Linux and Open Source

Steven J. Vaughan-Nichols & Paula Rooney

Some Linux Foundation crack attack details emerge

By Steven J. Vaughan-Nichols | September 13, 2011, 1:14pm PDT

Summary: The Linux Foundation and its sites are still down after a hack attack.

A well-maintained secure operating system, like Linux, can be safe. But, that doesn’t mean that a Website built on top of it is necessarily safe. The Linux Foundation has found out the hard way. The Linux Foundation’s main site, and related sites such as Linux.com are still down after a break-in was discovered on September 8th.

This attack came on the heels of the main Linux development site, kernel.org, being compromised in late August. Kernel.org is still down. In the meantime, Linus Torvalds has uploaded the mainline Linux source code to GitHub. This is a site that uses Git, a distributed version control system, for distributed software development. Once kernel.org is back in working order though Torvalds will be returning the code to it.

But while work continues apace on this site and over the Linux Kernel Mailing List (LKML), the Linux Foundation sites remain dark. If you visit these sites you’ll find the following message:

Linux Foundation infrastructure including LinuxFoundation.org, Linux.com, and their sub-domains are down for maintenance due to a security breach that was discovered on September 8, 2011. The Linux Foundation made this decision in the interest of extreme caution and security best practices. We believe this breach was connected to the intrusion on kernel.org.

We are in the process of restoring services in a secure manner as quickly as possible. As with any intrusion and as a matter of caution, you should consider the passwords and SSH [secure shell] keys that you have used on these sites compromised. If you have reused these passwords on other sites, please change them immediately. We are currently auditing all systems and will update this statement when we have more information.

We apologize for the inconvenience. We are taking this matter seriously and appreciate your patience. The Linux Foundation infrastructure houses a variety of services and programs including Linux.com, Open Printing, Linux Mark, Linux Foundation events and others, but does not include the Linux kernel or its code repositories.

That said, according to a Linux Foundation representative, “We believe there is a connection [between the kernel.org and Linux Foundation sites attacks] but are working with security experts and authorities to confirm the details.” In addition, the spokesperson said, “We are working with authorities and aggressively working to restore services.”

When pressed as to who these “authorities” were, I didn’t get an answer. I presume though that police and other legal agencies are looking into this as being more than just a random attack. According to the site’s FAQ, “We are aggressively investigating the source of the attack. Unfortunately, we can’t elaborate on this for the time being.”

So if you have a Linux.com account are you in any possible trouble? Maybe. The site’s FAQ notes that while the “Linux Foundation does not store passwords in plaintext. However an attacker with access to stored password would have direct access to conduct a brute force attack. An in-depth analysis of direct-access brute forcing, as it relates to password strength, can be read at Choosing Secure Passwords .We encourage you to use extreme caution, as is the case in any security breach, and discontinue the use of that password if you re-use it across other sites.”

I think you should assume that, unless you used a passphrase instead of a password, that your password has been compromised. If you only used it only on that site, you’re probably fine. But, if, like many people, you use the same password on many sites, change your password on those sites immediately.

How did this happen? We don’t know yet. Paul Ducklin, security firm Sophos’s Head of Technology, Asia Pacific, speculated that the breech was made by a malware attack. What kind of attack? We don’t know that either. From an e-mail sent by John ‘Warthog9′ Hawley, Chief Kernel.org Administrator, it appears that the first attack came in through a malware compromised PC.

If, as appears likely, a cracker obtained high level passwords, it would have been easy to “break” into the sites. It’s like “breaking” into a house if you have the key-there’s really nothing to it.

Eventually, we’ll find out exactly what happened. What I already know today is that no operating system, not even such security heavy-weights as Chrome OS or OpenBSD, are somehow magically immune to attacks.

Anything can be successfully attacked. It’s just that some systems are easier than others. This should serve as a reminder that Linux too can be vulnerable and needs to be guarded with proper security measures. Given how slowly and carefully The Linux Foundation is restoring its systems, it’s clear they’ve learned that lesson.

