Apache project server hacked, passwords compromised
- 15 April, 2010 05:46
Hackers broke into a server used by the Apache Software Foundation to keep track of software bugs.
The attack did not compromise the open-source Web server's source code repository, but it did give hackers access to a server used by the project to keep track of bugs, and they also obtained low-privilege accounts on another server used to maintain the people.apache.org Web site, according to Philip Gollucci, vice president of Apache infrastructure. "None of the source code was affected in any way," he said.
By taking advantage of a common Web programming error known as a cross-site scripting bug, and then using another password-guessing attack, hackers were able to break into the Atlassian JIRA software used by Apache. They then installed a password stealing program on that software, ultimately seizing full control of the machine. That gave them access to two other programs hosted by Apache on the same server, the Confluence wiki program and Bugzilla.
The intruders stole three cached login credentials from the compromised server to get access to the Minotaur.apache.org server that runs People.apache.org and provides shell accounts for Apache developers, but were unable to do much with these low-level accounts, Gollucci said. Even the data on its bugtracking systems is not sensitive, as Apache does not store information about security flaws on any of these servers, he said.
The unidentified attackers broke into Apache's JIRA server on April 6 and had begun stealing user passwords by the time Apache administrators noticed the issue on April 9.
In an attack launched at the same time, intruders were also able to break into Atlassian's own servers and gain access to customer user names and passwords. Atlassian employes several Apache developers, and attackers could have used the information from the Apache attack to try to break into accounts at Atlassian. "It's hard to say whether it was directed at Apache or at Atlassian," Gollucci said.
These passwords may prove to be valuable if Apache or Atlassian developers happen to use the same passwords on their source control systems. Then the attackers could make changes to the source code -- adding back door access to Apache projects, for example, said Chris Wysopal, chief technology officer with Veracode, via a text message.
Atlassian sells software development tracking and collaboration products, including the JIRA and Confluence software used by Apache.
According to a Atlassian blog post, hackers were able to access an unencrypted database of usernames and passwords used to login to customer accounts. "The breach potentially exposed passwords for customers who purchased Atlassian products before July 2008," Atlassian CEO Mike Cannon-Brookes said in a blog post. "We made a big error. For this we are, of course, extremely sorry. The legacy customer database, with passwords stored in plain text, was a liability."
Atlassian could not be reached immediately for comment.
This is not the first time the Apache Software Foundation has been hit by hackers. Last August intruders were able to break into the Minotaur server and run their owns scripts on Apache's Web site.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
Larry Page wants to see your medical records
Dual-Persona Smartphones Not a BYOD Panacea
After two-year hiatus, EFF accepts bitcoin donations again
CIOs struggle to deliver timely mobile business apps: survey
Spiceworks' free management software gets integrated MDM
Customer Success - Slater & Gordon Lawyers
Lawyers work hard, and they work fast. Any activity that takes their focus away from the task at hand represents lost productivity and lost revenue. Slater & Gordon Lawyers needed to filter spam and email-borne malware and provide high availability for email. Results from the business solution they chose include 250 hours of IT staff time reclaimed annually for other tasks, long delays in email delivery alleviated, reduced email-related storage costs, and email failover to the cloud in minutes, avoiding hours-long outages. Find out how they got these results.
Agentless Security for Virtual Environments
Virtualised datacentres, desktops, and cloud computing should be secured by the same strong protection technologies as physical machines. However, traditional agent-based solutions that are not architected for virtualisation can result in a number of significant operational security issues. Find out more about the first agentless security platform solution.
Advanced Targeted Attacks
The new threat landscape has changed. Cybercriminals are aggressively pursuing valuable data assets, such as financial transaction information, product design blueprints, user credentials to sensitive systems, and other intellectual property. Simply put, the cyber offense has outpaced the defensive technologies used by most companies today. Find out more on how to protect against the next generation of cyber-attacks.