Skip to Content.
Sympa Menu

ibiblio-announce - [ibiblio-announce] the beloved proto-ops 2009 exploit

ibiblio-announce AT lists.ibiblio.org

Subject: ibiblio services/changes announcement list

List archive

Chronological Thread  
  • From: Don Sizemore <dls AT ibiblio.org>
  • To: ibiblio-announce AT lists.ibiblio.org
  • Subject: [ibiblio-announce] the beloved proto-ops 2009 exploit
  • Date: Wed, 19 Aug 2009 17:55:19 -0400 (EDT)


Hello everyone,

Those of you whose CMS-based web sites have been compromised in the past will be familiar with seeing files owned by the unprivileged "nobody" user dropped in world-writable directories. We make every effort to catch them, turn them off when we find them, and take steps to prevent their return as we isolate their venues of entry.

However, in the past few days, we have seen several web pages modified without having been world-writable or owned by "nobody." This afternoon I identified the mechanism by which they were coming in: a cracked account on our login server. Ken and I have taken steps to prevent this exploit from recurring, even if there are more vulnerable user accounts.

We ask that everyone change his or her login.ibiblio.org password. You do this by logging in with an SSH client, and typing at the prompt:

$ passwd

We have ordered new hardware for login.ibiblio.org, as the current machine is showing its age. Once we've migrated to this box we'll be asking everyone to change passwords again, as migrating user accounts to the new machine means copying over the password hashes, as-is.

If you have questions or trouble, please do open up a ticket via
http://www.ibiblio.org/help

thank you, 919.962.5646 w
donald sizemore, ii 919.260.4915 c
ibiblio.org systems 919.962.8071 f



  • [ibiblio-announce] the beloved proto-ops 2009 exploit, Don Sizemore, 08/19/2009

Archive powered by MHonArc 2.6.24.

Top of Page