Weekly Edition
Return to the Security page
| |||||||||||
Savanna.gnu.org compromised too
If you go to Savannah,
the GNU project's development server, you'll find a note stating that it,
too, has been broken into. "The compromise seems to be of the same
nature as the recent attacks on Debian project servers; the attacker seemed
to operate identically." Savannah will be down until (at least)
December 5. (Thanks to "sdoyon", who posted the news in an LWN
comment).
(Log in to post comments)
Savanna.gnu.org compromised too Posted Dec 3, 2003 15:46 UTC (Wed) by stumbles (guest, #8796) [Link] Well, looks like it's time the script kiddies got tried of Microsoft's "ease of use" andhave decided to cut their teeth on something more challenging. Time for "us" to take our lumps.
Savanna.gnu.org compromised too Posted Dec 3, 2003 16:36 UTC (Wed) by freethinker (guest, #4397) [Link] Wonder how many more are out there, already rooted but not noticed yet? I hope people are checking their machines.
Savanna.gnu.org compromised too Posted Dec 3, 2003 17:51 UTC (Wed) by QuisUtDeus (guest, #14854) [Link] Debian's attack was a local one. The linux kernel attempt (correct me if I am wrong) was attempted by someone with some sort of CVS access. Now another local one.Is this perhaps some sleepers that have gotten local access to servers and now are taking advantage of it? Or perhaps, some developers have been "bribed" to allow improper use of their access? The Gentoo server was not their's, and so it remains to see if it looks like it might have been an "inside job." Or is someone finding a way to get remote access to user accounts in a new way or by brute force? The findings from Debian and Gentoo should help answer this. Anyway, attacks are always possible, whether sponsored by a large enemy like M$ or not. The right answer is still to fix the weaknesses that allowed them, and then perhaps to evaluate any trust relationships that might have been abused. This is still a small fraction of the more devastating results of world-wide windows-based viruses and exploits. -
Savanna.gnu.org compromised too Posted Dec 3, 2003 18:09 UTC (Wed) by sward (subscriber, #6416) [Link] The actual damage from these attacks hasn't been much, true. But the potential damage, if these had gone undetected for long enough, was considerable - because of the "leverage" to be gained by attacking a distribution repository such as this. I imagine that at least part of the cracker(s) motivation was that leverage effect.I just hope the GNU folks are on their toes; backdooring GCC would provide even more leverage...
It may not be "bad" developers Posted Dec 3, 2003 20:06 UTC (Wed) by Ross (subscriber, #4065) [Link] It may not have been the developer's fault. I'm pretty sure that in theDebian incident the developer's account was being used by someone else who had sniffed his or her password. Maybe the intruder(s) compromized a bunch of desktops and has been collecting passwords? I also remember that the FSF's ftp site was compromized by an "inside"
It may not be "bad" developers Posted Dec 3, 2003 21:01 UTC (Wed) by piman (subscriber, #8957) [Link] This is the case with Debian; a developer's home system (or one of his/her home systems) had been compromised, and so the attacker got the password (or phrase) when she/he logged into a Debian server.
Savanna.gnu.org compromised too Posted Dec 3, 2003 21:00 UTC (Wed) by piman (subscriber, #8957) [Link] > The linux kernel attempt (correct me if I am wrong) was attempted by someone with some sort of CVS access.The Linux kernel CVS is publicly readable, writable by no one. It's mirrored from the BK repository. The only people with "CVS access" and can't be tracked via BK commits, are BitMover employees. So, you're wrong. :)
Savanna.gnu.org compromised too Posted Dec 4, 2003 1:29 UTC (Thu) by NAR (subscriber, #1313) [Link] Or perhaps, some developers have been "bribed" to allow improper use of their access?I'm afraid most of the developers computers might be not as secure as they should be, so if a cracker gets in, he can easily get into the project server if the developer has a shell access there :-(
So, sourceforge and anything else with shell access.. Posted Dec 4, 2003 0:03 UTC (Thu) by ctg (subscriber, #3459) [Link] ... And anything where shell access is easy to get... may have been comprised.Oh dear.
Savanna.gnu.org compromised too Posted Dec 4, 2003 5:51 UTC (Thu) by tymiles (guest, #16469) [Link] My question is: Does this mean Linux is not as secure as people claim OR are people not securing their Linux installs right?
Savanna.gnu.org compromised too Posted Dec 4, 2003 6:32 UTC (Thu) by hummassa (subscriber, #307) [Link] this means there is some kind of coordinated effort to debunk the reputation for/perception of security that the FS/OSS systems have. Now, I have to buy some more tin foil. Do you want a hat too?
