130 captures

20 Nov 2002 - 07 Jul 2008

Dec	JAN	Feb
	27
2004	2005	2006

success

fail

About this capture

COLLECTED BY

Organization: Alexa Crawls

Starting in 1996, Alexa Internet has been donating their crawl data to the Internet Archive. Flowing in every day, these data are added to the Wayback Machine after an embargo period.

Collection: Alexa Crawls EA

Crawl data donated by Alexa Internet. This data is currently not publicly accessible

TIMESTAMPS

What's Happening?

It has been discovered that the server hosting JabberStudio has been hacked (cracked if you want to say that) for what appears to be one year. Careful analysis of logs and other information shows that the attack was an automated rootkit and it was never used to view or alter files. Regardless, we feel it is vital that all files be reviewed for any malicious changes before they are copied over to new machines and publicly distributed again.

First, we suggest that anyone that has used JabberStudio change their external passwords, especially if they connected to any machine from the JabberStudio shell server. All user accounts on the machine have been suspended until the new machines are finalized, so don't attempt to change your shell server password.

Next, all of the projects, listed below, need their admins to download the linked files, review them, and then contact temas once complete. Further, the files that have been actually publicly released (the releases dir) need to have MD5 sums sent to temas so that others may verify their old downloads. The MD5 sums are not necessary for CVS or WWW files. Once in contact with temas a method of extracting other files that were on the system will be discussed.

The admins review needs to verify that all the CVS source code was actually written by the project participants, and not altered in any way. They need to check releases for any alterations including such acts as modified source, modified binaries, modified installers, etc. Web files should be checked for any hidden changes, tracking, bad links, binary objects, etc. If you feel you don't understand what to look for please contact temas.

Project admins will have two weeks from Friday January 28, 2005 to complete this process. That is an end date of Friday, February 11, 2005. Any projects that have not reported back in that time will be removed from the website and new server until they can be verified.

Apologies to the community that this was not discovered much sooner, and that the cleanup process has to be so involved.

Finally, I want to reiterate that there is no evidence that downloaded files have been compromised in any way, but if we find any evidence contrary to this it will be immediately spread through the appropriate channels.

Projects