Linux B-day celebrations rattled by break-in
September 4, 2011 by Nancy Owano
(PhysOrg.com) -- Just days after celebrations marking the 20th birthday of Linux, the operating system revered around the globe as a rock-solid open source triumph, news surfaced that key servers used to maintain and distribute the operating system were hacked. Malware had gained root access. System software had been modified. The attack was confirmed in a note on Wednesday, August 28, posted on the Linux Kernel Archives www.kernel.org , the main distribution site for the Linux kernel. Though discovered on the 28th, the security breach possibly took place some time before, possibly no later than August 12. By Sunday, the 28th, it was obvious to admins of the web site that things had gone wrong. Files belonging to ssh (openssh, openssh-server and openssh-clients) were modified. A trojan startup file had been added to startup scripts.
The intruders initially gained root access on a server called hera, and compromising other servers. The administrators think they may have slipped in with a compromised user account. In an e-mail to kernel.org users, chief administrator John "Warthog" Hawley indicated he was definitely not in a party mood. The subject line: Master back-end break-in. "Afternoon everyone," he wrote,"as you can guess from the subject line, I've not had what many would consider a 'good' day." He said that a trojan had been discovered and he named "some boxes" on kernel.org that had been hit.
With the news of such a break-in, it might easily appear as if the event spells calamity, as this is all about a break-in of a repository hosting site of source code, and for an operating system that runs the engines of banks, businesses, and governments. What could be worse news than this? In fact, Linux being Linux signifies that the August break-in, while unwelcome, rattling, and burdensome, appears to have also given Linux keepers the opportunity to remind the world that its construct has built-in safeguards.
The strength of Linux, admins quickly pointed out, lies in its change-tracking system, where a secure hash of each of 40,000 files hosted on the site makes signs of tampering transparent. The hashes are stored in multiple servers. On confirmation of the break-in on the 28th, each of the site's 448 users were told to change their passwords and Secure Shell keys. Boxes were promptly taken off-line and re-installs were set in motion. Authorities in the U.S. and Europe were notified and asked to help in the investigation.
Source code does not appear to have been altered, according to the kernel maintainers, but the posting stated the administrators were doing an analysis to confirm that nothing has been modified.
More information: https://www.kernel.org/
© 2011 PhysOrg.com
-
From lemons to lemonade: Reaction uses carbon dioxide to make carbon-based semiconductor,
32 comments
-
Thioridazine kills cancer stem cells in human while avoiding toxic side-effects of conventional cancer treatments,
3 comments
-
SpaceX private rocket blasts off for space station (Update),
42 comments
-
Climate scientists say they have solved riddle of rising sea,
31 comments
-
SpaceX capsule has 'new car' smell, astronauts say (Update),
4 comments
-
Need a rigid insulation material???
18 hours ago
-
magnets or EMF in car bumpers to protect from fender bender
May 26, 2012
-
length of wire in a coil of known dimensions?
May 25, 2012
-
India Engineering Powerhouse
May 25, 2012
-
electromagnet core dereference between hard and soft iron
May 25, 2012
-
Measuring water pressure in an open tank
May 24, 2012
- More from Physics Forums - General Engineering
More news stories
Browser wars flare in mobile space
The browser wars are heating up again, but this time the fight is for dominance of the mobile Internet.
10 hours ago |
5 / 5 (1) |
3
Probability of contamination from severe nuclear reactor accidents is higher than expected: study
Catastrophic nuclear accidents such as the core meltdowns in Chernobyl and Fukushima are more likely to happen than previously assumed. Based on the operating hours of all civil nuclear reactors and the number ...
Technology / Energy & Green Tech
May 22, 2012 |
3.6 / 5 (22) |
56
|
HyperSolar shows dirty water no barrier to power world
(Phys.org) -- The Santa Barbara, California, company, HyperSolar, is set to transparently share the ups and downs of its research experiences toward the companys ultimate vision, successfully producing ...
SpotterRF debuts Radar Backpack Kit (w/ Video)
(Phys.org) -- SpotterRF has announced a special radar backpack kit designed to enhance situational awareness for soldiers on the ground. The company says its special radar is designed for warfighters as part ...
Tesla to launch electric sedan in US on June 22
Tesla Motors said Tuesday it would begin deliveries of "the world's first premium electric sedan" on June 22, slightly ahead of schedule.
Technology / Energy & Green Tech
May 22, 2012 |
4.5 / 5 (12) |
18
Land and sea species differ in climate change response: study
(Phys.org) -- Marine and terrestrial species will likely differ in their responses to climate warming, new research by Simon Fraser University and Australia’s University of Tasmania has found.
'Unzipped' carbon nanotubes could help energize fuel cells, batteries
Multi-walled carbon nanotubes riddled with defects and impurities on the outside could replace some of the expensive platinum catalysts used in fuel cells and metal-air batteries, according to scientists at ...
