Open Source 2009-06-18 · 42 days ·Credential Theft, Data Exfiltration

SquirrelMail plugin archives stole passwords

After a SquirrelMail web-server compromise in June 2009, the project found that three official plugin archives had been modified to mail user passwords to an offsite server.

Story

SquirrelMail had another distribution problem in 2009, but this one lived in the plugin channel rather than the core webmail release. The project disclosed in June that its web server had been compromised, locked accounts, reset critical passwords, and took the plugin repository offline while it investigated. At first, the team said it believed the plugins themselves had not been altered.

The follow-up was worse. On July 30, SquirrelMail announced that three plugin packages on its own site were in fact compromised: sasql-3.2.0, multilogin-2.4-1.2.9, and change_pass-3.0-1.4.0. Those were not lookalike downloads. They were plugins administrators expected to obtain from the SquirrelMail plugin repository.

The injected PHP attempted to send mail to an offsite server containing passwords. That made the affected plugin set especially sensitive: two of the names, multilogin and change_pass, sit close to authentication and account-management workflows, where administrators would least want silent exfiltration code running inside the webmail stack.

SquirrelMail could not establish when the plugin packages had been modified. The practical advice was blunt: anyone using the affected versions should download fresh copies and compare against the clean MD5 hashes published with the July 30 notice. Unlike the 2007 release-tarball incident, this compromise came after an already-known server intrusion and showed why "we think the downloads are fine" has to be treated as a hypothesis until every artifact has been re-verified.

Affected Artifacts

change_pass

· squirrelmail.org · repository · Plugin
Observed
2009-06-18 to 2009-07-30
Compromised Versions
Fixed
Not listed
Hashes
  • md5:2cff7c5d4f6f5d8455683bb5d96bb9fe
Evidence
distribution: squirrelmail.org/plugins.php, package: change_pass-3.0-1.4.0.tar.gz, observable: Modified plugin code attempted to send mail to an offsite server containing passwords.
  • SquirrelMail said it could not establish when the three plugin packages were compromised, so the start date follows the public June 2009 web-server compromise disclosure rather than a confirmed first malicious package date.

Incident Context

Motive
Credential Theft
Cause
Compromised Infrastructure
Transitive
No

External References

Source record: oss/attacks/squirrelmail/meta.yaml