If you use Gyazo, you’ve probably noticed it’s been down for days. It got hacked on September 11 and it’s been fully offline since September 18, with no return date yet. I wrote up the full breakdown on our blog.
What leaked
About 23.6 million account records, with names, emails and password hashes (not the passwords themselves), plus your Google sign-in email or Twitter token if you linked either. No payment info.
Records on about 490 million images, mostly from January 2019 or earlier, so if you joined after that, most of yours probably aren’t in there. Each has the image ID its Gyazo link is built from, plus the upload IP, any GPS data and the text Gyazo’s OCR read off it. The attacker also got a list of which images are private.
What I’d do right now
If you’ve used your Gyazo password anywhere else, change it there. Gyazo’s own has to wait until it’s back.
Unlink Gyazo in Twitter’s connected apps if you ever linked the two.
Don’t click links in emails about the breach. Go to gyazo.com yourself.
Once it’s back, delete the old images
A new password won’t do anything about those leaked image links. Gyazo says it’s building a way for you to review your images and make them viewable again, and when it does, I’d delete the old ones instead. Redact clears them in one run right from your computer, either everything or just the years the leak covers.
The app might need a quick tweak if Gyazo changes things when it relaunches, so I’ll update this thread once it’s working.
Anyone else have years of screenshots sitting on there?
Ha, yeah, it’s been all over. I went down the rabbit hole on the technical side, so here’s the nerdy version.
How they got in
Helpfeel (the company behind Gyazo) says someone exploited a bug in the image upload server, got arbitriry command execution, and made it from there into Gyazo’s database. No CVE, no bug class. Gyazo’s a Kyoto company, so the good discussion’s on the Japanese side, over on Hatena Bookmark (you have to use google translate), which is basically Japan’s Hacker News (your browser’s translate button handles it fine). Hiroshi Tokumaru, who wrote the web security book a lot of Japanese devs learned from, pointed out there that “arbitrary commands” means full RCE, which isn’t necessarily a plain command injection. That covers a lot of ground, anything from a poisoned image parser to a deserialization bug. Image upload pipelines have a rough history here (ImageTragick, or the ExifTool DjVu bug that got a pile of self-hosted GitLab servers popped in 2021), but nobody’s said it was one of those. What I’d really like to know is why a box that eats random files off the internet could reach the user database at all.
Why the image IDs are the real problem
Gyazo links are capability URLs. That 32-character hex ID works out to 2^128 possible addresses, which is why Gyazo’s help page says they can’t be guessed. Nobody has to guess when the real IDs are sitting in the dump. You also can’t rotate a URL without breaking every embed that points at it, so they pulled image viewing, and the plan is to have you review your images before anything’s viewable again.
Other stuff in the notice worth knowing
The 490M image records are only about 14.4% of Gyazo’s image data, mostly January 2019 or older. Could be a dump that ran oldest-first and got cut off, could be a legacy table. They haven’t said.
There’s a separate pull of about 2.4M image records “retrieved using specific filtering criteria.” That’s someone running targeted queries, and nobody’s said what they filtered on.
The metadata includes the OCR text Gyazo pulled off the images, so anything readable in the leaked screenshots is now searchabl e text. Long-term AWS keys all start with AKIA, so stuff like that is easy to fish out. If you ever captured a terminal or a .env file, rotate whatever was in it, even if it’s from 2017.
Password-locked captures (a Pro and Teams feature) leaked their passphrase hashes, plus the list of which images are private. Helpfeel hasn’t said what hashing it used for those or for account passwords.
The 23.62M user count is rows, not people. It includes anonymous accounts that never had an email on them.
Devs are feeling it too
Gyazoa image links are all 404ing right now and the upload API’s returning 502s. This PR’s a fun one. A docs site’s CI kept timing out because every build retried all ~916 of its Gyazo lookups, and every one came back 502. The fix is a neat little negative cache.
If you’ve got Gyazo images in READMEs or docs, it’s a decent week to move them somewhere you control.
thats crazy! and their site is still down. when will it be back up? it’s going to be a race against the hackers to delete your images before thew hackers can load the URLs