Vista la gravità dell’attacco tramite una nota nel sito lo staff ha richiesto a tutti gli utenti di effettuare un reset della password dell’account drupal.org.
Come tengono a precisare l’azione hacker è stata resa possibile da falle di sicurezza non dipendenti dal CMS Drupal ma da un applicativo terzo non ancora reso noto. Le password “rubate” non sono solo una parte della totalità degli iscritti al sito ma per precauzione consigliano il reset a tutti gli utenti. Lo staff è in collaborazione con quello dell’Hosting per analizzare quanto accaduto ed individuare il problema.
Questo l’annuncio pubblicato su Drupal.org e questa la parte in cui richiedono li reset della password Drupal.org:
The Drupal.org Security Team and Infrastructure Team has discovered unauthorized access to account information on Drupal.org and association.drupal.org.
This access was accomplished via third-party software installed on the Drupal.org server infrastructure, and was not the result of a vulnerability within Drupal itself. This notice applies specifically to user account data stored on Drupal.org and groups.drupal.org, and not to sites running Drupal generally.
Information exposed includes usernames, email addresses, and country information, as well as hashed passwords. However, we are still investigating the incident and may learn about other types of information compromised, in which case we will notify you accordingly. As a precautionary measure, we’ve reset all Drupal.org account holder passwords and are requiring users to reset their passwords at their next login attempt. A user password can be changed at any time by taking the following steps.
- Go to https://drupal.org/user/password
- Enter your username or email address.
- Check your email and follow the link to enter a new password.
- It can take up to 15 minutes for the password reset email to arrive. If you do not receive the e-mail within 15 minutes, make sure to check your spam folder as well.
All Drupal.org passwords are both hashed and salted, although some older passwords on some subsites were not salted.
In attesa di conoscere i dettagli dell’attacco rinnoviamo il consiglio ai frequentatori della community di Drupal.org di provvedere quanto prima alla reimpostazione della password.