#steemconnect

Automated votes abuse on SteemConnect?

Today at 13:00 UTC what looked like a massive automated vote occurred on Steem. The SteemConnect API received a lot of requests to upvote and downvote the following posts without user approval:

We can see from the SteemConnect logs that a malicious actor used Utopian privileges to broadcast votes for users. If you have delegated posting authority to the @utopian.app you may want check your posting/voting history to see if your account has been affected. If that is the case, then we recommend that you undo your votes.

To check your history, go https://steemd.com/@fabien (change @fabien with your username)

We’ve disabled the app @utopian.app and revoked all the access tokens on SteemConnect while this issue is being resolved. Utopian team helped us to identify early the abuse and the SteemConnect server logs clearly show that the requests were not from Utopian servers IPs but from an external actor.

What happened?

Utopian asks for “offline access” when using SteemConnect, this gives the Utopian app the ability to issue an access token for its users anytime with what we call “refresh token”. It’s a common use in the OAuth 2 standard. It seems that someone got access to Utopian’s database with stored refresh tokens. These refresh tokens were used to generate new access tokens and broadcast votes for these accounts. If your account has been affected you most likely were giving offline access to Utopian.

Has SteemConnect been hacked?

No. Someone malicious sent requests to the SteemConnect API using Utopian’s refresh tokens but does not have direct access to the SteemConnect server.

My account upvoted some posts without my approval, my keys are safe?

Neither SteemConnect nor Utopian have access to any of your keys. SteemConnect API is using posting authority delegation to broadcast posting operations for you. The operations are signed by the @steemconnect account but not using your own keys. You are not giving SteemConnect your keys but only the permission to use your account.

We are still investigating this issue and will give you another update when we have.

Edit: You can read Utopian related post here: https://steemit.com/utopian-io/@utopian-io/utopian-io-hack-may-3rd-may-4th-2018-no-wallets-or-keys-compromised

Comments · 32

@shanikhan(47)· 2795d
Test
@steemitboard(66)· 2949d
Congratulations @busy.org! You have completed the following achievement on Steemit and have been rewarded with new badge(s) :

Award for the number of upvotes

_{Click on the badge to view your Board of Honor.} _{If you no longer want to receive notifications, reply to this comment with the word STOP}

Do you like SteemitBoard's project? Then Vote for its witness and get one more award!
@inkedsatan(25)· 2949d
very slow follows system..
@steemitboard(66)· 2961d
Congratulations @busy.org! You have completed the following achievement on Steemit and have been rewarded with new badge(s) :

Award for the number of upvotes

_{Click on the badge to view your Board of Honor.} _{If you no longer want to receive notifications, reply to this comment with the word STOP}

Do not miss the last post from @steemitboard: SteemitBoard World Cup Contest - The results, the winners and the prizes

Do you like SteemitBoard's project? Then Vote for its witness and get one more award!
@steemitboard(66)· 2972d
Congratulations @busy.org! You have completed the following achievement on Steemit and have been rewarded with new badge(s) :

Award for the number of upvotes

_{Click on the badge to view your Board of Honor.} _{If you no longer want to receive notifications, reply to this comment with the word STOP}

Do not miss the last post from @steemitboard: SteemitBoard World Cup Contest - Quarter Finals - Day 2

Participate in the SteemitBoard World Cup Contest! Collect World Cup badges and win free SBD Support the Gold Sponsors of the contest: @good-karma and @lukestokes

Do you like SteemitBoard's project? Then Vote for its witness and get one more award!
@thejohalfiles(61)· 2979d
@busy.org When will the full toolset at https://steemconnect.com/ become available to use? I currently have a list of projects I want to delegate to, however I am going to wait until this becomes available as all the delegations will be easier to manage/monitor.
@steemitboard(66)· 2984d
Congratulations @busy.org! You have completed some achievement on Steemit and have been rewarded with new badge(s) :

Award for the number of upvotes

_{Click on the badge to view your Board of Honor.} _{If you no longer want to receive notifications, reply to this comment with the word STOP}

Do not miss the last post from @steemitboard!

Participate in the SteemitBoard World Cup Contest! Collect World Cup badges and win free SBD Support the Gold Sponsors of the contest: @good-karma and @lukestokes

Do you like SteemitBoard's project? Then Vote for its witness and get one more award!
@mightypanda(64)· 3003d
Hi, i have been using busy.org to post articles but i never receive an upvote from busy.org bot. My total follower vest is 141335117. Can you please tell me what i am doing wrong
@steemitboard(66)· 3016d
Congratulations @busy.org! You have completed some achievement on Steemit and have been rewarded with new badge(s) :

Award for the number of upvotes

Click on any badge to view your Board of Honor. For more information about SteemitBoard, click here

If you no longer want to receive notifications, reply to this comment with the word STOP

Do not miss the last announcement from @steemitboard!

Do you like SteemitBoard's project? Vote for its witness and get one more award!
@dwarrilow2002(57)· 3025d
The save button on the https://v2.steemconnect.com/apps/@steemhost.app/edit page does not work. Is there a tech support for steemconnect?
@rezanur-rhaman(46)· 3029d
Thank you for your information @busy.org
@mitaneuk(47)· 3030d
perfect, I am happy with successful people like you thank for the help ... good will always be replied with goodness !!!
@artgirl(69)· 3034d
Oh, what about those who keep following then unfollowing even if we mute the person they just keep appearing in our notifications which is annoying tbh.
@glorimarbolivar(55)· 3035d
I love your pos I like your work, thanks for the update
@machhour(61)· 3036d
thank you so much for this update , i understund now wat happend
@steemibu351(52)· 3036d
this is so great. you got the great point here
@jackjami(42)· 3036d
why you don't upvote my blog until last month....??
@anna-mi(61)· 3036d
Oh, it's so sad that the attackers are able to do this. I am amazed at their great mental abilities. If such strong minds are put on the right track, who knows how far progress would have stepped. It is a pity that the scammers spend their potential for criminal and dishonest fraud.
@bxt(80)· 3036d
Thank you for contributing to the platform and thanks for encouraging me who are those minnows to go ahead on the platform , thanks again and wish the platform will be better and better .
@leomesi(41)· 3036d
Thanks you master @busy.org
@leomesi(41)· 3036d
Thanks you master @busy.org
@fsl(45)· 3036d
May you always succeed in helping others
@joele(56)· 3036d
When coins got hacked they lose millions $ But on Steem you lose votes. ;)
@yasu24(70)· 3037d
Thank you for information. I resteemed this post.
@pieasant(60)· 3037d
Good information for us
@moonunit(61)· 3037d
Esteemed, thanks for the heads up.
@smokeasare165(49)· 3037d
@busy.org we are not satisfied with your explain...what arent you telling us...some of us are in panic and want to feel at least relieve...
@chireerocks(75)· 3037d
This awareness spreading post is really appreciable because it will help to the Steemians to stay vigilant and to keep more analytical vision towards the process because everyone's contribution is really important to keep the platform user friendly. Keep doing the great work. 🙂
@baninduana(49)· 3037d
I want to ask you, whether to use a quick post without using photos.
@nurhayati(59)· 3037d
Thank you master, I just use busy.org. I just believe busy.
@elear(68)· 3037d
Here the information about the hack https://steemit.com/utopian-io/@utopian-io/utopian-io-hack-may-3rd-may-4th-2018-no-wallets-or-keys-compromised
@diya28(54)· 3037d
We should maintain the clean atmosphere of this community