建站
咨詢
售后
建站咨詢
新聞中心
這個消息大家前兩天應(yīng)該也知道了，細節(jié)可以看下，黑客是如何在沒有root權(quán)限的情況下從一個服務(wù)器跳到另外的服務(wù)器的。apache.org號稱黑客沒有跳出環(huán)境，代碼也沒有受到影響，但我表示懷疑，apache.org用的fbsd7-stable的內(nèi)核，但milw0rm上有個bsd-ktimer.c （http://www.milw0rm.com/exploits/8261） ，還不知道這exp好用不，說不定黑客故意deface，然后讓apache的人以為僅僅是deface。其實已經(jīng)root了。不過話說apache.org的好些早都被國外某黑客組織給root了，并在apache代碼里留下了邏輯后門，也不差這一次了，反正大家該用還是繼續(xù)用。
創(chuàng)新互聯(lián)建站堅持“要么做到，要么別承諾”的工作理念，服務(wù)領(lǐng)域包括：成都做網(wǎng)站、網(wǎng)站建設(shè)、企業(yè)官網(wǎng)、英文網(wǎng)站、手機端網(wǎng)站、網(wǎng)站推廣等服務(wù)，滿足客戶于互聯(lián)網(wǎng)時代的巨野網(wǎng)站設(shè)計、移動媒體設(shè)計的需求，幫助企業(yè)找到有效的互聯(lián)網(wǎng)解決方案。努力成為您成熟可靠的網(wǎng)絡(luò)建設(shè)合作伙伴！
Netcraft is reporting that apache.org has been compromised. The apache blog posted the following message indicating an SSH key compromise.
“This is a short overview of what happened on Friday August 28 2009 to the apache.org services. A more detailed post will come at a later time after we complete the audit of all machines involved.
On August 27th, starting at about 18:00 UTC an account used for automated backups for the ApacheCon website hosted on a 3rd party hosting provider was used to upload files to minotaur.apache.org. The account was accessed using SSH key authentication from this host.
To the best of our knowledge at this time, no end users were affected by this incident, and the attackers were not able to escalate their privileges on any machines.
While we have no evidence that downloads were affected, users are always advised to check digital signatures where provided.
minotaur.apache.org runs FreeBSD 7-STABLE and is more widely known as people.apache.org. Minotaur serves as the seed host for most apache.org websites, in addition to providing shell accounts for all Apache committers.
The attackers created several files in the directory containing files for （www.apache.org）, including several CGI scripts. These files were then rsynced to our production webservers by automated processes. At about 07:00 on August 28 2009 the attackers accessed these CGI scripts over HTTP, which spawned processes on our production web services.
At about 07:45 UTC we noticed these rogue processes on eos.apache.org, the Solaris 10 machine that normally serves our websites.
Within the next 10 minutes we decided to shutdown all machines involved as a precaution.
After an initial investigation we changed DNS for most apache.org services to eris.apache.org, a machine not affected and provided a basic downtime message.
After investigation, we determined that our European fallover and backup machine, aurora.apache.org, was not affected. While the some files had been copied to the machine by automated rsync processes, none of them were executed on the host, and we restored from a ZFS snapshot to a version of all our websites before any accounts were compromised.
At this time several machines remain offline, but most user facing websites and services are now available.
We will provide more information as we can.”
Netcraft: （http://news.netcraft.com/archives/2009/08/28/apacheorg_compromised.html）
Apache Blog: （http://blogs.apache.org/infra/）
ZDNET: （http://blogs.zdnet.com/security/?p=4147）
TheRegister: （http://www.theregister.co.uk/2009/08/28/apache_hack/）
當(dāng)前文章：apache.org被黑了
文章來源：http://www.fisionsoft.com.cn/article/cogeicc.html
