Security Update: Linux Hacked details from Kernel.Org
Computer Security Linux Hack
Security Update
Linux source code site hack
09/13/2011 UPDATE from LinuxFoundation.org
*** UPDATE***
We want to thank you for your questions and your support. We hope this FAQ can help address some of your inquiries.
Q: When will Linux Foundation services, such as events, training and Linux.com be back online?
Our team is working around the clock to restore these important services. We are working with authorities and exercising both extreme caution and diligence. Services will begin coming back online in the coming days and will keep you informed every step of the way.
Q: Were passwords stored in plaintext?
The Linux Foundation does not store passwords in plaintext. However an attacker with access to stored password would have direct access to conduct a brute force attack. An in-depth analysis of direct-access brute forcing, as it relates to password strength, can be read at http://www.schneier.com/blog/archives/2007/01/choosing_secure.html. We encourage you to use extreme caution, as is the case in any security breach, and discontinue the use of that password if you re-use it across other sites.
Q: Does my Linux.com email address work?
Yes, Linux.com email addresses are working and safe to use.
Q: What do you know about the source of the attack?
We are aggressively investigating the source of the attack. Unfortunately, we can’t elaborate on this for the time being.
Q: Is there anything I can do to help?
We want to thank everyone who has expressed their support while we address this breach. We ask you to be patient as we do everything possible to restore services as quickly as possible.
—————Original Post——————
Kernel.org is currently displaying a Down for Maintenance message as is LinuxFoundation.org
The sites have been taken down with a notice put up stating that the sites are down for maintenance due to a security breach. The breach was said to have been discovered on the 8th of September, 2011. Kernel.org’s owners have contacted law enforcement in the US and Europe, and are in the process of reinstalling the site’s infrastructure and figuring out what happened.
A notice posted by LinuxFoundation cautions users that any passwords that might have been used on any of the services may be compromised.
“As with any intrusion and as a matter of caution, you should consider the passwords and SSH keys that you have used on these sites compromised” warns the Foundation in a statement.
“If you have reused these passwords on other sites, please change them immediately. We are currently auditing all systems and will update this statement when we have more information.”
Linux Hack
From LinuxFoundation.org:
Linux Foundation infrastructure including LinuxFoundation.org, Linux.com, and their subdomains are down for maintenance due to a security breach that was discovered on September 8, 2011. The Linux Foundation made this decision in the interest of extreme caution and security best practices. We believe this breach was connected to the intrusion on kernel.org.
We are in the process of restoring services in a secure manner as quickly as possible. As with any intrusion and as a matter of caution, you should consider the passwords and SSH keys that you have used on these sites compromised. If you have reused these passwords on other sites, please change them immediately. We are currently auditing all systems and will update this statement when we have more information.
We apologize for the inconvenience. We are taking this matter seriously and appreciate your patience. The Linux Foundation infrastructure houses a variety of services and programs including Linux.com, Open Printing, Linux Mark, Linux Foundation events and others, but does not include the Linux kernel or its code repositories.
Please contact us at [email protected] with questions about this matter.
The Linux Foundation
From Kernel.org
Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We discovered this August 28th. While we currently believe that the source code repositories were unaffected, we are in the process of verifying this and taking steps to enhance security across the kernel.org infrastructure.
- What happened?
- Intruders gained root access on the server Hera. We believe they may have gained this access via a compromised user credential; how they managed to exploit that to root access is currently unknown and is being investigated.
- Files belonging to ssh (openssh, openssh-server and openssh-clients) were modified and running live.
- A trojan startup file was added to the system start up scripts
- User interactions were logged, as well as some exploit code. We have retained this for now.
- Trojan initially discovered due to the Xnest /dev/mem error message w/o Xnest installed; have been seen on other systems. It is unclear if systems that exhibit this message are susceptible, compromised or not. If developers see this, and you don’t have Xnest installed, please investigate.
- It *appears* that 3.1-rc2 might have blocked the exploit injector, we don’t know if this is intentional or a side affect of another bugfix or change.
What Has Been Done so far:
- We have currently taken boxes off line to do a backup and are in the process of doing complete reinstalls.
- We have notified authorities in the United States and in Europe to assist with the investigation
- We will be doing a full reinstall on all boxes on kernel.org
- We are in the process of doing an analysis on the code within git, and the tarballs to confirm that nothing has been modified
The Linux community and kernel.org take the security of the kernel.org domain extremely seriously, and are pursuing all avenues to investigate this attack and prevent future ones.
However, it’s also useful to note that the potential damage of cracking kernel.org is far less than typical software repositories. That’s because kernel development takes place using the git distributed revision control system, designed by Linus Torvalds. For each of the nearly 40,000 files in the Linux kernel, a cryptographically secure SHA-1 hash is calculated to uniquely define the exact contents of that file. Git is designed so that the name of each version of the kernel depends upon the complete development history leading up to that version. Once it is published, it is not possible to change the old versions without it being noticed.
Those files and the corresponding hashes exist not just on the kernel.org machine and its mirrors, but on the hard drives of each several thousand kernel developers, distribution maintainers, and other users of kernel.org. Any tampering with any file in the kernel.org repository would immediately be noticed by each developer as they updated their personal repository, which most do daily.
We are currently working with the 448 users of kernel.org to change their credentials and change their SSH keys.
We are also currently auditing all security policies to make kernel.org more secure, but are confident that our systems, specifically git, have excellent design to prevent real damage from these types of attacks.
Need help? Firestorm Consulting
“What should we do now?” “What should we say?”
