Apache project server hacked, passwords compromised

The attack may be related to another intrusion at collaboration vendor Atlassian

Hackers broke into a server used by the Apache Software Foundation to keep track of software bugs.

The attack did not compromise the open-source Web server's source code repository, but it did give hackers access to a server used by the project to keep track of bugs, and they also obtained low-privilege accounts on another server used to maintain the people.apache.org Web site, according to Philip Gollucci, vice president of Apache infrastructure. "None of the source code was affected in any way," he said.

By taking advantage of a common Web programming error known as a cross-site scripting bug, and then using another password-guessing attack, hackers were able to break into the Atlassian JIRA software used by Apache. They then installed a password stealing program on that software, ultimately seizing full control of the machine. That gave them access to two other programs hosted by Apache on the same server, the Confluence wiki program and Bugzilla.

The intruders stole three cached login credentials from the compromised server to get access to the Minotaur.apache.org server that runs People.apache.org and provides shell accounts for Apache developers, but were unable to do much with these low-level accounts, Gollucci said. Even the data on its bugtracking systems is not sensitive, as Apache does not store information about security flaws on any of these servers, he said.

The unidentified attackers broke into Apache's JIRA server on April 6 and had begun stealing user passwords by the time Apache administrators noticed the issue on April 9.

In an attack launched at the same time, intruders were also able to break into Atlassian's own servers and gain access to customer user names and passwords. Atlassian employes several Apache developers, and attackers could have used the information from the Apache attack to try to break into accounts at Atlassian. "It's hard to say whether it was directed at Apache or at Atlassian," Gollucci said.

These passwords may prove to be valuable if Apache or Atlassian developers happen to use the same passwords on their source control systems. Then the attackers could make changes to the source code -- adding back door access to Apache projects, for example, said Chris Wysopal, chief technology officer with Veracode, via a text message.

Atlassian sells software development tracking and collaboration products, including the JIRA and Confluence software used by Apache.

According to a Atlassian blog post, hackers were able to access an unencrypted database of usernames and passwords used to login to customer accounts. "The breach potentially exposed passwords for customers who purchased Atlassian products before July 2008," Atlassian CEO Mike Cannon-Brookes said in a blog post. "We made a big error. For this we are, of course, extremely sorry. The legacy customer database, with passwords stored in plain text, was a liability."

Atlassian could not be reached immediately for comment.

This is not the first time the Apache Software Foundation has been hit by hackers. Last August intruders were able to break into the Minotaur server and run their owns scripts on Apache's Web site.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags atlassianhackpasswordsdata theftapache

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?