full-disclosure - Re: e107 latest download link is backdoored

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4B5EA7AB.1040709@acunetix.com>
Date: Tue, 26 Jan 2010 10:28:27 +0200
From: Bogdan Calin <bogdan@...netix.com>
To: Christian Sciberras <uuf6429@...il.com>
Cc: full-disclosure@...ts.grok.org.uk
Subject: Re: e107 latest download link is backdoored

Here is my speculation on what happened:

A few days ago, somebody found and exploited a e107 0day (for 0.7.16) on
some websites. The e107 guys were informed about this and released
0.7.17 to fix this problem.

However, at this point I suspect they were already hacked because they
are running e107 on e107.org and they were an obvious target.

The attackers waited until they released the security fix (0.7.17) and
modified the zip file to include the backdoor.

At this point, most e107 site owners were rushing to upgrade because of
security update announcement and I suspect that many people have
downloaded the backdored binary.

However, this is just a speculation. I have no actual data behind it.

Christian Sciberras wrote:
> Don't know the date at your place, but it's 25th Jan here, not 22nd. ;)
> 
> 
> 
> 
> 
> 
> On Mon, Jan 25, 2010 at 10:36 PM, Michael Holstein <
> michael.holstein@...ohio.edu> wrote:
> 
>>> Speaking of silent fixes...
>> Silent? .. it's right on the "news" section of the e107.org front page.
>> To wit :
>>
>> [http://e107.org]
>>
>>
>>        **SECURITY UPDATE** 0.7.17
>>
>> We were recently informed of a very nasty exploit that, as far as we can
>> see, affects almost all e107 0.7 releases. Everyone running e107 needs
>> to get their sites updated as soon as possible. If you are a site owner
>> and you are unable to upgrade for some reason (too much hacked core
>> code), please contact me directly and I can help you with a quick-fix.
>>
>> Please get the word out to all other e107ers. If you find an e107 site
>> out there, post on their site somewhere about this upgrade.
>>
>>
> 
> 
> ------------------------------------------------------------------------
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

-- 
Bogdan Calin - bogdan@...netix.com
CTO
Acunetix Ltd. - http://www.acunetix.com
Acunetix Web Security Blog - http://www.acunetix.com/blog

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/