3 ms·
the attacker left their IP address in the dump, and their LAN interface address Edit: it's whoever dumped this as opposed to an attacker I don't think tumblr
by nikcub 16y ago
the attacker left their IP address in the dump, and their LAN interface address
Edit: it's whoever dumped this as opposed to an attacker
I don't think tumblr have acted on this yet. The other exposed pages have S3 API secret keys, facebook api secret keys, the username and passwords for vimeo, clickatell (whatever that is), twitter oauth secret key, etc. they are going to have to revoke and re-setup each of these.
- mattkirman 16y agoIt doesn't really look like there was any attack. One of the developers made a mistake with the PHP opening tag in the config file. Anyone visiting the page would have seen this output.
- bl4k 16y agothere are dozens of pages that have been exposed on this one server. I have no idea how the opening tag can get mangled in so many different files
- elliottcarlson 16y agoBy having a central config file that is included throughout the pages. Once included, it's not parsing it as PHP because it has the typo in it - thus showing it on all pages that include that file...
- jarin 16y agoIf the typo is in a top-level layout file or something that would happen.