Sendmail source hit by a trojan horse

As detailed in this CERT advisory, the sendmail source distribution on ftp.sendmail.org was replaced by a version containing a trojan horse. The modified code stayed on the server from September 28 through October 6. The trojan was invoked during the build process; it would fire off a process that would listen for commands on port 6667. If you downloaded and installed sendmail during that time period, you need to take a serious look at the integrity of your systems.

Free software is supposed to be more secure because the source can be examined for this sort of thing. Yet this particular bit of malware managed to stay on a high-profile server for over a week. When you consider that, for example, the Interbase back door went undiscovered for over a year, one week does not seem all that bad. But one week is plenty of time to compromise a great many systems.

What is truly surprising is that we have not seen more of this sort of problem. Trojanized source distributions are scary; a compromised binary package is truly terrifying. There will be more - and worse - episodes of this nature in the future.

Of course, we have the tools to defend against most of these attacks. If you put up software for others to download, you should sign it with a cryptographic key. If you download software, you should check that signature. As long as the signing keys are handled carefully (i.e. not stored on the FTP server!), this bit of hygene will detect almost all tampering attacks. Without such checks, administrators are placing a great deal of trust in the security of every system they download software from.

---

(Log in to post comments)