BrowserStack hack

A BrowserStack email apparently sent to all users makes it abundantly clear they have been hacked or have a very disgruntled member of staff. Possibly both.

The Internet as a whole is asking if this is true, BrowserStack is currently showing a maintenance page.

The question people should be asking is “should I cancel my credit card?”. I really don’t care if they close down or not, at least, not as much as I care about my credit card details.

The text of the letter follows.

Dear BrowserStack User,

We are unfortunately displeased to announce that BrowserStack will be shutting down. After much consideration on our part, we have realized we were negligent in the services we claimed to offer. In our terms of service, we state the following:

  • after the restoration process is complete, the virtual machines are guaranteed to be tamper-proof.
  • The machines themselves are in a secure network, and behind strong firewalls to present the safest environment possible.
  • At any given time, you have sole access to a virtual machine. Your testing session cannot be seen or accessed by other users, including BrowserStack administrators. Once you release a virtual machine, it is taken off the grid, and restored to its initial settings. All your data is destroyed in this process.

Unfortunately, we have blatantly lied. Not only do all of our administrators have access, but so does the general public. We have no firewalls in place, and our password policies are atrocious. All virtual machines launched are open to the public, accessible to anyone with the alpha password “nakula” on port 5901, a password which is stored in plaintext on every VM. As well, our infrastructure uses the same root passwords on all machines, which is also stored in plaintext on every VM launched (“c0stac0ff33”).

Given the propensity for cyber criminals to target infrastructure services such as ours, it is almost certain all of your data has been compromised. These passwords take no less than 15 minutes to find for anyone who is looking.

We hope we have not caused you too much trouble, and to our enterprise customers who signed deals contracts based on a fabrication, we are equally sorry.

The BrowserStack Team


From Jake Archibald on Twitter.

Categorized as General

By Peter Wilson

Peter has worked on the web for twenty years on everything from table based layouts in the 90s to enterprise grade CMS development. Peter’s a big fan of musical theatre and often encourages his industry colleagues to join him for a show or two in New York or in the West End.


Leave a comment

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.