Savannah GNU Site Compromised

win32sux · 12-01-2010, 06:27 AM

Quote:

A site belonging to the Savannah GNU free software archive was attacked recently, leading to a compromise of encrypted passwords and enabling the attackers to access restricted project material.

The compromise was the result of a SQL injection attack against the savannah.gnu.org site within the last couple of days and the site is still offline now. A notice on the site says that the group has finished the process of restoring all of the data from a clean backup and bringing up access to some resources, but is still in the middle of adjusting its security settings.

Complete Article

jens · 12-02-2010, 08:36 AM

Chronological account of the events:
http://www.fsf.org/blogs/sysadmin/sa...u.org-downtime

unSpawn · 12-02-2010, 11:14 AM

Without the benefit of insider knowledge, what would you all say we could learn from the account of events as posted there?

H_TeXMeX_H · 12-02-2010, 12:40 PM

Quote:

Originally Posted by unSpawn

Without the benefit of insider knowledge, what would you all say we could learn from the account of events as posted there?

Well ...

Quote:

# Fri Nov 26 14:27 UTC -- At least one Savannah admin account was compromised by brute forcing the password.

Stronger passwords. (probably the main cause)

Prevent SQL injection, there are plenty of articles on this.

From the rest I sense that many things were not configured properly.

unSpawn · 12-05-2010, 08:59 AM

Indeed. Weak password policy, non-existent or insufficient user input, request and log checking and reporting, lax permissions for the www-cvs user, no use of cron.deny, web server misconfiguration and no probably MAC. Taking nearly three days to get notified of (or do something about) malicious activity is way too long.