Security breach at Opscode as attackers download databases

[Kwelwild]

Updated Opscode, the commercial side of the open source Chef configuration management tool beloved by Google, Facebook, and IBM, has warned customers that a flaw in an unnamed third-party application has left its wiki and ticketing system pwned.

"The attacker gained escalated privileges and downloaded the user database for the wiki and ticketing system," the company said in a blog post on Thursday. "The user database that was accessed contained usernames, email addresses, full names, and hashed passwords."

"We believe these passwords are adequately secure (the software in question uses the PBKDF2 algorithm), but we will be forcing a password change on the ticketing and wiki systems. If you use this password on other systems, we suggest choosing a new password on those systems as well. We will also contact the affected users via email today."

The company was alerted to the attack by internal security monitoring, the attacker has been kicked out, and now a full investigation is underway using forensics the team has gathered. There's no word as to whether the police are involved.

Opscode says there's "currently no evidence" that hosted data has been copied or compromised, but it recommends users who use the same username and password for hosted accounts should also change passwords.

It's an embarrassing issue for a company that has become something of a cloud and datacenter darling of late, but it could happen to anyone these days and such openness is to be commended.

The company promises more details as they become available. ®

Update

Opscode has provided more details about the hacking attack, and says that all hosted Chef data is now confirmed to be secure and untouched.

"The attack happened around 1pm yesterday, and our security systems picked it up in under five minutes," Pauly Comtois, director of operations, told El Reg. "Once we were alerted that someone was running a script in the system, we pulled the plug on the box and took it offline immediately."

Overnight, two Opscode teams worked on the problem. The first set about rebuilding the wiki and ticketing system from the ground up so that normal services wouldn't be interrupted, while a second team took the original system and started gathering forensic evidence.

It appears the attacker used a vulnerability in the wiki software and ran a JavaScript program from the Uniform Resource Identifier. In the short time before being spotted, the attacker was able to download some database data, but nothing too serious.

While the attacker got some information, all passwords are secure from anything but a brute force attack requiring significant processing time, but Comtois said the company wants to let users know about the breach so that they could take precautions – just in case.

Sursa: Security breach at Opscode as attackers download databases • The Register