Admins Acknowledge Mistakes That Lead to Apache.or

The Apache Infrastructure Group has released an in depth analysis from the latest assault that led to multiple apache.org servers currently being compromised. Right after outlining the mistakes that made the incident feasible and their prepare to reinforce security, the admins have been congratulated by the local community for his or her openness.

The full report printed about the Apache Foundation's blog starts by stressing that,Cheap Windows 7, "At no time were any Apache Software Basis code repositories, downloads, or users put at risk by this intrusion," and explains that, "Providing a detailed account of what happened will make the internet a better place, by allowing others to learn from our problems."

It was confirmed that the point of entry for the attackers was the server hosting the Apache Conference website (apachecon.com), which was becoming maintained by a third-party company. The attackers gained root privileges within the machine,Office 2010 Serial Product Key, possibly by using a local privilege escalation exploit. There is few information available about how they got access, because they deleted the logs.

What's certain, though,buletininfo.com Menkes dan IPB Perlu Umumkan Susu, is that they used the SSH key associated to an account the Apache Infrastructure Staff had on that server for backup purposes, to jump to people.apache.org, the Foundation's "staging machine for our mirror network," as it is called in the report. The newly obtained access was used to write CGI scripts into the document root of the apache.org website, which then got propagated on all mirrors, due to automatic sync processes. These scripts were later executed from the attackers over HTTP in order to obtain remote shells.

The first thing that the Apache Infrastructure Group criticize themselves for is the SSH keys implementation, which, according to their own account,Microsoft Office 2007 Key, left a lot to become desired. "We did not restrict SSH keys appropriately, and we were unaware of their misuse," they write. The second one is leaving ExecCGI enabled,Windows 7 X86, even though most of their websites don't require it. Finally, the current setup with the rsync and logging processes also contributed to the success of the assault.

The admins are in the process of making changes to address many of these difficulties. These involve, but are not limited to, requiring all users with elevated privileges to use OPIE for sudo on certain machines, recreating and using new SSH keys, one per host, for backups, while also enforcing use with the from="" and command="" strings in the authorized key file about the destination backup server,Microsoft Office Standard 2007 Key, disabling CGI support on most website systems and re-implementing measures such as IP banning right after many failed logins, on all machines.

"What really impresses me, however, is how well Apache handled the potentially highly embarrassing incident – taking swift action and keeping their users informed via blog updates. […] So bravo to Apache for responding to the problem rapidly and with openness, proving it is possible to turn a potentially bad story into a positive experience," Graham Cluley, senior technology consultant at antivirus vendor Sophos, comments.
Follow the editor on Twitter @lconstantin