS secrets manager, and other cloud platforms' equivalents, which keep the secrets accessible only to your application.