Full Disclosure mailing list archives
WordPress.com root level compromise
From: nix () myproxylists com
Date: Wed, 13 Apr 2011 22:28:54 +0300
---------------------------- Original Message ---------------------------- Subject: [New post] Security Incident From: "WordPress.com News" <no-reply () wordpress com> Date: Wed, April 13, 2011 8:58 pm To: nix () myproxylists com -------------------------------------------------------------------------- Post : Security Incident URL : http://en.blog.wordpress.com/2011/04/13/security/ Posted : April 13, 2011 at 4:46 pm Author : Matt Tags : security Tough note to communicate today: Automattic had a low-level (root) break-in to several of our servers, and potentially anything on those servers could have been revealed. We have been diligently reviewing logs and records about the break-in to determine the extent of the information exposed, and re-securing avenues used to gain access. We presume our source code was exposed and copied. While much of our code is Open Source, there are sensitive bits of our and our partners' code. Beyond that, however, it appears information disclosed was limited. Based on what we've found, we don't have any specific suggestions for our users beyond reiterating these security fundamentals: * Use a strong password, meaning something random (https://www.grc.com/passwords.htm) with numbers and punctuation. * Use different passwords for different sites. * If you have used the same password on different sites, switch it to something more secure. (Tools like 1Password (http://agilewebsolutions.com/products/1Password) , LastPass (http://lastpass.com/) , and KeePass (http://keepass.info/) make it easy to keep track of different unique logins.) Our investigation into this matter is ongoing and will take time to complete. As I said above, we've taken comprehensive steps to prevent an incident like this from occurring again. If you have any questions or concerns, please leave a comment below or contact our support (http://en.support.wordpress.com/contact/) . Add a comment to this post: http://en.blog.wordpress.com/2011/04/13/security/#respond -- WordPress.com | Thanks for flying with WordPress! Manage Subscriptions http://subscribe.wordpress.com/?key=f789a3089316029758e7760f1dd2adad&email=nix%40myproxylists.com Unsubscribe: http://subscribe.wordpress.com/?key=f789a3089316029758e7760f1dd2adad&email=nix%40myproxylists.com&b=aCdPTreN%3FJ%2Cm8TRK2pKA%2FOqOK%3FmeJaJqtroqk%3D%2Bccpazu%3D%5BB
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- WordPress.com root level compromise nix (Apr 13)