Savanna.gnu.org compromised too Posted Dec 4, 2003 6:44 UTC (Thu) by RobSeace (subscriber, #4435) [Link] Perhaps a little of both? Nothing is ever going to be completely secure,so all of the people who claimed that Linux (or OpenBSD, or anything else) is are simply fools... But, I think MOST people were only trying to claim that Linux was far more secure than Windoze... And, there, I think there can be no doubt as to the truth of that claim... But, I personally have always considered that on ANY host running ANY OS, In my opinion, the REAL problem is NOT a new local root exploit... Big
Savanna.gnu.org compromised too Posted Dec 4, 2003 9:40 UTC (Thu) by ccchips (guest, #3222) [Link] Maybe it's also time for a change of focus, as I've said before.I keep reading people saying things about locks, defects in locks, lock picks, and beating up people for not locking their doors properly. Now, correct me if I'm wrong, but if I should (accidentally or on purpose) leave my back door open on my house, does that action tell you that you have the right to go in there and steal my washing machine? Or, let's say I buy a lock from the Super-Defender Lock Company, and it turns out that somebody knows about a flaw in the metal, and that such a flaw allows them to break the lock, and get into my house. Does that mean people have the right to go on my property, break the lock, and hide in my house until I leave, then steal all my diskes? We can fortify our computers until Hell freezes over, and as long as the people who break into them contine to be allowed to have no respect for our rights, they will continue to be broken into. Once, a long time ago, my father left the back door of our house unlocked when we went on vacation. When we returned, we found the door locked on the bottom (one of those automatic locks once you leave,) and a note inside the house from a neighbor, saying that we had left it unlocked and that he'd locked it for us. Now, I'm not trying to fault anyone for fixing problems in the computer; it seems fairly easy to conclude that a lot of security breaches are possibe because of software flaws. However, I do believe that people need to wake up to the fact that there are fundamental social issues at stake here that technology will never fix. You've got to know that people are going to try really hard now to compromise Linux installations, especially since Gates and Co. made their big announcement about its insecurity. Don't be surprised if they are disillusioned former GPL supporters or current Microsoft fanatics who also happen to be expert crackers. You've got to have been expecting this, and for a long time. Also, Linux is now being advocated heavily by large, money-making concerns, as a possible desktop alternative. Joe User is not going to know (or care) about security the way some of you do. He may leave his window open, his door unlocked, or he may install a cheap-o-flex alram system. Does that give anyone the right to violate or hijack his computer system? No. It's not my fault if I'm the victim of a crime, it's the fault of the criminal. This was true when Microsoft was the butt of jokes about security, and it's still true now that Linux may be.
Savanna.gnu.org compromised too Posted Dec 4, 2003 9:53 UTC (Thu) by RobSeace (subscriber, #4435) [Link] Sure, of course the one breaking in is at prime fault... I don't think Isaw anyone arguing otherwise anywhere... However, that doesn't mean you should say, "Well, since they're at fault, I
Savanna.gnu.org compromised too Posted Dec 4, 2003 10:10 UTC (Thu) by ccchips (guest, #3222) [Link] Absolutely right. Howefer:Start with a wide-open door. Then a lock. Then a better lock. Then a dog. Then an alarm system. Then what---a full-time armed guard? I'm just saying we should never lose sight of the causes for this situation happening in the first place. If those are not addressed, all computer users will be in a vicious cycle forever. I'm waiting for the day when those codes on the dashboard radios no longer have any effect on thieves. Maybe then someone will ask themselves where this ends.
Savanna.gnu.org compromised too Posted Dec 4, 2003 12:57 UTC (Thu) by RobSeace (subscriber, #4435) [Link] And, how exactly do you propose to address these causes?? I personallydon't know of any magic method of transforming everyone on the planet into an ethical and law-abiding person... I quite suspect that for as long as the human species exists, there will be some of us who break the law, and/or do bad things... (And, let's be clear: the law is not always in line with what's right, either...) I just don't see that it's possible at all to ever do anything to change that basic fact of our nature... Short of maybe some intensive genetic-engineering to breed out our bad sides, but that will lead to a race of soulless zombies, like in every dystopian sci-fi movie ever made... ;-) So, I think we're better off addressing an issue which we actually have a
Savanna.gnu.org compromised too Posted Dec 4, 2003 12:31 UTC (Thu) by proski (subscriber, #104) [Link] Actually, there are several projects that allow limiting permissions of the root account. In particular, direct access to the hardware can be disabled. Also it should be possible to remount most filesystems read-only and disable root permissions for mounting. If you need to perform administrative tasks, you have to reboot the system and do it on local the console.Or just give a separate virtual machine to every user.
Savanna.gnu.org compromised too Posted Dec 4, 2003 11:17 UTC (Thu) by vblum (subscriber, #1151) [Link] Errm .... I'd say these were an example of how good security works: Debian and Gentoo did pretty well, didn't they? It'll be almost impossible to create complete security if an attacker is determined, but these intrusions were _detected_ almost instantly - great work!Savannah didn't do so great though, based on the timeline; that attack went undetected far too long. Hm.
Savanna.gnu.org compromised too Posted Dec 4, 2003 15:09 UTC (Thu) by ccchips (guest, #3222) [Link] As I understand it, Stallman didn't believe in security and passwords "'way back when," and he wants to keep security only as tight as absolutely necessary.Unfortunately, it was more absolutely necessary....
Not so bad for Linux, but get grsec anyway Posted Dec 4, 2003 16:13 UTC (Thu) by emk (subscriber, #1128) [Link] No operating system is truly secure, although OpenBSD comes close.Windows doesn't even seriously attempt to protect against local attacks, though, so Linux is still doing fairly well here. As for the remote attacks, we've seen two different scenarios: 1) gentoo: The rsync daemon wasn't secure, allowing an attacker to run code on the gentoo server. This can happen to any network service. 2) Debian & Savannah: The attacker had access to an account on the machine. So Linux is still looking pretty good, at least compared to Windows (if not OpenBSD). But if you want more security, install the grsec kernel patch, which makes life truly difficult for the bad guys.
Savanna.gnu.org compromised too Posted Dec 4, 2003 6:39 UTC (Thu) by davidl (guest, #12156) [Link] I doubt whether the Windows scripters are clever enough to do this.
Savanna.gnu.org compromised too Posted Dec 4, 2003 21:38 UTC (Thu) by fLameDogg (guest, #11305) [Link] A lot of them, sure. Probably even the majority. Maybe even the *vast* majority. But y'know, there's an awful lot of such people, including, I'm sure, some *very* smart ones.But this is someone(s), obviously, who has been studying the kernel, rsync, and probably more at great length. Hmm. Wasn't there a story about Microsoft's Linux lab, around about the time the SCO stink first broke (shortly after which, MS bought licenses from SCO). Hm. Hm. Hmmm... To the person passing out tinfoil hats: can I have one, too?
|
|||||||||||