At approximately 10 AM EST today (April 18), a malicious user uploaded an image to OptickleArt. This image really was not an image at all, but rather a PHP script with a different extension. The script injected code into many pages on CafeLinux. org, and as a result users were unable to login to many areas of the site.
If a login was attempted twice, then the page would have a hidden block linked to a malicious site. What the site did is unknown, but in security situations it is best to look at the worst possibilities.
Because the attack merely injected an embedded frame into pages, the only thing that could have been sent to the site was cookie data. If you had at least Firefox 2, the page would have not even loaded due to phishing protection. If the page did load, the only way for CafeLinux cookie data to be sent would be an exploit of an old browser. And finally, if somehow your CafeLinux cookie data was sent to the site, it was just session information. No passwords are stored in cookies.
However, if you logged in at all on or around April 18th before this message, I highly advise you to change your password, since you never know if something else happened with the exploit. No accounts, data, or passwords were taken from the site or its databases.
Until we are able to fix the problem, OptickleArt will remain offline. I apologize if this means you cannot get to your images, but we need to do a full run-down of the site. I have performed a full security audit of all other areas of the site, and have removed all of the malicious code by reverse-engineering the exploit. From this point on, it is safe to access all areas of CafeLinux. org.
Full details will be posted to CafeLinux team members.
Jacob, This is incredible work that you have done. The exploit is troublesome and I am glad to here that you are working on the security of CafeLinux.org.
Jacob, Thank You.
If and when the Optickle Art website comes back up we need to adopt tougher security measures. The new users are already only approved by Admin only, perhaps we can work on further security measures but at this point I am not sure what. Jacob I will defer to your advise on this and I am very glad and truly appreciate that you are on the CafeLinux.org team.
Jozef(AKA Big Sky, RAV TUX, and many other things
)