Related Stories:

Hackers break into Linux Foundation

Ghost in the Wires: The Kevin Mitnick Interview

If you have a mysterious problem with a Linux box, try bashing your system with sys_basher

Fake SSL certificates pirate Web sites

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Linux and Open Source”

What's coming in Ubuntu's new Unity Linux desktop

Windows 8 distribution takes a page from Linux

Topics

Security, Password, Site, Attack, Linux Foundation, Linux, UNIX, Operating Systems, Open Source, Software, Steven J. Vaughan-Nichols

Steven J. Vaughan-Nichols, aka sjvn, has been writing about technology and the business of technology since CP/M-80 was the cutting edge, PC operating system

Full Bio
Disclosure
Contact

Vendor HotSpot

The 360° Conversation around Cloud Computing

TECH VISUALIZER brings the social conversation to life... powered by Brocade

Learn More »

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?

Linux command line tips: history and HISTIGNORE in Bash

Ask a Question Start a Discussion

Comments

Add Your Opinion

Join the conversation!

Follow via:: RSS; Email Alert

Just In

fdsd

jywhy888 8th Mar

View in thread

Please Select
Please Select

0 Votes

+ -

Contributr

RE: Some Linux Foundation crack attack details emerge

khess 13th Sep

You have to be pretty brave to hack that site.

Reply
Flag

0 Votes

+ -

must heve been

The Linux Geek 13th Sep

@khess M$ moles in the Linux foundation

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

1773 13th Sep

@The Linux Geek You seem to have lost your mind !!!

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Pete "athynz" Athens 13th Sep

@The Linux Geek Face the facts Linux Geek - The Linux Foundation got hacked. Period, end of story. This was not an issue of having the front door open as DTS originally postulated as a possible cause but an attack that brought down Linux hard. Tough break dude, you just found out that you guys are just as vulnerable as Mac users to malware attacks. Now you can either act on that hard truth by learning how to defend or you can keep on trollin' and stick your head in the sand and pretend this did not happen. Knowing you I'd guess it'll be the latter course of action.

0 Votes

+ -

They do not need moles. The Linux developer's own incompetence

Mister Spock 13th Sep

@The Linux Geek
is obviously all that was needed.

plain

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

linux for me 14th Sep

@The Linux Geek
@Pete "athynz" Athens

"first attack came in through a malware compromised PC"

It wasn't malware on the linux systems, it was malware on a PC that did the attack. Most likely, passwords were compromised giving the attackers access to the systems. If you search for lists of the most commonly used passwords, you would be astonished to find out how many system admins still use these, regardless of the operating system being run. I know, I see it all the time as a consultant. Unix/Linux is still the most secure OS, but nothing is secure if you give away all the keys.

As for some Linux Geek's posts, he gives other linux users a bad name. If this was a game, I would wonder what side he was really on.

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Badgered 14th Sep

@linux for me It wasn't malware on the linux systems, it was malware on a PC that did the attack.

From the link.

Earlier today discovered a trojan existing on
HPA's personal colo machine, as well as hera.

So... sure, it was a personal computer. Running what OS I'm not sure, but wouldn't you think folks used to running Linux would know what to look for on their personal computers? If that Trojan was on a machine running Linux, that would be telling indeed.

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Pete "athynz" Athens 14th Sep

@linux for me

"first attack came in through a malware compromised PC"

At least use the full quote:"How did this happen? We don???t know yet. Paul Ducklin, security firm Sophos???s Head of Technology, Asia Pacific, speculated that the breech was made by a malware attack. What kind of attack? We don???t know that either. From an e-mail sent by John ???Warthog9??? Hawley, Chief Kernel.org Administrator, it appears that the first attack came in through a malware compromised PC." Note the words "...it appears that the first attack came in through a malware compromised PC" (Emphasis mine). So it was a PC - was it a PC running Windows, Mac, or Linux? Or are you going with the PC = Windows based Personal Computer thing?

It wasn't malware on the linux systems, it was malware on a PC that did the attack. Most likely, passwords were compromised giving the attackers access to the systems.

Again not the "...appears to be..." part of that quote. At this point that is still not certain. But was the "malware compromised PC" actually at The Linux Foundation? How was it connected? How was it able to compromise the Linux based servers?

If you search for lists of the most commonly used passwords, you would be astonished to find out how many system admins still use these, regardless of the operating system being run. I know, I see it all the time as a consultant. Unix/Linux is still the most secure OS, but nothing is secure if you give away all the keys.

NOW we come to another excuse - the "it was secured using a common password" theory... which is similar to DTS's "the front door was open" theory. Next.

As for some Linux Geek's posts, he gives other linux users a bad name. If this was a game, I would wonder what side he was really on.

I seriously thing that Linux Geek needs some heavy duty meds - he really does give Linux fans a bad name. As for me I don't hate Linux at all - I do not find it to be very useful for me as a desktop OS as I play MMORPGs and sync my iPhone which is something Linux cannot do and Windows can.

But all of that aside, how can you explain the following from the link claiming it was a malware compromised PC:

As you can guess from the subject line, I've not had what many would
consider a "good" day. Earlier today discovered a trojan existing on
HPA's personal colo machine, as well as hera. Upon some investigation
there are a couple of kernel.org boxes, specifically hera and odin1,
with potential pre-cursors on demeter2, zeus1 and zeus2, that have been
hit by this.

Now if Linux - as I have been told by quite a few Linux fans here on ZDNet - is invulnerable or not susceptible to malware how were those boxes hit? And by what?

0 Votes

+ -

The malware seems to have been on a Linux machine

WilErz 14th Sep

@ Badgered

The answer to your question is in the link provided by Vaughan-Nichols.

The term 'malware compromised PC' is something that Vaughan-Nichols simply made up (as he tends to do), unless he's posted the wrong link. The link he posted makes no reference to a PC. Rather, it states that a trojan was discovered on 'HPA's personal colo machine' -- a 'personal machine', not a 'PC'.

More importantly, the source also states that a 'trojan startup file was added to rc3.d'. As anyone familiar with Linux will know, 'rc3.d' is a directory containing start-up scripts for run level 3. The Linux run level scheme was copied from Unix, and as anyone familiar with Windows will know, Windows does not use run levels, nor has it ever.

In short, what Vaughan-Nichols calls a 'malware compromised PC' was apparently a 'personal co[-]lo[cation] machine' running Linux. It was apparently infected, along with several other Linux machines, by a trojan that targets Linux. It was Linux malware, full stop.

Anyone who's puzzled by a high-profile infection of Linux systems should consider the following:

1. Every production operating system contain bugs

2. Every user/administrator makes mistakes (much more important than 1)

3. Containing user/administrator mistakes and managing problems caused by bugs requires considerable resources

4. It's exceedingly unlikely that the Linux Kernel Organization, a non-profit, can match the resources of large commercial firms

5. Despite the myths spread by the technically inept, Linux isn't inherently more secure than Windows (indeed, as Charlie Miller has pointed out, Linux desktops are probably easier to hack than Windows desktops)

To those who haven't the first clue about security and think Linux is magically protected by pixies (i.e. most Linux zealots), the fact that hackers were able to compromise kernel.org and apparently remain undetected for some time must come as a shock. To anyone who actually understands the Linux, Unix and Windows security models, however, it isn't the least bit surprising.

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

tom@... 15th Sep

@The Linux Geek
There is no such company as "M$".

0 Votes

+ -

fdsd

jywhy888 8th Mar

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

tom@... 15th Sep

@khess
"You have to be pretty brave to hack that site."

Why? I can think of a lot of other sites that would be more dangerous to attack. ONE HOP is all a hacker needs to hide himself and I'll bet the number was a lot higher than 1!
Now, if ISPs were to do their job, and authenticate EVERY piece of mail right at the first knocking on the door, and refuse/accept right there, the perps would have a LOT more trouble hiding. But hell, even I could leave a message that you'd never track down to me rght now, ISP affadavits forced by gvt subpoenas or not! ISPs just-do-not-care to be part of the solution and thus are part of the trackiing problem. Then eventually, ANY ISP not conforming would be a known rogue or personally owned source and lists of perps suddenly begin to appear in public.

Reply
Flag

0 Votes

+ -

Interesting

CommonOddity 13th Sep

I hope they describe how they did it. It would definitely be an interesting read.

Despite their efforts, the Kernel code is safe, and so far, no credentials have been reported as misused (not to be confused with 'stolen'). Not too shabby.

Reply
Flag

0 Votes

+ -

Why?

