Hackers Hit, Compromise Passwords

Hackers Hit, Compromise Passwords
Hackers Hit, Compromise Passwords 

By Brian Prince

The Apache Software Foundation reports that it was hit earlier in April 
by a sophisticated attack that compromised user passwords.

Hackers launched a multistage, targeted attack against the Apache 
Software Foundation's infrastructure April 5 that compromised user 

According to the foundation, the hackers took advantage of an XSS 
(cross-site scripting) vulnerability using a shortened URL to target the 
server hosting issue-tracking software for the open-source group's 
projects. The foundation uses a donated instance of Atlassian JIRA to 
track issues and requests, and hosted the instance on, 
running Ubuntu Linux 8.04 LTS.

"If you are a user of the Apache-hosted JIRA, Bugzilla or Confluence, a 
hashed copy of your password has been compromised," the foundation said 
in an April 13 statement on the Apache Infrastructure Team blog. "JIRA 
and Confluence both use a SHA-512 hash, but without a random salt. We 
believe the risk to simple passwords based on dictionary words is quite 
high, and most users should rotate their passwords."


Register now for HITBSecConf2010 - Dubai, the premier 
deep-knowledge network security event in the GCC, 
featuring keynote speakers John Viega and Matt Watchinski! 

Site design & layout copyright © 1986-2015 CodeGods