On Tuesday, November 3rd, it was discovered that scratchvm.drupal.org, used
for testing Drupal infrastructure upgrades, was compromised by a brute force
attack on a weak account password. The attacker was NOT able to achieve root
access to the server. However, to ensure the continued security of user
accounts, the Infrastructure Team has revoked passwords for Drupal CVS
accounts and for Infrastructure Team members. If you do not have CVS access,
and are not a member of the Drupal Infrastructure Team, YOU MAY IGNORE THIS
EMAIL. Likewise, if you have a CVS account which is no longer in use, you can
ignore this email and your account will remain securely locked out.
-------- CVS ACCOUNT PASSWORDS
-----------------------------------------------
A mirror of the Drupal CVS repository was stored on the compromised server.
This included secure hashes of CVS passwords. While it is extremely unlikely
that CVS accounts could be compromised, passwords have been revoked as a
precaution. To reset your CVS account password:
1) Log in to your user account at http://drupal.org/
2) Click on "My account" in the navigation block.
3) Click the "Edit" tab for your account.
4) Click the "CVS" sub-tab under "Edit".
5) Enter a new password, and click "Save".
6) Wait AT LEAST 30 MINUTES before attempting to use your CVS account. This
time is needed for the CVS server to synchronize your password.
If you cannot access your CVS account after following these steps, please
file a support request in the Drupal infrastructure issue queue:
http://drupal.org/project/issues/infrastructure
-------- DRUPAL INFRASTRUCTURE TEAM PASSWORDS
--------------------------------
Stored Subversion credentials are stored in clear-text, and were potentially
exposed to the attacker. By default, your username and password would be
stored for any protected subversion server accessed from scratchvm, such as
svn.drupal.org. While it is unlikely that the attacker accessed Subversion
passwords, in order to protect your account, infrastructure.drupal.org
passwords have been revoked. To reset your Infrastructure Team password:
1) Browse to https://infrastructure.drupal.org/user/password
2) Enter your user name or email address.
3) Follow the instructions sent to your email to use the one-time login
link.
4) Reset your password with a different password then what you previously
used.
5) If you have Subversion access, WAIT AT LEAST 30 MINUTES before accessing
your Subversion account. This time is needed for the Subversion server to
synchronize your password.
If you cannot access your Subversion account after following these steps,
please file a support request in the Drupal infrastructure issue queue:
http://drupal.org/project/issues/infrastructure
-------- USERS OF SCRATCHVM.DRUPAL.ORG
---------------------------------------
If you accessed a protected SVN server other than svn.drupal.org, or used
other programs which saved passwords in clear-text, it is recommended that
you change your password for those services.
