The recent compromise of several Debian servers has been well publicized.
It appears that the Debian archive was unaffected, and Debian users need
not be worried about malware entering their systems by that path.
Certainly this event, like the recent kernel backdoor attempt, has raised
awareness of the vulnerability of our software repositories. An attacker
who is able to slip a bit of evil code into the wrong place could
compromise many thousands of systems.
Less attention has been paid to the cost of having the Debian servers be
unavailable for the better part of a week. Your editor, waiting for a
working version of psycopg to be uploaded to unstable, was merely
inconvenienced. Other users, who may have planned significant
installations or upgrades, or who were trying to discuss problems with
Debian developers will have been rather more inconvenienced. Debian
developers, trying to get 3.0r2 out the door, were stopped dead for a
while. These consequences are costly enough by themselves, but consider
what could happen. Had a major
security incident broken out while the Debian servers were unavailable, it
would have been difficult or impossible for the project to respond
quickly.
Linux systems are living things; even the most stable systems need
occasional updates to stay secure. Linux users depend on the availability
of their distributions' supporting infrastructure to keep their systems up
to date. This sort of attack, by making that infrastructure unavailable,
hurts users worldwide, and could leave them unable to respond quickly to
serious security problems. Once again, we have been warned that our
infrastructure is too fragile and insufficiently secure.
Comments (17 posted)
The quarterly CERT Summary - which describes the security issues being most
actively exploited - is out. Of the nine vulnerabilities, six affect only
Windows systems. The summary does, however, point out ongoing problems
with OpenSSL, OpenSSH, and sendmail.
Full Story (comments: none)
