full-disclosure - Jabberstudio.org compromised

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050129232138.A20360@evita.devdas.geek>
From: devdas at dvb.homelinux.org (Devdas Bhagat)
Subject: Jabberstudio.org compromised

Just a heads up for everyone:

<quoting jabberstudio.org>
What's Happening?

It has been discovered that the server hosting JabberStudio has been
hacked (cracked if you want to say that) for what appears to be one
year. Careful analysis of logs and other information shows that the
attack was an automated rootkit and it was never used to view or alter
files. Regardless, we feel it is vital that all files be reviewed for
any malicious changes before they are copied over to new machines and
publicly distributed again.

First, we suggest that anyone that has used JabberStudio change their
external passwords, especially if they connected to any machine from the
JabberStudio shell server. All user accounts on the machine have been
suspended until the new machines are finalized, so don't attempt to
change your shell server password.

</quote>

A whole year? Don't these guys use tripwire or aide or equivalent? Or
are they just overloaded with real life?

Devdas Bhagat