0

Problem

This morning I found that, what I thought was one of our proprietary artifacts, had been published to a public repository:

http://repo.grails.org/grails/simple/codehaus-cache/com/

If you click on the link you see that there are tons of Artifacts from companies like Adobe, Amazon, AOL, BP, ... at least some of which don't look like they were intended for the public.

Navigating down to and downloading any artifact for example

http://repo.grails.org/grails/simple/codehaus-cache/com/aol/advertising/ad-notification-client/2.4.0/ad-notification-client-2.4.0-sources.jar

always yields an identical file of 1.33kb which is not actually a software artifact but an HTML file, and which has been published to the repository for the first time around 170 days ago.

What is also strange is that this repository should be a mirror/cache of yet another repository, but this other repository doesn't actually contain these artifacts,

The situation doesn't seem to be as bad as I thought, since no intellectual property seems to have been actually leaked, but nobody will be really happy with even having their internal project names be public.

Question

Can you help me make sense of this? Could it just be a bug in a version of the Gradle shell or in Artifactory? Could it be a malware related?

1 Answer 1

4

Codehaus was hacked, so repo.grails.org which proxies it, was filling up with the crap. We cleaned it up, tightened the checksum policy to fail the fetching if no valid checksum exists in the remote repo (codehaus) and enabled validation of the jar files integrity.

7
  • Thank you for the answer! However that seems to be only part if the answer, since it doesn't explain how private artifacts got into the codehouse repo, i.e. how did the attacker now private artifact names?
    – Tilo
    Feb 28, 2014 at 20:34
  • All that I have no clue. Just letting you know we secured repo.grails.org.
    – JBaruch
    Feb 28, 2014 at 20:42
  • Great! Thank you!! Can I bother you to delete the artifacts? Probably everything in the codehaus-cache repo under "com" shouldn't be there, cf. repository.codehaus.org/com. For the few exceptions Artifactory will just pull the artifacts again.
    – Tilo
    Feb 28, 2014 at 20:48
  • Already did. Since Artifactory has a checksum search it was very easy to find all the problematic artifacts (they all have the same checksum b95d8d7d1a57cf46d9f0e924f8864f94159bffd3)
    – JBaruch
    Feb 28, 2014 at 20:59
  • Codehaus wasn't hacked, the DNS expired due to a combination of errors. The parking page would have been downloaded by the proxy - and since it wasn't validated put into your cache. Only retaining artifacts with a valid checksum is the correct approach. Mar 1, 2014 at 4:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .