Foro de

Foros Generales => Noticias => Mensaje iniciado por: WHK en 29 Mayo 2013, 23:56 pm

Título: Servidores de Drupal Hackeados y Sistemas comprometidos
Publicado por: WHK en 29 Mayo 2013, 23:56 pm
Hace pocos segundos me ha llegado un comunicado oficial por parte de Drupal comentando que sus servidores han sufrido un ataque de intrusión.

Se recomienda a los registrados en el portal a que actualicen sus credenciales de acceso y a los que utilizan el sistema a volver a descargarlo ya que no se sabe aun si hay descargas comprometidas con algún backdoor. (

Mensaje original:
Dear community member,

We respect the privacy of your information, which is why, as a precautionary measure, we are writing to let you know about an incident that involves your personal information. The Security and Infrastructure Teams have discovered unauthorized access to account information on and Information exposed includes usernames, email addresses, and country information, as well as hashed passwords. However, we are still investigating the incident and may learn about other types of information compromised, in which case we will notify you accordingly.

This unauthorized access was made via third-party software installed on the server infrastructure, and was not the result of a vulnerability within the Drupal software itself. This notice applies specifically to user account data stored on and, and not to sites running Drupal generally.

We have implemented additional security measures designed to prevent the recurrence of such an attack, and to protect the privacy of our community members.

The next time you attempt to log into your account, you will be required to create a new password.

Below are steps you can take to further protect your personal information online. We encourage you to take preventative measures now to help prevent and detect the misuse of your information.

First, we recommend as a precaution that you change or reset passwords on other sites where you may use similar passwords, even though all passwords on are stored salted and hashed. All passwords are both hashed and salted, although some older passwords on were not salted. To make your password stronger:

* Do not use passwords that are simple words or phrases
* Never use the same password on multiple sites or services
* Use different types of characters in your password (uppercase letters, lowercase letters, numbers, and symbols).

Second, be cautious if you receive emails asking for your personal information and be on the lookout for unwanted spam. It is not our practice to request personal information by email. Also, beware of emails that threaten to close your account if you do not take the "immediate action" of providing personal information.

For more information, please review the security announcement and FAQ at If you find any reason to believe that your information has been accessed by someone other than yourself, please contact the Drupal Association immediately, by sending an email to

We regret that this incident has occurred and want to assure you we are working hard to improve security.

Thank you,
Holly Ross
Drupal Association Executive Director


Título: Re: Servidores de Drupal Hackeados y Sistemas comprometidos
Publicado por: WHK en 29 Mayo 2013, 23:57 pm
No se cual sea la falla especificamente pero supongo que bastará hacer un diff de la versión actual con la anterior, pero por lo que se ve es un agujero de seguridad muy crítico.