[Python-Dev] SF hacked

[Thomas Wouters]

It *seems*, from this site:

http://66.92.75.28/~vladimir/themes-org.html

that SourceForge has been hacked, and more seriously than SF first admits
(if I'm to believe the arrogant sprouting of some script-kiddie, anyway. :)
And the same goes for apache.org, it looks like. Anyway, if anyone connected
*from* any of sourceforge's machines to anywhere else, in the last couple of
months, they'll be well advised to change their passwords and check for
intruders. The same goes if you connect through ssh and (foolishly ;)
allowed ssh-agent-forwarding to the SF machines. In that case, better check
all the machines that ssh-agent would give you unpassworded access to for
logins you don't recognize. The site above lists a number of sniffed
passwords, in case you want to check, but there's no reason for the hacker
not to have even more sniffed passwords lying about :)

And if you have a login on apache.org, you probably want to change your
password in any case.... the above listed site has what seems to be a copy
of the shadow password file.

-- 
Thomas Wouters <thomas@xs4all.net>

Hi! I'm a .signature virus! copy me into your .signature file to help me spread!