Myacen, my ISP, just put up a notice on its support forums that it is banning Movable Type and erasing it from all users' directories. They don't explain why. Suggest you contact Myacen.

Weird to do this without stating a reason. One of my hosters, hostingmatters, recently banned GreyMatter scripts for new clients, citing a security flaw that allowed upload of php scripts through comments and resource issues (they allow existing accounts to stay if they do a script patch to close the comments hole). But hey, at least they stated *why* and offered alternatives.

If I were you, I'd demand an explanation of "why" from Myacen.

Cheers,

Myacen banned it because of this post on the Cpanel forums :

http://forums.cpanel.net/showthread.php?s=...&threadid=12013


Can somebody in MT please verify the problem quick.

What does the post say? I don't want to register just to read it.

If it's about posting malicious code in comments, the Sanitize feature of MT addresses this.

Here's what I found at the CPanel forum:
The first post:


the next:



And the next:


And the next:



And here is what is being said by "Robert" the staffer at MyAcen. I suggest that MT contact them soonest!



Get aload of thsi customer service!:


and this:

So, they don't know for sure that it's MT, they just assume because the two users who got hacked were both using MT that it must be MT's fault??

I'm a Myacen customer and a MT user. Myacen have not assumed anything. They have taken the precaution to ban MT which COULD be the source of the problem and I agree with their decision. I would much rather know that they have taken steps to protect their customers than risk security.

If and when the exact source of the problems are determined I'm sure Myacen will consider lifting the ban (if MT is not the problem).

As for their customer service - I have had bad experiences with other hosts in the past who are clearly motivated by money and do not know the meaning of customer service and support. I for one am grateful that Myacen have always been upfront and honest and it's reassuring to know that they care more about security and protecting their customers rather than losing a few dollars on those existing (and potential) customers who will consider leaving over a banned script.

I'd be more impressed with their current (and hopefully tentative) decision if they had found something in the web server logs. Finding a shell script in the history file says that the culprits had an interactive session, and provides no supporting evidence for the conclusion that they got in by exploiting a CGI script.

Speaking of which, do the web servers at this ISP actually run as the user whose home directory is /root? As in the user "root"? Sorry, but that piece of the evidence makes it look like someone cracked the machine in a way that is unlikely to have anything to do with CGI. Either that, or the folks running the site have an odd sense of humor when it comes to setting up customer environments.

I should note that I'm running MT on a chrooted Apache using mod_perl, and it couldn't run a shell script if it wanted to, because there aren't any shells (or any other binaries, for that matter) inside the chroot. The fact that this extremely limited environment doesn't impair MT's functionality suggests that the package is pretty well self-contained, and is quite likely one of the safer Perl scripts you could be running on your server.

The only external calls I see in a casual audit are to sendmail and imagemagick/netpbm, and they look pretty clean. Also optional.

Could it be MT? Sure. It could also be PHP, Cpanel, lousy passwords, or a hack to some completely unrelated daemon that's listening for incoming connections (telnet, ssh, pop3/imap, sendmail, etc).

Now, I suppose it's possible that they have a smoking gun that just hasn't been mentioned on that forum, or that they're withholding details to give the folks responsible a chance to fix the hole before it starts getting used more widely, but as presented here, it looks to me like they've jumped the gun by blaming MT.

If anyone from Myacen wants to contact us to give us more information about the hack, and why they think Movable Type was responsible, we can be contacted through the contact form.

However, I think it's very important to note *this message* in the thread linked above, which was not quoted above (because it wasn't written yet, I think):



This is rather good evidence that the hack is not Movable Type-related. If anyone from Myacen or another host knows anything otherwise, email us. But banning software from a server without real knowledge of whether the software caused the vulnerability, *and* without emailing the creators of the software with more information, strikes me as fairly irresponsible. We've always been very responsive to security issues, but there's nothing we can do without more information.

Just as an update to this thread, check the thread I started here. The quoted "2 out of 3 domains had Movable Type" comment came from my webhost, Excelwebhosting.com. I think one of my sites was one of the 2 MT installations that was hit. In any event, Excelwebhosting is banning MT as well.

Heavy sigh. The sad thing is that Excelwebhosting's service was fast and friendly. Uptime was tremendous, and ping times very good. So I'm sorry to have to leave them.

FWIW, a former friend of mine who is an IT security professional spent time trying to find security holes in MT (out of his own natural curiousity more than any real concerns with MT).

He never found one. Or, at least, he hadn't by the time we stopped talking to one another.

I've been hacking Perl and running large Unix sites for fifteen years now, and I chose MT for my server for the same reason that I chose OpenBSD: they've nailed it down so I don't have to. It's very careful about how it writes to files and executes local binaries. So far, the only thing that I have even the tiniest quibble with is the way it searches for the netpbm packages, if you enable that functionality.

Even then, the only risk is from a local attacker with write privileges to one of the small list of directories searched, and anyone who can do that has already compromised the system in ways that make MT quite irrelevant. And in any case, you can explicitly specify a safe path to the tools and avoid the search.

I bring it up not as an example of poor coding on their part (it isn't), but rather to illustrate just how difficult it was to come up with even a potential, trivial hole in the system, and how easy it was to audit their code to rule out other common attacks.

Another simple reality check was searching the CERT and SANS security-alert archives. How many people use Movable Type? How many relevant security alerts can you find? Compare and contrast to other commonly-installed CGI scripts.

There is one very real weakness in MT's security model: plugins. I'm not saying that any of the existing ones are unsafe, simply that they could be unsafe, and should be examined carefully before use. All of the ones I've looked at so far are fine.

I'm use (well, trying to use) MT with berkeley db format because my host is on windows, and I'm having problems because it is considered insecure.

The big problem is having to have directories with read/write/delete access. My host just won't do it. Right now I have to go back every day and reset my permissions on the root, then delete index.htm and achives.html just to post to my blog.

Is MySQL a better solution, or am I at the whim of my host with that too? My current situation is pretty unworkable.

Your host is running IIS and thinks that MT is insecure?

That's the funniest thing I've heard in a while. Thanks for making my evening.

Oh, and you should consider finding a webhosting outfit which is running Apache (with SUExec enabled).

Hello,

Sorry for our delay in responding to this thread. We have just signed up and I will be monitoring this forum as lots of our customers do use moveable type and I wish to investigate it further and if possible use it/test it.

Myacen currently has not inforced it's written ban (posted on our forums) on moveable type. We are re-investigating the issues and will be discussing it further.

Just thought i'd clear that up.

Thanks for coming here Carl to clear all of this up.

Yep, thanks for coming over. And taking the time to investigate this even more.