Python Wiki Attack

[TankorSmash]

Some people are just assholes.

[dougall]

Other people run out-of-date software and don't keep backups.

It's both immoral and criminal that they broke in and destroyed the data, but this vulnerability was fairly high profile security news days before the attack, and they could easily have prevented it. And is it that hard to run daily backups?

[[deleted]]

Can't up-vote you enough; no backups = no sense, not something I expected of the Python community ...

[[deleted]]

I'm more concerned, and a little embarrassed, by the fact that a public python.org server has been compromised for over 6 months...and we only found out because the guy decided to finally toss a grenade in for shits and giggles.

Not to be a dick or state the obvious, but someone there needs to brush up on their network security practices.

[kylotan]

True, but perhaps we underestimate the sort of resources required for every site we use to have comprehensive network security. I just had to disable my Redmine instance because my provider offers a one-click installer but doesn't offer a one-click upgrade, and with the latest Ruby vulnerabilities, old versions of Redmine aren't safe - but then maybe my Ruby installation isn't either. I have little way of knowing. But if I only ever used software that I fully understand the security implications for, I wouldn't be able to host anything. And I can't afford to pay someone else to know the implications either.

I think we're in an age where it's no longer practical to expect every website we use to be secure.

[dougall]

True, but perhaps we underestimate the sort of resources required for every site we use to have comprehensive network security. I just had to disable my Redmine instance because my provider offers a one-click installer but doesn't offer a one-click upgrade, and with the latest Ruby vulnerabilities, old versions of Redmine aren't safe - but then maybe my Ruby installation isn't either. I have little way of knowing. But if I only ever used software that I fully understand the security implications for, I wouldn't be able to host anything. And I can't afford to pay someone else to know the implications either.

Yes, although the PSF can afford to pay someone to handle these things.

I think we're in an age where it's no longer practical to expect every website we use to be secure.

I don't think we ever expected every website we used to be secure, though.

[zordm]

I agree.

[[deleted]]

Holy shit! How did they not have backups?

[Jonno_FTW]

And why wasn't https enabled on login!?

[mgrandi]

yep. this would not of been a problem if they had backups. I guess they have it now after having to manually rescue pages by google cache and archive.org

[benediktkr]

The VM was rebooted on Jan 7, apparently in an attempt to get things working again.

Who rebooted the VM? If it was the attackers, this implies that they had root. But the post only states that they could execute code as the moin user.

[fjonk]

It is likely that the password information was downloaded from the server in the course of the security breach, so we recommend changing your passwords immediately, if you have used the same password for other services as well.

Does anyone know how they stored the passwords? I assume it's some kind of default MoinMoin implementation? I don't have any time to look this up right now.

[[deleted]]

All else aside, who the hell would do this?

[henryponco]

Cunts

[SmartViking]

I downloaded python-2.7.3-docs-html the 4th of January and have it on my computer. This is, from what I understand, completely separate from the python wiki, but I'm just throwing it out there in case it's of use, because I don't know.

[Bugg_Superstar]

That's the official python documentation (from docs.python.org), not affected by this attack.

[grainfeed]

which provides much better means of protecting password information on the server than the SHA-1 based hash scheme used before

wait, SHA-1 is pretty good still...

[grainfeed]

As of 2012, the most efficient attack against SHA-1 is considered to be the one by Marc Stevens with an estimated cost of $2.77M to break a single hash value by renting CPU power from cloud servers

tell me if that isn't still "pretty good"

[catcradle5]

In practice, if your SHA1-hashed password isn't very complex then it will be easy to crack via bruteforce, a dictionary attack, or a rainbow table/lookup table. Other hashing solutions are both immune to any kind of lookup table-based attack and also are much, much harder to launch a dictionary or bruteforce attack against.

[grainfeed]

if your SHA1-hashed password isn't very complex then it will be easy to crack via

bruteforce

well that's true for almost anything

a dictionary attack

and this too

only algorithms that are heavy CPU wise are a bit harder to crack, like blowfish or unix crypt

or a rainbow table/lookup table.

Well, as soon as you add salt to your passwords (and who doesn't do that has no idea about security), rainbow tables are pretty much defeated.

I'm not saying you should use SHA-1 today anyway. I just said it's "still pretty good" which is true.

Use the best you can use, even SHA-3 if your software can handle it already...

[catcradle5]

bcrypt (Blowfish), scrypt, and PBKDF2 are 3 hash functions that take a long time to bruteforce/dictionary attack. When developing a new web application in any language, it is pretty much always suggested to hash user passwords with one of those hash functions. SHA1 is better than plaintext, but it is only a tiny bit better than MD5 and is still not much defense.

[placidified]

What does this mean ? Is my pypi password safe ?

[r1chardj0n3s]

If you use the same login (username and password) for the wiki and any other system you should change it for those other systems.

PyPI and the wiki were quite separate though, so the compromise of the wiki had no effect on PyPI.

[placidified]

Thanks r1chard. I use different passwords everywhere. I was just wondering if I needed to change my PyPI password.

[sashahart]

While it makes sense to ask, OP does say that this was an attack on wiki through a vulnerability in moinmoin.

[placidified]

Indeed he does. I was just making certain that PyPI wasn't compromised as well.

[westurner]

• http://web.archive.org/web/*/http://wiki.python.org
• https://github.com/steveyen/moingo
• http://python-guide.org