I am an avid user of Yahoo! Groups. I have a browser tab open on “My Groups” as long as I’m sitting at any computer, which is 12+ hours a day, and frequently check in on the dozen or so I subscribe to.
And yes, my wife frequently says “get a life!”
Now, security being at the top of my concerns, I sit behind three firewalls here, where my primary use machines click away 24/7.
Two are dedicated hardware firewalls, running SmoothWall, the third is shorewall (and snort) running on this box, a Celeron 1GHz running Mandriva 2007.1
www.smoothwall.org
www.mandriva.com
Snort and shorewall have never reported anything untoward getting by the smoothie(s) and onto this machine. Smoothwall should be mostly impenetrable, without a directed, hands-on attack (no script kiddies, thank you very much) and for a number of years here it has been.
Until now.
I’ll interject that the second firewall has yet to let anything by. Shorewall (via mindi) and snort still tell me nothing, except perhaps that they are bored.
In my setup, the second smoothwall is the only interface (well, real one 😉 ) that the first one’s “green zone” sees. Everything else is in the second “green zone” behind the second smoothie.
For as long as I can remember I’d check the IDS and firewall logs on the second firewall and they’d be empty.
But today, August 19, I saw this in the IDS logs:
(http_inspect) OVERSIZE REQUEST-URI DIRECTORY
Somebody got by the first smoothwall?!
Guess who? Yahoo! Groups!
Needless to say I was floored, disappointed, and becoming increasingly worried as this sinks in…
What’s up with Yahoo? Is it even remotely possible some script kiddie or other has hijacked them?
More I suspect they are “cooperating” with
Now, three of the groups I belong to, and participate in heavily, are no doubt “of interest” to the the type of crowd that could talk Yahoo! into something like this. For the record I consider this intrusion most untoward, and probably unlawful, if it is a conscious effort on Yahoo!’s part.
I won’t mention these group’s specific topics of discussion, except to say we are very interested in cleaning up certain messes various governments have gotten themselves into, and we are making substantial headway.
So what is in fact going on here? Is it simply Yahoo! been compromised? Wouldn’t be the first time, I suppose. But I find this hard to believe. If it were a simple glitch in the TCP/IP flow, it should have been dropped by the first smoothie, as it has dutifully done for years on end without a hitch.
Fragroute? How does Yahoo! Groups allow for someone using that off their IP? Someone would have to be all but dead at the switch for that to happen, it would sure seem to me.
Which is why I suspect “cooperation” of whatever sort.
Anyone with some insight into the IDS report above, please chime in. I’ve googled it and understand what it means, but not what you can do with it, so far as any nefarious intents.
Meantime, I need to figure out what the first firewall needs to prevent this from becoming a habit.
Cliff Jones