WilErz 14th Sep

@ CommonOddity

Why would it be interesting? At least one bit of malware involved was a simple trojan script in rc3.d. Something as obvious as a new start-up script in a privileged directory went unnoticed for weeks, on several Linux machines. Even worse, it sounds as if it was only discovered by chance, because of a bug. To top it off, they still don't even know exactly when the intrusion occurred, which implies there wasn't proper auditing in place.

I'm sorry, but the administrators of the Linux systems behind kernel.org are clearly inept. The same applies, I'm afraid, to most Linux users/administrators I've known (I used to be a Linux user myself). They seem to think the Linux pixies are magically protecting their systems from harm. If anyone actually bothered to attack these Swiss cheese Linux machines, they could probably break in within seconds, steal all the information and leave without a trace (maybe leaving behind some hidden key loggers for good measure). I doubt the kernel.org admins are as bad as that, but it doesn't sound like they'd last long in any organisation routinely targeted by hackers (e.g. just about any large firm).

The insecure state of so many of the Linux servers I've encountered does make me wonder how important compromised Linux servers (e.g. web servers serving malware) are to the overall malware ecosystem.

Reply
Flag

0 Votes

+ -

So, no update then?

facebook@... 13th Sep

This is the exact same information that I knew yesterday. Why is it taking so longer to make information about the exploit public? We would not tolerate this from a non open source organzation, we should demand the same from Linux Foundations.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Rabid Howler Monkey Updated - 13th Sep

@facebook@... wrote:
"We would not tolerate this from a non open source organzation

You mean like HBGary, RSA or Lockheed Martin? I think that both kernel.org and The Linux Foundation have been VERY forthcoming so far. And bravo to SJVN for writing this article, though a bit late for kernel.org.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

jgm@... 14th Sep

@facebook@... On the contrary, this is a group who are essentially all unpaid volunteers and they've behaved much better than many corporations so far - disclosing the compromise as soon as it was found out, taking all systems that could have been affected offline, putting some back together from the ground up, etc. That's what we're owed and that's the priority - assessing damage and repairing damage and then closing security holes. The Linux kernel folks aren't under a pressing demand to explain to you in detail how to steal a member's password and get access to their systems. You're not likely to hear anything in regards to how until everything is back online, the attack is fully understood, and measures are in place to prevent it from being successful again. If law enforcement is involved, you're certainly not going to be getting details about the attack at this time.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Rabid Howler Monkey Updated - 13th Sep

Recapping from the link SJVN provided for the kernel.org hack:

http://pastebin.com/BKcmMd47

The attackers gained root level privileges and a trojan startup file was added to rc3d, presumably /etc/rc3.d, on both HPA's personal machine and kernel.org server, Hera. The trojan was initially discovered through Xnest /dev/mem error messages without Xnest installed.

The break-in is believed to have occurred no later than August 12, 2011, and was discovered on August 29, 2011, a duration of at least 17 days.

Doesn't sound like they had ossec-hids, or similar, installed on their servers, pushing periodic reports to sysadmins mail boxes. The directory /etc/rc3.d surely would be a prominent monitoring location.

One wonders what the kernel.org security policy looks like. I'm sure some improvements will be made once all of the details are uncovered and digested.

Reply
Flag

0 Votes

+ -

SJVN, the Hera machine was rooted

honeymonster 13th Sep

In fact, the entire infrastructure was compromised. Either way you try to spin this, a web site vulnerability can *never* explain how a machine gets root'ed.

I think you will find that either the kernel.org maintainers were incompetent (not patching with their own patches) or that the hackers used a zero-day vulnerability.

Personally my money would be on a vulnerability which has been fixed in the kernel repository but which hasn'tmade its way through to the distro on which kernel.org runs.

This is a systemic problem with the Linux open source model which relies on distros to repackage. Vulnerabilities are effectively disclosed when fixes are committed to the kernel.org. But they are not patched until the distros incorporate those fixes into actual patch packages.

Reply
Flag

0 Votes

+ -

Couldn't it have been as simple as a keylogger on a PC?

daboochmeister 13th Sep

@honeymonster - why do you say the above? Couldn't the attack boiled down to something as simple as a keylogger on a PC being used by an admin to access the web servers for admin purposes?

