Cybersecurity hygene on Atlasssian products needs improvement

Question

Hi Atlassian, I need to highlight some cybersecurity vulnerabilities with your products particularly Jira. I think some tightening and measures and Cybersecurity reporting points should be in place to prevent this sort of Atlassian product abuse.

Examaple culprint Jira site: https://e20ltu31.atlassian.net/ Im currently attached by the hacker to this Jira site)

Right under your noses Russian hackers are setting up these fake sites in Jira and then sending invites to emails that could be potential victims of viral infections or hack attacks.

The invite I reieved from this site: https://e20ltu31.atlassian.net/

And the verification request I recieved from Atlassian to login eventhough I dont have an account yet. What you need to do in those emqails is: 1) Have an option like facebook to report unauthorised invitations. This is spam in my view as the viewer of the email. 2) prevent the invitation of emails that dont have associated Atlasssian accounts.Makes seense to prevent it from being abused in this way:

Then I setup an account by resetting the password they created using my email and their own password. And went into Jira Service Management for site: https://e20ltu31.atlassian.net/

And other unsuspecting victims they invited in the Team list for this Jira site:

It was necessary to expose this on your community site as you havent got proper Cybersecurity tip hotline or reporting email address to send all this even if I dont have an account.

Please consider improving your cybersecurity practices or be used as a tool by hackers to attack Australian and other citizens who may be affected by these attacks.

Regards,

M

Andy Heinzer · Answer

Hi @meservo

I already reported the site you first mentioned.  It has already been deactivated by our abuse team, based on this report.

Thanks for the feedback here as well.  I agree that Atlassian should do more to actively take in these reports, and from users without an account.  I have filed a few requests with different internal teams to push for these changes.  One of these is a public feature request over in https://jira.atlassian.com/browse/CLOUD-11637

It specifically seeks to have all our Atlassian Cloud sites include a means to notify us of abuse coming from a site.  I am not sure if or when this option might be considered, but I would recommend watching that ticket for updates to this.

Thanks again for reporting this site to us.  It feels bad that we have provided a service to an account that abused it to send spam to you and others.  I will keep pushing for the change we need to detect earlier and prevent such future abuse.

meservo · Answer

Can you also please report this to abuse team for me?

meservo · Answer

@Andy Heinzer on your Contact Us page you don't have a Abuse reporting form or have any mention of this abuse reporting email address. Please consider doing so. Also within each Jira site have abuse reporting options in various screens like abuse of posts in sites or sites themselves. That way its easier for victims to report. Thanks foe following this up. And hopefully my ideas about enhancing the email format to include "I didn't create the account" option flags it with abuse or accounts team to investigate. Please hunt those hackers down too.