Re: Status of Recent User Information Leak

[Nkuvu]

in reply to Status of Recent User Information Leak

"Some time on May 20, 2009, an unused (but still on line) perlmonks server was hacked...
The exploit was published in a hacker e-zine, and was brought to the attention of PerlMonks administrators later that night."

From the text here, it sounds like the exploit was known to the Perlmonks administrators for two full months before anything was done about it. Can someone explain to me why this security breach was wide open for two months without any notification for the people who may have been affected?

Edit to add: The original node has been updated since I posted this, clarifying the point. Specifically, the second sentence I quoted now shows a date.

[Argel]

It could be worded better but the intent is clear -- they found out about it shortly after the ezine was published (which was just recently). If that ezine link went to the actual ezine instead of a Wikipedia entry then we could see the publication date and Co-Rion's intent would be much clearer. Update: reworded previous sentence to be clearer.

[planetscape]

The gods found out about the leak sometime on 07/28/2009. The May 20 date would seem to be the result of forensic sleuthing by the gods/Pair.com. As far as anyone knows, the info was only leaked, by the hackers, as of approximately Jul 28, 2009 at 18:00 CDT (my best guess based on when certain links were posted on certain blogs - I don't feel the need to give any more direct pointers to the hacker 'zine).

[Nkuvu]

It's just the way the original node is worded -- apparently the gods were notified twice, two months apart. I was hoping that Co-Rion just mis-wrote the text and the gods were only notified once, on July 28th.

Added: Note that I'm not looking for a link, and I agree that the fewer links to it, the better (no reason to make them all happy by giving them extra attention, not an attempt at "security through obscurity").

[Argel]

The real problem is it's written as if the intent was to include the link to the ezine. Replace the link to the Wikipedia article with a link to the ezine and the sentence makes perfect sense. Well, you would need to follow the link, but after that it would make sense.

[Anonymous Monk]

Re: the hacker "article" see here: http://staynalive.com/articles/2009/07/30/theres-more-than-one-way-to-store-a-password-perlmonks-hacked/ They claim not to have any further malevolent purposes:

There is a really simple reason we owned PerlMonks: we couldn’t resist more than 50,000 unencrypted programmer passwords. That’s right, unhashed. Just sitting in the database. From which they save convenient backups for us. In case you guys are worried, we did NOT backdoor dozens of your public Perl projects. Honest. Why would we want to do that?