Critical.
Authoritative.
Strategic.
Subscribe to CIO Magazine »

Apache project server hacked, passwords compromised

The attack may be related to another intrusion at collaboration vendor Atlassian

Hackers broke into a server used by the Apache Software Foundation to keep track of software bugs.

The attack did not compromise the open-source Web server's source code repository, but it did give hackers access to a server used by the project to keep track of bugs, and they also obtained low-privilege accounts on another server used to maintain the people.apache.org Web site, according to Philip Gollucci, vice president of Apache infrastructure. "None of the source code was affected in any way," he said.

By taking advantage of a common Web programming error known as a cross-site scripting bug, and then using another password-guessing attack, hackers were able to break into the Atlassian JIRA software used by Apache. They then installed a password stealing program on that software, ultimately seizing full control of the machine. That gave them access to two other programs hosted by Apache on the same server, the Confluence wiki program and Bugzilla.

The intruders stole three cached login credentials from the compromised server to get access to the Minotaur.apache.org server that runs People.apache.org and provides shell accounts for Apache developers, but were unable to do much with these low-level accounts, Gollucci said. Even the data on its bugtracking systems is not sensitive, as Apache does not store information about security flaws on any of these servers, he said.

The unidentified attackers broke into Apache's JIRA server on April 6 and had begun stealing user passwords by the time Apache administrators noticed the issue on April 9.

In an attack launched at the same time, intruders were also able to break into Atlassian's own servers and gain access to customer user names and passwords. Atlassian employes several Apache developers, and attackers could have used the information from the Apache attack to try to break into accounts at Atlassian. "It's hard to say whether it was directed at Apache or at Atlassian," Gollucci said.

These passwords may prove to be valuable if Apache or Atlassian developers happen to use the same passwords on their source control systems. Then the attackers could make changes to the source code -- adding back door access to Apache projects, for example, said Chris Wysopal, chief technology officer with Veracode, via a text message.

Atlassian sells software development tracking and collaboration products, including the JIRA and Confluence software used by Apache.

According to a Atlassian blog post, hackers were able to access an unencrypted database of usernames and passwords used to login to customer accounts. "The breach potentially exposed passwords for customers who purchased Atlassian products before July 2008," Atlassian CEO Mike Cannon-Brookes said in a blog post. "We made a big error. For this we are, of course, extremely sorry. The legacy customer database, with passwords stored in plain text, was a liability."

Atlassian could not be reached immediately for comment.

This is not the first time the Apache Software Foundation has been hit by hackers. Last August intruders were able to break into the Minotaur server and run their owns scripts on Apache's Web site.

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

More about: Apache, Apache Software Foundation, Atlassian, Minotaur
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the CIO comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: apache, atlassian, data theft, hack, passwords
Latest Blog Posts
Whitepapers
  • Automating Your Processes to Outperform Your Competition
    Welcome to Volume Three of the “Intelligent Guide to Enterprise BPM.” Get ready for an education in automation—Process Automation, that is. This white paper goes into detail about the Process Automation entry point into an Enterprise Business Process Management (BPM) program. Read on to learn how Process Automation opens up new ways to help your business do things faster—like open up a new sales channel or deliver customer orders. Discover how Process Automation enables your business to run smoother and consistently in an orchestrated way. With a true Enterprise BPM solution, you can automate newly designed processes far easier than starting from scratch.
    Learn more »
  • Managing IBM License Complexity
    IBM provides thousands of products in its portfolio and uses a variety of license models, contract terms and conditions. These license models can be very complex, causing frequent confusion for organisations trying to grasp the concepts while maintaining license compliance. While at first IBM licensing may seem incomprehensible, some education on the license models and licensing scenarios will help minimise the confusion. In addition, a more automated approach to managing licenses enables organisations to gain control, reduce ongoing software costs and minimise license liability risks. Read on.
    Learn more »
  • Mobile Security: Don’t leave employees to their own devices
    No organisation can afford to ignore the rising march of consumer devices in today’s workplace. But neither can they ignore the risks that consumerisation brings. Companies must adapt IT and security strategies accordingly, balancing the needs and demands of more flexible work models with the often thorough information security safeguards that were implemented to protect the business in the first place. Fortunately, there are ways of doing just that and achieving a balance that works for all concerned.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Recent comments