Within the past three days, open-source community and project hosting network SourceForge has been attacked, its operations team detecting a targeted attack at the sites developer infrasctructure.
As a result of the attack several SourceForge.net servers were exploited, leading the team to shut them down to safeguard user accounts, software projects and protect other services operated by the network. The shutdown has meant that its CVS Hosting, ViewVC (web based code browsing), New Release upload capability and Interactive Shell services were switched off, preventing any further compromise.
According to Wikipedia, SourceForge plays host to over 2 million users and over a quarter of a million software projects. Wanting to protect its users – despite no evidence to suggest user data or passwords were compromised – SourceForge has begun to reset passwords for all its users, after its admins uncovered evidence of password sniffing attempts on the network.
As SourceForge puts it on its blog:
Our investigation uncovered evidence of password sniffing attempts. We have no evidence to suggest that the sniffing attempt was completed successfully. But, what we definitely don’t want is to find out in 2 months that passwords were compromised and we didn’t take action.
If you are a SourceForge user, you will no longer be able to access SourceForge.net with your old password, the site has invalidated all database passwords. Each member will need to go through a simple email recovery process, choosing a new password via the following link.
The team aims to get the site back up and running over the weekend, restoring services back to their former states. It’s a great example of a large internet property putting its users first and making sure any possible data breach is communicated to its users. It can’t be easy to tell 2 million people they now have to change their passwords because of a possible compromise.
Gawker, are you watching?
Get the TNW newsletter
Get the most important tech news in your inbox each week.