Re: Fink Wiki website intrusion report (was: Website issues)
"David R. Morrison" <[email protected]>
| Newsgroups | gmane.os.apple.fink.core |
|---|---|
| Message-ID | <[email protected]> |
I wonder if instead this could be caused by the DNS table issue that was raised last week? Looks like somebody could have hijacked DNS requests for a fink site, rather than the site itself... On Mar 27, 2012, at 5:12 AM, Max Horn wrote: > Wow, that sounds serious. Changing subject line to make this a bit clearer... > > As far as I know, the Wiki is hosted on finch. If this is true, then *everything* currently on finch must be regarded as compromised; including e.g. all Wiki user accounts and their passwords (attackers might have modified the login script to track those). > > I guess it would be best to take finch offline right away, then verify if there was an intrusion. This means setting up a (temporary) replacement host for the website, I guess... > > > Max > > Anfang der weitergeleiteten E-Mail: > >> Von: Alexander Hansen <[email protected]> >> Datum: 27. März 2012 06:14:55 MESZ >> An: Darren Hart <[email protected]>, Fink Core Group <[email protected]> >> Betreff: Re: [fink-core] Website issues >> >> On 3/26/12 9:06 PM, Darren Hart wrote: >>> >>> Hi Alexander, >>> >>> Wasn’t sure where to post this so let me know or forward this on if this is the wrong person. I had some fink issues today and was working through a fix when access to the wiki.finkproject.org was blocked by our institutions internet management software. Upon further inspection by the info sec team it would appear that the web server that this resides on has been compromised by a fairly sophisticated web attack where its re-directing traffic to a number of sites for drive by exploits before returning the user to the wiki at the end of the run. I don’t know who runs the wiki site but they need to have a look and find out what’s been gotten at. >>> >>> Many thanks and great work with fink ! >>> >>> Cheers, >>> >>> Darren >>> >>> Darren Hart | IT Manager | Department of Biochemistry | University of Otago >>> T - +6434794965 | M - +6421991638 >>> >> That'd be "not me". I'll forward this on. >> -- >> Alexander Hansen, Ph.D. >> Fink User Liaison >> http://finkakh.wordpress.com/2012/02/21/got-job/ >> ------------------------------------------------------------------------------ >> This SF email is sponsosred by: >> Try Windows Azure free for 90 days Click Here >> http://p.sf.net/sfu/sfd2d-msazure_______________________________________________ >> fink-core mailing list >> [email protected] >> List archive: >> http://news.gmane.org/gmane.os.apple.fink.core >> Subscription management: >> https://lists.sourceforge.net/lists/listinfo/fink-core > > ------------------------------------------------------------------------------ > This SF email is sponsosred by: > Try Windows Azure free for 90 days Click Here > http://p.sf.net/sfu/sfd2d-msazure_______________________________________________ > fink-core mailing list > [email protected] > List archive: > http://news.gmane.org/gmane.os.apple.fink.core > Subscription management: > https://lists.sourceforge.net/lists/listinfo/fink-core ------------------------------------------------------------------------------ This SF email is sponsosred by: Try Windows Azure free for 90 days Click Here http://p.sf.net/sfu/sfd2d-msazure _______________________________________________ fink-core mailing list [email protected] List archive: http://news.gmane.org/gmane.os.apple.fink.core Subscription management: https://lists.sourceforge.net/lists/listinfo/fink-core