Important security information and potential data breach on degrowth co-munity - please read through!

Dear co-munity users,

Short version:

Co-munity has been lately taken offline by Ecobytes in response to a major Drupal hack affecting servers worldwide. Due to the seriousness of this hack, we took this decision and are hard at work rebuilding our servers. Unfortunately, we can believe the degrowth.co-munity.net site and data has been probably compromised. All co-munity passwords have been reset. As a precaution, we strongly advise you to change passwords on other sites where you use similar usernames, emails or passwords. We are monitoring for further signs of intrusion but also ask users to report anything suspicious around the site. Unfortunately, it is never possible to guarantee 100% internet security, but we apologise for this situation.

Some more detail:

During the last days co-munity was brought offline by Ecobytes as a preemptive measure to protect the data of our users in face of the recent Drupal security hole, which is estimated to have affected several million sites and servers worldwide (see for example this BBC article on the "Drupalgeddon").

Due to the high risk of data theft, server intrusion and privilege escalation, we took the decision to temporarily suspend the service until we could finish an extended security audit and forensics on all sites and servers and take all measures necessary to exclude potential backdoors that the attackers may have left. Ecobytes sysadmins and site developers have been working day and night this last week, as we decided to rebuild all compromised sites and servers, while taking the opportunity to harden the security. We believe *we have mitigated the risk of new exploits and intrusion to the extent possible*.

Unfortunately, as the Drupal public service announcement writes, we have to assume that the degrowth.co-munity.net site has been probably compromised and that any information you have on the server might have landed in the hands of malicious users (botnets, spammers, your personal enemies). This includes all data that you have on your co-munity profile (name, e-mail address, bio, organisation or any other information entered there), as well as any content published on the site. Our forensics analysis suggests the occurrence of potential intrusion on the former degrowth.co-munity.net server, potentially with access and data theft of the database and files.

Although passwords in Drupal are stored in encrypted format on the database, we nevertheless strongly advise you to change your password on other sites and services where you use the same user/mail and password combination. On co-munity itself all passwords have been reset and you will have to set up a new one by using the automated one-time login link that you should have received a few minutes ago (alternatively request a new one here http://degrowth.co-munity.net/user/password). Make sure to choose a different password than you had before.

degrowth.co-munity.net is hosted by Ecobytes on a BOA stack and all our Drupal sites have been fixed. Our system checks and will continue to check on a daily basis for any known patterns of Drupalgeddon intrusions, amongst other suspicious behavior and report it to our system administrators. Nevertheless, we ask for your help in identifying and reporting to us any suspicious content (e.g. spam content and links, pieces of code in the middle of content, changes on your profile data, particularly the e-mail address, etc.). You can do by posting to the co-munity issue queue or through e-mail). Please note that, due to the overload our team currently has with this issue, we might have difficulties in replying to requests within reasonable time.

During the next days and weeks we will be publishing more information on this issue and the actions taken by our collective to mitigate the threats. Please visit the Ecobytes co-munity to keep being informed.

We apologize for the inconvenience this situation caused to all of you. Unfortunately, it is not possible to guarantee 100% security in internet data transmission and servers (even giants like eBay or Twitter had millions of users data stolen; not to mention those that we never get to know because of commercial interests). Ecobytes has and will always do the best to protect its users data and provide a transparent, community-oriented and supported IT service.

We wish you a good and safe time on the newly rebuilt degrowth co-munity!

Your Ecobytes system keepers,
almereyda, asdx, gandhiano and zeh