Dataloss.net: How we defaced www.apache.org

[ Thanks to S.Ramaswamy for this link.
]

“This paper does _not_ uncover any new vulnerabilities. It
points out common (and slightly less common) configuration errors,
which even the people at apache.org made. This is a general
warning. Learn from it. Fix your systems, so we won’t have to
:)”

“This paper describes how, over the course of a week, we
succeeded in getting root access to the machine running
www.apache.org, and changed the main page to show a ‘Powered by
Microsoft BackOffice’ logo instead of the default ‘Powered by
Apache’ logo (the feather). No other changes were made, except to
prevent other (possibly malicious) people getting in.”

“Note that the problems described in this paper are not
apache-related, these were all config errors (one of ‘m straight
from BugZilla’s README, but the README had enough warnings so I
don’t blame the BugZilla developers). People running apache httpd
do not need to start worrying because of anything uncovered
herein.”

“We hacked www.apache.org because there are a lot of servers
running apache software and if www.apache.org got compromised,
somebody could backdoor the apache server source and end up having
lots of owned boxes.”

“We just couldn’t allow this to happen, we secured the main
ftproot==wwwroot thing. While having owned root we just couldnt
stand the urge to put that small logo on it.”

Complete
Story