Office 2010 Pro Plus Admins Acknowledge Mistakes T

The Apache Infrastructure Staff has introduced an in depth analysis of your current attack that led to many apache.org servers being compromised. After outlining the mistakes that produced the incident achievable and their plan to strengthen safety,Office Home And Business 2010, the admins happen to be congratulated from the neighborhood for their openness.

The total report printed within the Apache Foundation's blog starts by stressing that, "At no time were any Apache Software Basis code repositories, downloads, or users put at risk by this intrusion," and explains that, "Providing an in depth account of what happened will make the internet a better place, by allowing others to learn from our blunders."

It was confirmed that the point of entry for the attackers was the server hosting the Apache Conference website (apachecon.com), which was becoming maintained by a third-party company. The attackers gained root privileges around the machine,Windows 7 32 Bit, possibly by using a local privilege escalation exploit. There is few information available about how they got access, because they deleted the logs.

What's certain,Microsoft Office Professional Plus 2007, though, is that they used the SSH key associated to an account the Apache Infrastructure Crew had on that server for backup purposes, to jump to people.apache.org, the Foundation's "staging machine for our mirror network,Office 2010 Pro Plus," as it is called in the report. The newly obtained access was used to write CGI scripts into the document root with the apache.org website, which then got propagated on all mirrors, due to automatic sync processes. These scripts were later executed from the attackers over HTTP in order to obtain remote shells.

The first thing that the Apache Infrastructure Staff criticize themselves for is the SSH keys implementation, which, according to their own account, left a lot to be desired. "We did not restrict SSH keys appropriately, and we were unaware of their misuse," they write. The second one is leaving ExecCGI enabled, even though most of their websites don't require it. Finally, the current setup of the rsync and logging processes also contributed to the success from the attack.

The admins are in the process of making changes to address several of these problems. These involve, but are not limited to, requiring all users with elevated privileges to use OPIE for sudo on certain machines, recreating and using new SSH keys, one per host, for backups,Office Pro 2007, while also enforcing use of the from="" and command="" strings in the authorized key file on the destination backup server, disabling CGI support on most website systems and re-implementing measures such as IP banning after several failed logins, on all machines.

"What really impresses me, however, is how well Apache handled the potentially highly embarrassing incident – taking swift action and keeping their users informed via blog updates. […] So bravo to Apache for responding to the problem rapidly and with openness, proving it is possible to turn a potentially bad story into a positive experience," Graham Cluley, senior technology consultant at antivirus vendor Sophos, comments.
Follow the editor on Twitter @lconstantin