The cyber break-in was discovered this week, according to a notice sent Tuesday by the Spread Firefox team to registered users of the Web site. The breach was limited to SpreadFirefox.com and did not affect the main Mozilla.org Web site or Mozilla software, according to the e-mailed message.
The server that hosts the Spread Firefox Web site was compromised by attackers who attempted to exploit a security vulnerability in TWiki, according to the notice. TWiki is open-source software for the collaborative authoring of online pages called "wikis".
This is the second time the site has been hacked via a flaw in software used to run the Web site. In July, the marketing site was compromised by attackers who exploited an unpatched security hole in PHP. The Drupal content management system used by the site is written in the PHP scripting language.
After the July attack, Mozilla instituted procedures to ensure that it would not overlook any more security fixes. "Unfortunately, those procedures overlooked the installation of the TWiki software, since it is not used by the main Spread Firefox site," the Spread Firefox team said in its notice.
The Firefox marketing Web site has been taken offline and will be rebuilt from scratch, according to the e-mail. "When the system is rebuilt, all the software will be audited to ensure that security updates will be applied in a timely manner," the team wrote.
The latest attack likely did not expose any user information, according to the e-mail. Still, people should change their password when the site comes back online, the team suggested. Spread Firefox's Web site should be back online circa Oct. 15, according to a notice on the site.
The hack is an additional embarrassment to Mozilla, which has emphasized security as a main selling point for its Firefox Web browser.
Spread Firefox is the online Firefox marketing hub. Mozilla has successfully used the site to mobilize volunteers to popularize the browser through free marketing techniques such as Web site buttons and by collecting money for an ad in The New York Times.
