King Skrupellos hack

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

King Skrupellos hack

Gillevet Patrick

Has anyone been hacked through the galaxy port 8080?  We have an aberrant link on our install and I cannot find where it is hidden.

The message that comes up is attached.

Pat

********************************************************************************
                                Patrick M. Gillevet, Ph.D
                       Director, Microbiome Analysis Center
                          Professor, Department of Biology
        George Mason University, Science & Technology Campus
                    10900 University Boulevard, MSN 4D4
                             Manassas, Virginia  20110
Office 703-993-1057     Room Colgan Hall-426     FAX 703-993-8430
                                      http://mbac.gmu.edu
**********************************************************************************

___________________________________________________________
Please keep all replies on the list by using "reply all"
in your mail client.  To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
  %(web_page_url)s

To search Galaxy mailing lists use the unified search at:
  http://galaxyproject.org/search/
Reply | Threaded
Open this post in threaded view
|

Re: King Skrupellos hack

Dannon Baker-2
Sorry for the delayed response here, I think this fell through the cracks
while folks were engaged with GCC this year.  The attachment didn't make it
through, can you provide more information?  For what it's worth, we've seen
'hacks' like this in the past simply be that someone uploads data with spam
text/links in the contents, so it may not be much to worry about.

On Thu, Jul 11, 2019 at 7:44 AM Pat Gillevet <[hidden email]> wrote:

>
> Has anyone been hacked through the galaxy port 8080?  We have an aberrant
> link on our install and I cannot find where it is hidden.
>
> The message that comes up is attached.
>
> Pat
>
>
> ********************************************************************************
>                                 Patrick M. Gillevet, Ph.D
>                        Director, Microbiome Analysis Center
>                           Professor, Department of Biology
>         George Mason University, Science & Technology Campus
>                     10900 University Boulevard, MSN 4D4
>                              Manassas, Virginia  20110
> Office 703-993-1057     Room Colgan Hall-426     FAX 703-993-8430
>                                       http://mbac.gmu.edu
>
> **********************************************************************************
>
> ___________________________________________________________
> Please keep all replies on the list by using "reply all"
> in your mail client.  To manage your subscriptions to this
> and other Galaxy lists, please use the interface at:
>   %(web_page_url)s
>
> To search Galaxy mailing lists use the unified search at:
>   http://galaxyproject.org/search/
>
___________________________________________________________
Please keep all replies on the list by using "reply all"
in your mail client.  To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
  %(web_page_url)s

To search Galaxy mailing lists use the unified search at:
  http://galaxyproject.org/search/
Reply | Threaded
Open this post in threaded view
|

Re: King Skrupellos hack

Gillevet Patrick
Dannon

Here is the link and the corresponding page.  I agree that it is probably innocuous but I cannot find the data file in the galaxy database.
Any hints so I can remove it would be welcome…   the GMU IT department is bugging me about it.

thanks
Pat

http://mbac.gmu.edu:8080/datasets/6d3270914ac86d96/display





On Jul 30, 2019, at 8:16 AM, Dannon Baker <[hidden email]<mailto:[hidden email]>> wrote:

Sorry for the delayed response here, I think this fell through the cracks while folks were engaged with GCC this year.  The attachment didn't make it through, can you provide more information?  For what it's worth, we've seen 'hacks' like this in the past simply be that someone uploads data with spam text/links in the contents, so it may not be much to worry about.

On Thu, Jul 11, 2019 at 7:44 AM Pat Gillevet <[hidden email]<mailto:[hidden email]>> wrote:

Has anyone been hacked through the galaxy port 8080?  We have an aberrant link on our install and I cannot find where it is hidden.

The message that comes up is attached.

Pat

********************************************************************************
                                Patrick M. Gillevet, Ph.D
                       Director, Microbiome Analysis Center
                          Professor, Department of Biology
        George Mason University, Science & Technology Campus
                    10900 University Boulevard, MSN 4D4
                             Manassas, Virginia  20110
Office 703-993-1057     Room Colgan Hall-426     FAX 703-993-8430
                                      http://mbac.gmu.edu<http://mbac.gmu.edu/>
**********************************************************************************

___________________________________________________________
Please keep all replies on the list by using "reply all"
in your mail client.  To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
  %(web_page_url)s

To search Galaxy mailing lists use the unified search at:
  http://galaxyproject.org/search/<http://secure-web.cisco.com/1WyIBPyi6RnnURKuDPdOUjWkO6rKvRhOFFsGHDo0sTYBVMPVsu1OZl92sB9OO94U0wIkC9EXXyEWONR8XQ91KFx-1Nd-5zCEsohAJBeiNBg5OA2i3Rklfy-jcXE0M_7L9y-BWSTSJ1krePydY_ATaXs5G9xRwy5RqEUmH9JQOeI3ZZYo1AfMZsyx6NpfHFSwasZp2ZcyycPIMVUoYeuvf_rgInFXh0Cyti1UCWlirO28oTOAhFECCkpGGXIfw9AID5wkUHakwRioe77BXz0Jr29WZ8WY1vS4Hl80mtVrArHvd22fGCPrRBvNqv5slknz_1tACzdrEzjYt-kic5dC1QByG__dVbIMFsffsBFnXbPqwY1E4K7kmLZ8MxjPUzdUO0JHJH0rdgue9YevRxPkhWk-MkQ_Vjq-kDYF-FzMtaMBMgU4NiEMCrMcCfzFNtQEb/http%3A%2F%2Fgalaxyproject.org%2Fsearch%2F>