T cells 'hunt' parasites like animal predators seek prey, study shows
By pairing an intimate knowledge of immune-system function with a deep understanding of statistical physics, a cross-disciplinary team at the University of Pennsylvania has arrived at a surprising finding: T cells use a movement ...
Computer model used to pinpoint prime materials for efficient carbon capture
When power plants begin capturing their carbon emissions to reduce greenhouse gases and to most in the electric power industry, it's a question of when, not if it will be an expensive undertaking.
Change in developmental timing was crucial in the evolutionary shift from dinosaurs to birds: study
At first glance, it's hard to see how a common house sparrow and a Tyrannosaurus Rex might have anything in common. After all, one is a bird that weighs less than an ounce, and the other is a dinosaur that ...
Almost half of new vets seek disability
(AP) -- America's newest veterans are filing for disability benefits at a historic rate, claiming to be the most medically and mentally troubled generation of former troops the nation has ever seen.
Sep 04, 2011
Rank: 1.4 / 5 (27)
Sep 04, 2011
Rank: 4.3 / 5 (10)
I find that statement incredibly juvenile.
Surely you aren't under the impression there is a unbreakable system or OS?
Fact is, Linux is one of the most stable and secure out there, bar none. Perfection does not exist however.
I remember using a chat room set up by a university that lasted many years without a single reboot. It was funny actually, the computer clock would drift off many hours before someone who knew the admin could get into contact to have it reset.
It is known and accepted that part of Linux security is the fact that it is a fraction over 1% of the OSes out there. Another aspect is it probably gets better tech support from the Linux community (because it is open source) than Windows, but ironically it also makes it more vulnerable.
Sep 04, 2011
Rank: 4.7 / 5 (6)
"The strength of Linux, admins quickly pointed out, lies in its change-tracking system, where a secure hash of each of 40,000 files hosted on the site makes signs of tampering transparent" I'm sure that Sony Corp wishes they had been using a Linux OS on their servers!
Sep 04, 2011
Rank: 1.7 / 5 (6)
Ironically, Linux's main mode of security is obscurity. Every instance of Linux running in banks and supermarkets and embedded devices is different, and so breaking in to them depends on you knowing what exactly was put in there and how.
In reality every installation of Linux is something of a custom botch-job and has security holes up the wazoo. The whole thing is so complicated and has so many moving parts, alternative parts that are so poorly documented that you can't really implement it perfectly. The number of possible problems that you can evoke by choosing this network manager over that network manager over this version of that network manager is astronomical. It's like having sex: sometimes the kid turns out to be a retard
The thing that keeps it safe is the fact that nobody else knows what choices you made. There's no patent solution for breaking in
Sep 04, 2011
Rank: 4.6 / 5 (31)
He once claimed that PC's would need a maximum of 200mb of ram. He has called the programming language C an "abortion" and a "sick religion", and intimated it was a dying language.
Sep 04, 2011
Rank: 1.7 / 5 (12)
Actually, I said that PC's (IBM PC's) would never have a need for Gigabytes of RAM.
And they never did. The IBM PC era is over and even with Windows Vista the average desktop computer at that time had less than 1 gigabyte of RAM installed.
We are now in a multicore era with 64 bit CPU's that can support more than the 4 gigabyte limit of the earlier Pentium class and below CPU's, and even today most machines have less than 2 gigabytes of RAM installed.
That will continue to change slowly.
Sep 04, 2011
Rank: 1.6 / 5 (13)
C remains an abortion and is pretty much dead as a language. C has some life left in it but it's popularity is rapidly declining as well.
Both languages remain Abortions that are responsible for over 90 percent of the security exploits used to compromise computers.
Click on a GIF image and have a virus installed on your computer. You can thank C and C and the sick followers of those programming religions for that kind of nonsense.
Sep 04, 2011
Rank: 1.9 / 5 (12)
The LinTard OS certainly has improved over the years, and people have managed to hack it into all kinds of operating environments that use to run Unix.
But lets face it, Linux is Unix and the history of Unix is that it eat's it's own rather than gain market share.
Linux is like that. Growing only by eating Unix installs.
If you like command line driven junk, You will love Linux.
Sep 04, 2011
Rank: 1.8 / 5 (10)
Sony's servers were running Linux, Tard Boy.
SONY Play Station Network was running on unpatched Apache server with no firewall
http://www.linuxt...39NWHWSW
Sep 04, 2011
Rank: 5 / 5 (3)
It appears the attack did not exploit a vulnerability of the OS. This is a case of an administrative account being hacked and we all know that it can happen to any user based software system. The solution is obviously to implement tighter user security protocols around the repository.
Sep 04, 2011
Rank: 4.6 / 5 (8)
The opposite is true. Linux is an example of a solid system thet does not rely on security through obscurity.
Again, the opposite is true. Seldom have I read a statement so bizzarely untrue.
Linux networking is one of the best documented and simple out there. It has to be to be as secure as it is. The best practices are well understood... TBH I think this poster must be trolling.
Sep 04, 2011
Rank: 1 / 5 (2)
unix flavors, much like apple flavors, simply arent the majority and have enjoyed that status for 20 years, so arent attacked as often.
@Ensa-oh man i dont know where to start with that..linux is entirely non-dynamic by comparison to other server systems on the market. it and all unix flavors at best follow RFC guidelines, which is good and all, but they don't go beyond that as some other vendors do (granted, being open source you yourself can take it beyond that). take kerberos for instance...is it capable, sure, but its chocked full of manual interaction unless you code an app to streamline it (been there, done that).
Sep 04, 2011
Rank: 5 / 5 (4)
Sep 04, 2011
Rank: 4 / 5 (3)
I just had to refute those particular statements as being completely untrue. I mean gob-smackingly untrue.
Sure there are insecure implementations, but generally the more insecure they are the more they deviate from the known - very well known, secure implementations.
With security in OS's, transparancy and clarity is very important. You just cannot afford to have unknowns and ambiguous standards/protocols - these are the main dangers. Linux does not suffer from these.
I cannot talk about the pros and cons of various distros, some are a mess, especially the popular ones, though they serve a purpose. I won't touch Ubuntu in any kind of critical situation for example.
But secure is secure. Bottom line. A truly secure system is compiled from audited source and well maintained.
Even some of the hardened Slackware systems I know are as secure as an OS gets.
Sep 04, 2011
Rank: not rated yet
Sep 04, 2011
Rank: 2.3 / 5 (3)
Very few actually bother, because it requires a level of experience and competence with the OS that is missing with the majority of people who do use it.
The result is, that wherever Linux gets used in schools or business, some self-titled "expert" pretends to know what they're doing and the end result is a mess. It's cheaper and faster that way.
And what else can you expect from an operating system where the main mode of business is to ship an incomplete, unassembled system in order to sell commercial support for it.
Sep 04, 2011
Rank: 4.4 / 5 (7)
Sounds like Bill Gates trolling as "Vendicar Decarian".
Sep 04, 2011
Rank: 4 / 5 (3)
Well - I am done ranting.
Until next time.
:)
http://xkcd.com/932/
Sep 04, 2011
Rank: 4 / 5 (6)
Your posts are ridiculous. If you have something meaningful to contribute, then do so. Otherwise, save your trolling for a group of people who might fall for it.
Sep 04, 2011
Rank: 1.4 / 5 (7)
Sep 05, 2011
Rank: 4 / 5 (1)
Most of the development going into Linux(es), as in the whole OS and not just the kernel, is actually business to business based work. There's only about 20% independent "free" development left in the whole structure.
The businesses either do the developing for their own purposes, in which case they have in-house knowledge of how it works and so they don't need to make it easy - in fact that's just a bonus; the stuff is too obscure for your competitors to easily adopt.
Or, they are developing the thing for a customer, in which case they have an incentive to make it difficult and incomplete so they could sell more support contracts.
That's the only way to make money off of Linux.
Sep 05, 2011
Rank: 2 / 5 (4)
It is a shame really that the LinTards chose to recreate every failure of the perpetual failure that was the Unix OS, which couldn't even compete against DOS.
Sep 05, 2011
Rank: 5 / 5 (1)
Sep 05, 2011
Rank: 2.3 / 5 (3)
Is that why Java is more popular than C?
http://www.tiobe....dex.html
"Linux isn't an OS" - Koch
You've got that right.
Sep 05, 2011
Rank: not rated yet
I know alot of you folks just love your UNIX flavors, but in all seriousness, if you sit down and look at them, although Windows has to be paid for, the is MUCH more bang for the buck in all scenarios. For security, hell, free PKI, no additional license necessary...not to mention EFS, BitLocker (whole disk encryption), NTFS/Share securuty (although someone knowledgeable enough can bypass this), etc. etc. etc.
What do UNIX flavors have...the PAM and other iterations of it (depending on the version)...a MANUALLY configured KRB5.conf file adding MUCH pain into any kind of kerberos realm/domain rollout....the lack of a dynamic nature alone is enough...
Sep 05, 2011
Rank: not rated yet
Sep 05, 2011
Rank: 2.3 / 5 (3)
Filth.
Sep 05, 2011
Rank: not rated yet
Sep 06, 2011
Rank: 2.3 / 5 (3)
Long live Skynet
Sep 24, 2011
Rank: not rated yet
You don't pay for PKI, its a free service on top that can issue millions of certificates from a single server without tanking it with no CALs necessary. This DOES include issuance to non-microsoft operating systems.