LINGUIST List 10.821

Thu Jun 3 1999

All: Why LINGUIST has been down

Editor for this issue: Anthony Rodrigues Aristar <aristarlinguistlist.org>

Directory

1. The LINGUIST List, Why LINGUIST has been down

As some of you may know, the LINGUIST Listserv is hosted on its own
machine at the Linguistic Data Consortium at the University of
Pennsylvania. Ten days ago, a system administrator noticed unusual
activity on the network, and tracked it down to some unauthorized jobs
running on a machine at the LDC. When this was investigated, it was
discovered that a number of machines at the University of Pennsylvania
had been hacked. One of those was the LINGUIST Listserv.

In accordance with normal security procedures, these machines were
immediately pulled off the network, and the laborious process of
examining their file systems began. The hackers had apparently done a
great deal of work: many system files were changed, and more than one
trojan horse was found. Trojan horses, we might note, are programs
which allow illicit users to bypass normal security measures to get
onto a machine. The hackers clearly intended to stay, and to use the
machines for a long time.

It's taken the last 10 days to clear out all the files and software
these nice people installed, and the systems people at the Linguistic
Data Consortium have worked very hard. During that time, unfortunately, 
the Listserv had to be removed from the Internet, with distressing
results. Mail has been bouncing. Messages have failed to be
distributed. And to make matters worse, we were unable even to tell
you what was happening. We can only say how sorry we are that this
was necessary.

Almost everything has now been fixed, and new security precautions are
being put in place. The Listserv is back on the net, and we will
begin distributing mail again. The Listserv's web server is still
not up -- the server software will have to be rebuilt to ensure that
nothing nasty was left behind by the hackers -- but we hope to have
even this running again by next week.

The good thing is that no permanent damage seems to have been done.
The hackers, probably in an attempt to hide their tracks, avoided
touching any file-systems which are important to LINGUIST, and no
archive files were damaged. We can only be thankful.

Anyway... This is just to tell you that we're back...

The LINGUIST Moderators
Anthony, Helen, & Andrew