Earlier today I received a notification of a security incident at Mandrill. At first I was concerned, but then after I dove into the details I became confused as to why they considered this noteworthy at all.
To summarize, it appears that Mandrill made some changes to their EC2 security groups, which resulted in some ports on their logging servers being accessible to the Internet for a few weeks.
On March 10, we discovered evidence that automated attempts were made against Mandrill's internal logging servers in an effort to use them in a botnet. Analysis of the servers that were impacted, including network traffic logs and files present on the servers, indicates that these attempts were unsuccessful. There are no signs that the servers were targeted to access the data stored on them.
We investigated the issue and found that the opportunity for this attack stemmed from a firewall change we made on February 20 in order to more granularly control access to some of Mandrill's servers. Parts of Mandrill's infrastructure are hosted with Amazon Web Services (AWS), and we use EC2 Security Groups to control access. One change was made to a security group that contained more servers than we intended to affect. As a result, a cluster of servers hosting Mandrill's internal application logs was made publicly accessible instead of allowing internal-only access.
Now, we all deal with botnets all the time and how to keep your machines reasonably safe from them is pretty well known. Especially since nearly all of what I run is public facing and I see millions of botnet attempts, none of which ever succeed at doing anything but generating log entries.
But because of this they are recommending that everyone invalidate and change all of their API keys. I personally have close to a dozen active API keys and it will take me most of an afternoon to change all of these where they need to be changed.
My personal thought is that they have massively overreacted to this. But I don't know everything. Is there some reason that simply having open ports would be considered a potential compromise here?