2010/1/26 Fernando Augusto <fernando@xxxxxxxxxxxxxxxxxx>: > Fun stuff... > > From here (Brazil) neither me nor anyone I asked, even through different > carriers, are getting this kind of data while looking at > http://e107.org/news.php.... I am not someone that talks here, but I believe > that it should be looked with more care. I use Sophos here (up to date) and > no warning was sent, so it gave me something to wander... > well, well, the link you provided above now gives a 404. if you go to e107.org, you'll find the following message: ========= [ snip ] ========= e107.org compromised OK, here's what I know happened and what's been done: * e107.org was hacked using the exact exploit we patched in .17, it looks like we waited too long to fix e107.org. I have spent the past day attempting to clean everything up and am relatively confident I've cleaned it up, but you never know. If hacks persist, we'll have to resort to more drastic measures. * Yes, there was a zip file that was backdoored. This file was NOT the officially released zip file and the source code was not compromised. While the hackers had access to our server, they uploaded their own version of the full zip file and re-pointed the download link to this corrupt file. It was only the full install .zip file. If you upgraded your version of e107 using files from the full install .zip file, please download the one that is available from sourceforge and re-upgrade. * The current version (0.7.17) is safe (as far as I know) from further attacks in this same manner, there will be a .18 release someday, but there are no immediate plans for it's release. * Yes .17 has a new favicon, this was a mistaken commit by one of the devs and the current .17 package files have this file restored. * When downloading e107 release files, please ensure they are coming from sourceforge, we only release files from there. We have, in the past, provided specific patch files from e107.org locally, but this will stop. If you get a file from somewhere other than sourceforge, don't trust it. If anyone sees anything odd with their sites or with e107.org, or just has specific question, please do not hesitate to contact me personally. Please be patient, I will attempt to answer anything I receive. posted by McFly on Tuesday 26 January 2010 - 11:04:55 comments: 14 ========= [ snap ] ========= besides, when in doubt wether a side was compromised or not, it's useful having a look at the source-code... *cough* cheers gregor -- just because your paranoid, doesn't mean they're not after you... gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2 gpgp-key available @ http://pgpkeys.pca.dfn.de:11371 @ http://pgp.mit.edu:11371/ skype:rc46fi
