Drupal.org User Accounts Compromised 60
An anonymous reader writes "The Drupal.org team released a bulletin this evening notifying users of a breach in their infrastructure.
From the bulletin: 'The Drupal.org Security Team and Infrastructure Team has discovered unauthorized access to account information on Drupal.org and groups.drupal.org.
This access was accomplished via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself. This notice applies specifically to user account data stored on Drupal.org and groups.drupal.org, and not to sites running Drupal generally.
Information exposed includes usernames, email addresses, and country information, as well as hashed passwords...
All Drupal.org passwords are both hashed and salted, although some older passwords on some subsites were not salted.'
Users are encouraged to update their Drupal.org passwords and the passwords of any accounts that could be linked via the compromised information."
Re:third-party software? (Score:4, Interesting)
They probably don't know what happened.
If I was a hacker, attempting to gain user account passwords - here's how I'd do it:
1. I'd breach the server and install something that would capture newly submitted raw passwords prior to them being salted/hashed
2. I'd inform the site owner that I'd hacked them and provide some proof. The site owner then warns everyone to change their passwords.
3. New, fresh, raw, non-salted, non-hashed passwords come flowing in.
Rainbow tables and brute-force password cracking is resource intensive. Why not grab 'em while they're in the clear?