https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22094#M211 <P style="margin: 0;">Hi Robert. We are aware of this issue and fixing it.</P> Mon, 01 Feb 2021 23:39:17 GMT arsalan_habib 2021-02-01T23:39:17Z https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22092#M209 <P style="margin: 0;">When I send an invitation thru the Ruckus Unleashed App (Android), the links the App sends starts like this:</P> <P style="margin: 0;"></P> <P style="margin: 0;">http://unleasheddev.com/bmM9dW40MjE4MDIwMDU5[redacted]</P> <P style="margin: 0;"></P> <P style="margin: 0;">It looks to me like the invitations created points to a site no longer under Ruckus control.</P> <P style="margin: 0;"><BR />Have you been hacked or just allowed a domain to expire, letting someone else take over?</P> <P style="margin: 0;"></P> <P style="margin: 0;">That site could register all clicks on links in invitations, <STRONG>including the GUID that should be a secret</STRONG>!</P> <P style="margin: 0;"></P> <P style="margin: 0;">Looks to me like a MAJOR security issue. Will you look into it?</P> Mon, 01 Feb 2021 18:34:19 GMT https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22092#M209 robert_winther 2021-02-01T18:34:19Z https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22093#M210 <DIV data-cannedresponseid="" style="text-align: center;">Screendump from site the invitation mail links to:</DIV> <DIV data-cannedresponseid="" style="text-align: center;"><span class="lia-inline-image-display-wrapper" image-alt="Image_ images_messages_601849d95f25f97dd176355e_b92927a868cef6618b7aa1560255a33c_Ruckussecurity-5fa84a39-003b-4731-87a1-0aab479ff760-768575644.jpg"><img src="https://community.ruckuswireless.com/t5/image/serverpage/image-id/2148i764962AA0C00A0BC/image-size/large?v=v2&amp;px=999" role="button" title="Image_ images_messages_601849d95f25f97dd176355e_b92927a868cef6618b7aa1560255a33c_Ruckussecurity-5fa84a39-003b-4731-87a1-0aab479ff760-768575644.jpg" alt="Image_ images_messages_601849d95f25f97dd176355e_b92927a868cef6618b7aa1560255a33c_Ruckussecurity-5fa84a39-003b-4731-87a1-0aab479ff760-768575644.jpg" /></span></DIV> <P style="margin: 0;"></P> Mon, 01 Feb 2021 18:35:05 GMT https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22093#M210 robert_winther 2021-02-01T18:35:05Z https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22094#M211 <P style="margin: 0;">Hi Robert. We are aware of this issue and fixing it.</P> Mon, 01 Feb 2021 23:39:17 GMT https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22094#M211 arsalan_habib 2021-02-01T23:39:17Z https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22095#M212 <P style="margin: 0;">Thank you for the update.<BR /><BR />Should we worry about the invitations we have already sent? <BR /><BR />If the <SPAN>unleasheddev.com domain is not under your control, every request could have been logged.</SPAN></P> Tue, 02 Feb 2021 16:54:00 GMT https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22095#M212 robert_winther 2021-02-02T16:54:00Z https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22096#M213 <P style="margin: 0;">Hi Robert, the invites by themselves do not expose any information. The app knows how to get the required information from it.</P> <P style="margin: 0;"></P> <P style="margin: 0;">By the way with this invite on Android you will see a prompt to either open it on the browser or the Unleashed mobile app. When the user selects Mobile App, the Mobile App opens and gets access to this link. In this case this link is not hit at all.</P> Wed, 03 Feb 2021 01:52:07 GMT https://community.ruckuswireless.com/t5/Apps-and-SPoT/Ruckus-hacked-or-domain-expired-Invite-for-Remote-Management/m-p/22096#M213 arsalan_habib 2021-02-03T01:52:07Z