Gawker was hacked early in December. Photo by DBreg2007 on Flickr. Some rights reserved
Hackers had access to the gossip site Gawker's content management system (CMS) and password files for around six months, rather than the few days suggested by the company, the Guardian has learnt from sources connected to the break-in.
That contradicts the indications given by Gawker in public statements, such as an email sent out on 17 December by Thomas Plunkett, Gawker's chief technology officer, in which he suggested that the hackers only had access "briefly" to the site: "Gawker Media servers and some company email accounts were compromised by hackers at some time during the last few weeks; the compromise was made public to us (and everyone else) this past weekend," Plunkett wrote in an internal memo which was reposted on the Poynter.org website.
The hacking of Gawker and its associated sites led to the usernames, email addresses and passwords of 1.3 million registered users of the sites being made available – among them, those for Gawker staff including its chief Nick Denton. The hackers discovered Denton had used the same password for Gawker and for other sites such as Campfire, used by his company to coordinate its work. That allowed them to access those sites and find sensitive details including chats between members of the company.
Sources close to the hacking group Gnosis, which carried out the attack, have told the Guardian that they obtained access to Gawker's server by using a "local file inclusion" (LFI) weakness. Gawker has not previously said whether the access was via a weakness in the Gawker site, via a staff member's password, or some other means.
"The Gawker site LFI [flaw] was found about six months ago," a source close to, but not a member of, Gnosis told the Guardian. "The Campfire access came after the administrator database for the CMS was cracked."
The Guardian asked Plunkett to respond to the claims. He declined to comment and said that the company would offer further clarification later.
Gawker Media was targeted because Denton and the staff decided earlier this year to annoy denizens of 4Chan, the anarchic web forum. The members of Gnosis have their origins in 4Chan and the separate but related Anonymous group, but are not affiliated with them, and do not work on the same projects.
The Guardian's sources insist that the Gnosis attack was not a short-term thing. "They didn't just crack it in a day, they spent a fair bit of time working on it and they had full access for at least a month. Mind you, when the database leak rumour was going around, Gawker publicly announced that they weren't compromised. Either they were lying to the public and trying to fix the hole, or they didn't even notice Gnosis in there – given the proper tools it's very easy to hide yourself on a Linux system."
Once the Gnosis group gained access to the computer server's file system via the LFI weakness, they progressed through the site and examined the files that they found there, including the "Ganja" programs that run the content management system. They also sought out the "passwd" – password – file which they knew would contain information that would let them crack other sites in the Gawker network.
"The configuration file for their webserver (which is often in a predictable location) gave out clues as to the location of password files and the Ganja source code," the Guardian's source explained. "From here [Gnosis] audited Ganja and used the LFI exploit to retrieve more sensitive data. After auditing and finding exploits in Ganja they were able to achieve remote SSH access [secure shell login] to Gawker's servers, which were promptly backdoored [so that the hackers could enter them at any time without it being visible to the server's owners]. From this point they mostly had free rein of the network."
The hackers were able to crack about 250,000 of the passwords, which had been encrypted using a system called
DES, which usually poses a serious computational challenge to reverse. The task was made simpler because many people had used simple passwords such as "password" or "123456", which are especially vulnerable to a "dictionary attack" in which the encrypted password is compared to a standard set of words encrypted by the same method.
Updated: corrected MD5 to DES. Confused with Mozilla, which used MD5. Corrected "pwd" to "passwd" as targeted file.