Apache SSH Key compromised » CounterMeasures

September 2010
M	T	W	T	F	S	S
« Aug
	1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30

Aug

UPDATE: A post regarding this incident from apache.org is available at https://blogs.apache.org/infra/entry/apache_org_downtime_initial_report

______________________________________________________________________________

As of this moment, Apache.org is reporting that SSH key associated with its US servers has been compromised and are shifting all traffic to their European mirror.

Details of the attack/compromise are few at the moment, as this is breaking news. It is worth remembering however that a compromised SSH key led to in-the-wild exploitation of Linux based systems exactly this time last year, for the purposes of installing rootkits. Keep your eye on how this story develops.

Apache servers account for around 50% of all web servers in the July 2009 web server survey.

Bookmark

| More

This entry was posted on Friday, 28. August 2009 and is filed under "Site Compromise". You can follow any responses to this entry with RSS 2.0. You can leave a response here, or send a trackback from your own site.

6 Comments to "Apache SSH Key compromised"

Carter Cole:
Friday, 28. August 2009 um 5:08 pm

oops… thats crazy they got apache im wondering if we will ever get details about the attack

also math spam protection is way lame see my post here
http://blog.cartercole.com/2009/08/why-textual-captchas-are-fail.html

it would be oh so easy to have my script pull and pares your <span class=”spamText”>Sum of 6 + 8 ?</span>

	Twitter Trackbacks for Apache SSH Key compromised » CounterMeasures [trendmicro.eu] on Topsy.com: Saturday, 29. August 2009 um 3:12 pm

[...] Apache SSH Key compromised » CounterMeasures countermeasures.trendmicro.eu/apache-ssh-key-compromised – view page – cached A Trend Micro Blog. Rik Ferguson and others blog about security related issues — From the page [...]

	Apache Website Owned! \| SecTechno: Monday, 31. August 2009 um 3:19 pm

[...] you can find the screenshot posted by Trendmicro Blog,the identity and reason of this attack still not discovered yet but sharing the information of this [...]

Rik Ferguson:
Monday, 31. August 2009 um 11:37 pm

Thanks Carter, I agree about the math CAPTCHA, but honestly it cut my Spam trashing workload by at least three quarters, that’s enough time for at least two beers, and in my world, that’s a good thing :)

Thanks for reading the blog!
Rik

	Apache.org Hacked Using Remote SSH Key \| Darknet – The Darkside: Wednesday, 2. September 2009 um 8:19 am

[...] on the incident, since removed, have been preserved for posterity in a blog posting by Trend Micro here and F-Secure here. [...]

	ShaunWright.co.uk » Blog Archive » Dare I say, Owned? Again.: Sunday, 13. September 2009 um 3:26 pm

[...] on the incident, since removed, have been preserved for posterity in a blog posting by Trend Micro here and F-Secure here. [...]

Name:

E-Mail (not published)

Website:

Spam protection

Sum of 6 + 8 ?