Beefy Boxes and Bandwidth Generously Provided by pair Networks
Keep It Simple, Stupid
 
PerlMonks  

Re: Status of Recent User Information Leak

by Nkuvu (Priest)
on Jul 30, 2009 at 23:20 UTC ( #784766=note: print w/ replies, xml ) Need Help??


in reply to Status of Recent User Information Leak

"Some time on May 20, 2009, an unused (but still on line) perlmonks server was hacked...
The exploit was published in a hacker e-zine, and was brought to the attention of PerlMonks administrators later that night.
"

From the text here, it sounds like the exploit was known to the Perlmonks administrators for two full months before anything was done about it. Can someone explain to me why this security breach was wide open for two months without any notification for the people who may have been affected?

Edit to add: The original node has been updated since I posted this, clarifying the point. Specifically, the second sentence I quoted now shows a date.


Comment on Re: Status of Recent User Information Leak
Re^2: Status of Recent User Information Leak
by Argel (Prior) on Jul 30, 2009 at 23:31 UTC
    It could be worded better but the intent is clear -- they found out about it shortly after the ezine was published (which was just recently). If that ezine link went to the actual ezine instead of a Wikipedia entry then we could see the publication date and Co-Rion's intent would be much clearer. Update: reworded previous sentence to be clearer.

    Elda Taluta; Sarks Sark; Ark Arks

Re^2: Status of Recent User Information Leak
by planetscape (Canon) on Jul 31, 2009 at 11:21 UTC

    The gods found out about the leak sometime on 07/28/2009. The May 20 date would seem to be the result of forensic sleuthing by the gods/Pair.com. As far as anyone knows, the info was only leaked, by the hackers, as of approximately Jul 28, 2009 at 18:00 CDT (my best guess based on when certain links were posted on certain blogs - I don't feel the need to give any more direct pointers to the hacker 'zine).

    HTH,

    planetscape

      It's just the way the original node is worded -- apparently the gods were notified twice, two months apart. I was hoping that Co-Rion just mis-wrote the text and the gods were only notified once, on July 28th.

      Added: Note that I'm not looking for a link, and I agree that the fewer links to it, the better (no reason to make them all happy by giving them extra attention, not an attempt at "security through obscurity").

        The real problem is it's written as if the intent was to include the link to the ezine. Replace the link to the Wikipedia article with a link to the ezine and the sentence makes perfect sense. Well, you would need to follow the link, but after that it would make sense.

        Elda Taluta; Sarks Sark; Ark Arks

Re^2: Status of Recent User Information Leak
by Anonymous Monk on Jul 31, 2009 at 17:59 UTC
    Re: the hacker "article" see here: http://staynalive.com/articles/2009/07/30/theres-more-than-one-way-to-store-a-password-perlmonks-hacked/ They claim not to have any further malevolent purposes:
    There is a really simple reason we owned PerlMonks: we couldnít resist more than 50,000 unencrypted programmer passwords. Thatís right, unhashed. Just sitting in the database. From which they save convenient backups for us. In case you guys are worried, we did NOT backdoor dozens of your public Perl projects. Honest. Why would we want to do that?

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://784766]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others imbibing at the Monastery: (3)
As of 2014-11-23 03:47 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    My preferred Perl binaries come from:














    Results (128 votes), past polls