********************************************************************************
                                Patrick M. Gillevet, Ph.D
                       Director, Microbiome Analysis Center
                          Professor, Department of Biology
        George Mason University, Science & Technology Campus
                    10900 University Boulevard, MSN 4D4
                             Manassas, Virginia  20110
Office 703-993-1057     Room Colgan Hall-426     FAX 703-993-8430
                                      http://mbac.gmu.edu
**********************************************************************************

___________________________________________________________
Please keep all replies on the list by using "reply all"
in your mail client.  To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
  %(web_page_url)s

To search Galaxy mailing lists use the unified search at:
  http://galaxyproject.org/search/
Reply | Threaded
Open this post in threaded view
|

Re: King Skrupellos hack

Daniel Blankenberg-2
Hi Pat,

I wanted to make sure that you were able to figure this out. As suggested
previously, this is most likely just a user uploaded file, but if you are
an admin of the Galaxy instance then you should be able to figure it out.
If you want to learn a bit more about this specific dataset in your Galaxy
instance, log in as a Galaxy admin_user, and go to the show_params page,
i.e.: http://mbac.gmu.edu:8080/datasets/6d3270914ac86d96/show_params

As an admin user, you will be able to see the file location on disk, the
tool and command line used to generate the dataset, etc. Please let us know
how it goes.



Thanks for using Galaxy,

Dan


On Tue, Jul 30, 2019 at 8:23 PM Pat Gillevet <[hidden email]> wrote:

> Dannon
>
> Here is the link and the corresponding page.  I agree that it is probably
> innocuous but I cannot find the data file in the galaxy database.
> Any hints so I can remove it would be welcome…   the GMU IT department is
> bugging me about it.
>
> thanks
> Pat
>
> http://mbac.gmu.edu:8080/datasets/6d3270914ac86d96/display
>
>
>
>
>
> On Jul 30, 2019, at 8:16 AM, Dannon Baker <[hidden email]<mailto:
> [hidden email]>> wrote:
>
> Sorry for the delayed response here, I think this fell through the cracks
> while folks were engaged with GCC this year.  The attachment didn't make it
> through, can you provide more information?  For what it's worth, we've seen
> 'hacks' like this in the past simply be that someone uploads data with spam
> text/links in the contents, so it may not be much to worry about.
>
> On Thu, Jul 11, 2019 at 7:44 AM Pat Gillevet <[hidden email]<mailto:
> [hidden email]>> wrote:
>
> Has anyone been hacked through the galaxy port 8080?  We have an aberrant
> link on our install and I cannot find where it is hidden.
>
> The message that comes up is attached.
>
> Pat
>
>
> ********************************************************************************
>                                 Patrick M. Gillevet, Ph.D
>                        Director, Microbiome Analysis Center
>                           Professor, Department of Biology
>         George Mason University, Science & Technology Campus
>                     10900 University Boulevard, MSN 4D4
>                              Manassas, Virginia  20110
> Office 703-993-1057     Room Colgan Hall-426     FAX 703-993-8430
>                                       http://mbac.gmu.edu<
> http://mbac.gmu.edu/>
>
> **********************************************************************************
>
> ___________________________________________________________
> Please keep all replies on the list by using "reply all"
> in your mail client.  To manage your subscriptions to this
> and other Galaxy lists, please use the interface at:
>   %(web_page_url)s
>
> To search Galaxy mailing lists use the unified search at:
>   http://galaxyproject.org/search/<
> http://secure-web.cisco.com/1WyIBPyi6RnnURKuDPdOUjWkO6rKvRhOFFsGHDo0sTYBVMPVsu1OZl92sB9OO94U0wIkC9EXXyEWONR8XQ91KFx-1Nd-5zCEsohAJBeiNBg5OA2i3Rklfy-jcXE0M_7L9y-BWSTSJ1krePydY_ATaXs5G9xRwy5RqEUmH9JQOeI3ZZYo1AfMZsyx6NpfHFSwasZp2ZcyycPIMVUoYeuvf_rgInFXh0Cyti1UCWlirO28oTOAhFECCkpGGXIfw9AID5wkUHakwRioe77BXz0Jr29WZ8WY1vS4Hl80mtVrArHvd22fGCPrRBvNqv5slknz_1tACzdrEzjYt-kic5dC1QByG__dVbIMFsffsBFnXbPqwY1E4K7kmLZ8MxjPUzdUO0JHJH0rdgue9YevRxPkhWk-MkQ_Vjq-kDYF-FzMtaMBMgU4NiEMCrMcCfzFNtQEb/http%3A%2F%2Fgalaxyproject.org%2Fsearch%2F
> >
>
>
> ********************************************************************************
>                                 Patrick M. Gillevet, Ph.D
>                        Director, Microbiome Analysis Center
>                           Professor, Department of Biology
>         George Mason University, Science & Technology Campus
>                     10900 University Boulevard, MSN 4D4
>                              Manassas, Virginia  20110
> Office 703-993-1057     Room Colgan Hall-426     FAX 703-993-8430
>                                       http://mbac.gmu.edu
>
> **********************************************************************************
>
> ___________________________________________________________
> Please keep all replies on the list by using "reply all"
> in your mail client.  To manage your subscriptions to this
> and other Galaxy lists, please use the interface at:
>   %(web_page_url)s
>
> To search Galaxy mailing lists use the unified search at:
>   http://galaxyproject.org/search/
___________________________________________________________
Please keep all replies on the list by using "reply all"
in your mail client.  To manage your subscriptions to this
and other Galaxy lists, please use the interface at:
  %(web_page_url)s

To search Galaxy mailing lists use the unified search at:
  http://galaxyproject.org/search/