<html><head><title>WineHQ database compromise</title>
<META http-equiv=Content-Type content="text/html; charset=windows-1251">
</head>
<body>
<span style=" font-family:'Courier New'; font-size: 9pt;">Hello Jwhite,<br>
<br>
Could you share the encryption procedure your system was using to store the hashes in the database? Was it using the secret word <br>
which all so became a public domain? Was it a default Bugzilla authorization method? How much time it would require to brute force the passwords?<br>
<br>
In the future try to avoid using "out of the box" encryption which allows passwords to be brute forced. If an attacker wouldn't know <br>
the algorithm the hash was generated with it would be nearly impossible to brute force the hashes.<br>
<br>
I recommend to move the authorization mechanics out of the host directories in a way which would prevent an attacker <br>
who gained control over the virtual host files to read authorization algorithms. <br>
<br>
How is it possible that you don't know how the passwords were stolen but you know that they were stolen? Aren't there HTTP secure log archive? <br>
Check out host secure log. It's important to understand how the info leaked to close the leak. May be an attacker gained<br>
access to another virtual host and through that access downloaded the database. In this case you may loose information again. <br>
<br>
The key to the answer HOW is apache & mysql logs, scrutinize them and you'll understand what happened. If there is an unknown bug in mysqladmin you <br>
will immediately catch it. At least you will know if an attacker got DB access through your host. <br>
<br>
<br>
Many people around here might be interested if it's really worth changing passwords which are at least 6 letters in length. <br>
<br>
<br>
You told us that phpmyadmin was obfuscated, it excludes a scanner getting access over the database. <br>
Hacking WINE bugzilla is a foul job and only a teenager kid (or an man which is still young in his soul) would ever do that.<br>
Kids are usually gaining access to the filesystem first. Check out if there is a change in templates... which leaked <br>
the cookies or passwords in files which could be read. <br>
<br>
The worst thing that could happen is that the passwords would be decrypted and added to the automatic scanners which probe <br>
the online services but I doubt that kind of intelligence from a person hacking bugzillas. <br>
<br>
<br>
Thanks for letting us know most of the services prefer to keep silence over these problems. <br>
<br>
<span style=" font-family:'arial'; font-size: 8pt; color: #c0c0c0;"><i>-- <br>
Best regards,<br>
Igor <a style=" color: #c0c0c0; font-style: normal;" href="mailto:sprog@online.ru">mailto:sprog@online.ru</a></body>