The Mozilla Foundation has temporarily pulled the plug on its marketing site after a hacker break-in put user accounts at risk.

The non-profit Foundation, which has used the site to launch grassroots campaigns to support the Firefox Web browser, said the site will remain offline until October 15 while the site is rebuilt from scratch.

"We have scanned SpreadFirefox servers and at this time do not believe any sensitive data was taken, but as a precautionary measure we have shutdown the site and will be rebuilding the Web site from scratch," the open-source group said in an e-mail sent to members.

"We also recommend that you change your SpreadFirefox password and the password of any accounts where you use the same password as your SpreadFirefox account," Mozilla added.

The site used MD5 (Message-Digest algorithm 5) hashing to encrypt user passwords on the site but, in its notice, Mozilla noted that "MD5 cannot protect all passwords against offline dictionary style attacks."

The break-in was blamed on unknown remote attackers who attempted to exploit a security vulnerability in TWiki, a Web collaboration software installed on the Foundation's server.

n the e-mail alert, Mozilla said the TWiki software was disabled as soon as the attempts to access were discovered.

"This exploit was limited to and did not affect Web sites or Mozilla software," the group added.

It's the second time this year that hackers have broken into the site.

In July, a similar breach triggered a warning that user accounts were potentially compromised and forced the Foundation to implement new security patch-management procedures. Special Report: Advances in Web Browsers

On Tuesday, Mozilla acknowledged a weakness in the implementation of the new procedures.

"After SpreadFirefox was compromised in July, we instituted procedures to ensure that we apply all security fixes to the software running the site (Drupal and PHP) as soon as they become available.

"Unfortunately, those procedures overlooked the installation of the TWiki software since it is not used by the main Spread Firefox site," the group said.

"When the system is rebuilt, all the software will be audited to ensure that security updates will be applied in a timely manner," Mozilla added.


boys lie.

No we do not!!!!