I just got an email from admin [at] spreadfirefox.com saying the spreadfirefox web site had been hacked on June 12. Here’s the email…
On Tuesday, July 12, the Mozilla Foundation discovered that the server hosting Spread Firefox, our community marketing site, had been accessed on Sunday, July 10 by unknown remote attackers who exploited a security vulnerability in the software running the site. This exploit was limited to SpreadFirefox.com and did not affect other mozilla.org web sites or Mozilla software.
We don’t have any evidence that the attackers obtained personal information about site users, and we believe they accessed the machine to use it to send spam. However, it is possible that the attackers acquired information site users provided to the site.
As a Spread Firefox user, you have provided us with a username and password. You may also have provided us with other information, including a real name, a URL, an email address, IM names, a street address, a birthday, and private messages to other users.
We recommend that you change your Spread Firefox password and the password of any accounts where you use the same password as your Spread Firefox account. To change your Spread Firefox password, go to SpreadFirefox.com, log in with your current password, select “My Account” from the sidebar, select “Edit Account” from the sidebar, then enter your new password into the Password fields and press the “Save user information” button at the bottom of the page.
The Mozilla Foundation deeply regrets this incident and is taking steps to prevent it from happening again. We have applied the necessary security fixes to the software running the site, have reviewed our security plan to determine why we didn’t previously apply those fixes in this case, and have modified that plan to ensure we do so in the future.
Sincerely,
The Mozilla Foundation
There is a post on the Spread Firefox blog from today at 1:44 AM [PST I assume] that discusees the site being down and describes their investigation and the nature of the hack.
…we’ve been down for a few days. We took the site down to investigate an attack on the site. It appears that a part of Spread Firefox was hacked in an attempt to use it to send out spam. It doesn’t look like the attacker accessed any personal data on the site, but to be safe, we’re encouraging all of our users to log in and change their passwords. If you have an account with Spread Firefox, you probably received an email about this with instructions for updating your password…
I must admit this is a bit disturbing but I’m not all that concerned. Although Apache is a solid server, it’s still a piece of software. Software will always be vulnerable to manipulation and such.
For those interested, here are the headers returned from SpreadFirefox.com
HTTP/1.1 200 OK
Date: Fri, 15 Jul 2005 13:16:16 GMT
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: PHP/4.3.9
Set-Cookie: PHPSESSID=18091fe87ca26363fd9fc11f04b7716e; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Fri, 15 Jul 2005 12:45:03 GMT
ETag: “2e80ab3db7e4b0a86a6b209be509986f”
Connection: close
Content-Type: text/html; charset=utf-8
Jason Dowdell is a technology entrepreneur and operates the Marketing Shift blog.
