Forum Moderators: phranque
How did this happen?
On the Elance Security Alert [elance.com] page about this they state they following:
The hackers discovered a security hole on an unprotected page that enabled them to access a data table that contained contact information including name, email address, telephone number, city location, and username, and that contained protected versions of user passwords, in an unreadable format called a one-way hash. Their attack did not access personal financial information such as credit card, bank account, social security or tax ID numbers.
[edited by: phranque at 5:50 am (utc) on July 17, 2009]
[edit reason] added link to quote source [/edit]
Any way one can protect themselves from a similar mess in such environments.
Sign up for, and PASS a securityMetrics scan might help.
IMO the eLance vulnerabilities are the result of too many "bells and whistles:" Excessive Ajax, combinations of multiple technologies (perl, php, JS) all lumped on top of each other and probably with multiple developers interacting and unaware of the possible holes they may be creating.
It's a pretty complex system, when a system gets complex you're bound to have holes in it.
EDIT: This may also be related to a recent "site theft" of the eLance database. An off-shore site sprung up containing all the provider's info without their knowledge. It's been taken down by the ISP only to reappear a few days later.
I will say, the staff is proactive in going after the thieves, but you know the difficulties in actually finding them. It may never end.
Sign up for, and PASS a securityMetrics scan might help.
Hackers just were one step forward.
discovered a security hole on an unprotected page that enabled them to access a data table that contained contact information
If the page was unprotected, it would be public, if it was public, S.M. can scan it, if it didn't detect an XSS or injection vulnerability, it seems to indicate either S.M. is not doing as well as it should be or a scan was never run. Just my take without further knowledge . . . I've had to bring servers up to S.M. validation (except for system vulnerabilities) and I can testify . . . they are brutal.
However if an S.M. scan was run and eLance can verify this, it turns our attention to securityMetrics.
The unprotected page might have been added or edited between the scans.
Just another suggestion.
