"Moshe Goldfarb." <brick_n_straw@xxxxxxxxx> wrote in message
news:9qsrqz2ljhlu$.jjw6mgzd77n9$.dlg@xxxxxxxxxxxxx
> On Sat, 16 Aug 2008 09:11:05 -0400, Ezekiel wrote:
>
>> Linux Mint Server hacked - Attacks visitors to the site
>>
>>
>> http://www.tuxmachines.org/node/29606
>>
>> <quote>
>> Our server was hacked and code was injected into it to make connections
>> on
>> our behalf to pinoc.org and download a trojan called JS/Tenia.d
>>
>> If you visited linuxmint.com in the last two days we recommend you scan
>> your computer to make sure this trojan isn't present. As this attack
>> exploited vulnerabilities within our PHP code we took the opportunity to
>> clean it all and secure every single page against injections in the
>> future.
>> </quote>
>>
>>
>> Sounds like the same script kiddies that hacked every page on Roy
>> Schestowitz's 'secured by linux' website.
>
> It certainly does sound similar to what happened when Roy Schestowitz's
> Linux based web site was hacked.
>
> The difference is that it appears the Mint people acted quickly unlike
> Schestowitz who let his site spew nasties for weeks before fixing it.
I think that Schestowitz got a bit complacent with his thinking that since
he runs linux that it's going to be 100% safe. There have been several
reports like this and usually it's the result of the software not being
fully patched. There's two ways of looking at the software not patched
issue. One way is that it's the users fault and not the software/app
because if they kept current this may not have happened. The other side of
the same coin is that patching/updating software is not 100% reliable. If a
website/mailserver/PBX is running correctly there is a certain amount of
risk involved with updating it ("if it works don't fix it") so sometimes
updates aren't applied because of the concern/lack-of-trust that it may
break something.
>
> --
> Moshe Goldfarb
> Collector of soaps from around the globe.
> Please visit The Hall of Linux Idiots:
> http://linuxidiots.blogspot.com/
** Posted from http://www.teranews.com **
|
|