Reply
Flag

0 Votes

+ -

The Turnaround for Security Patches Is Very Short

CFWhitman 14th Sep

@honeymonster
The turnaround for security patches from a project to a distribution's repositories is generally very short. It's not much of a window of opportunity.

According to the information that's been released so far about this attack, the initial vector seems to be a compromised password, although it's unclear from the reports just how the password was compromised.

What has yet to be released about the attack is how the attackers got from having user level access, which they probably used to ssh into the server, to root level access. Until we know how that was done, it's hard to make any pronouncements about who was incompetent or how.

It would be possible for elevated privileges to be obtained by installing a keylogger into the account of a user who knew the root password and waiting for him to su into the root account. For the moment we don't know it was done.

I suspect that carelessness about security on someone's part led to the obtainment of the initial password, but it would be nice to have more details about the progression of events.

Reply
Flag

0 Votes

+ -

Amazing how it is so much less BAD if it is Linux...

Raid6 Updated - 13th Sep

"A well-maintained secure operating system, like Linux, can be safe. But, that doesnt mean that a Website built on top of it is necessarily safe."

First of all I don't have a reputation like many who are regular, long-time posters here, but in all of my responses I have always used one of my Windows XP/7 computers - I never made a post from a Linux box.

This is important because last Friday I decided it was time to try a dual boot and I am now using Linux Mint (64 bit Katya) almost nearly 99.9% of the time.

I have to confess, I really like this OS.

That being said the article that opens with the quoted phrase above begs a deeper and more scrutinising rebut.

First of all the author of this blog is a rapid, stark craving mad Linux zealot. I have never faulted a security breach on a web server running Linux as a fault of Linux.

What a joke since most successful hacks don't exploit some very complicated and laborious effort exploiting a true low level OS vulnerability.

Instead it is bad code, bad code built on bad code, good code built on a bad framework, or some combination of multiple causes.

I remember big issues with PHPBB that were easily eliminated by using MOD_SECURITY with proper filters in place. Now of course that didn't eliminate the bad coding, it eliminated the ability to exploit that bad code.

Remember when that reaaaaaallllly long query string would overflow the buffer on IIs 4?

That was a true vulnerability. Since then how many IIs servers have been successfully hacked? Compare that number to Apache on a LAMP stack!

Is LAMP secure - well it sure as heck can be. Is IIs 6, 7, and 7.5 secure? Yeah, as secure or MORE (possibly) than a LAMP stack.

Put in place proper front end scrubbing, good clean, smart code instead of lazy hacked together frameworks and you probably will never be successfully hacked.

Far too much credit is given to the brilliance of hackers and far to little blame is put on the developers, webmasters, and the configuration of software.

So this bozo that writes this column will softly excuse exploited Linux/Unix servers but he will rail on any negative news about MS. He lives for that in fact.

Over the past five days I have learned to thoroughly enjoy the Linux Mint environment, learning some very good lessons. I am looking forward to an opportunity to write about the issues I have had, and there have been plenty, but also about the really positive aspects of my experience.

It would be nice of the writers for ZD were objective and not willing to bend and contort to reach the predefined objective.

Oh and I forgot to mention...

Brute force? Seriously? That is a result of bad policy, bad configuration, and people who just failed to do their jobs. I am certain that there are effective methods of detecting and blocking brute force attacks - in fact I am 100% sure that it is possible to combat these attacks. Not saying I am an expert, but I am saying brute force is not limited to Linux.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

tonymcs@... 13th Sep

How much of an apologist can you get?

Apparently SJVN would like to try.

First

"A well-maintained secure operating system, like Linux, can be safe. But, that doesn???t mean that a Website built on top of it is necessarily safe."

So we've moved from Linux as the god of OSs, to having to be maintaine, made secure and it's still not proof against bad web pages. So Linux is like every other OS - except simpler?

Apparently the passwords are hacked, they didn't use heavy encryption and they're having real trouble getting the sites up again - which apparently is a good thing, because they're being slow - I'll remember that the next time you're raving about MS downtimes.

Also according to your rumours, it's not a real hack, just someone stole the passwords????

"Anything can be successfully attacked. It???s just that some systems are easier than others"

Which is another dog whistle to suggest this is just the one exception to the totally secure Linux - while the other OSs are just easy.

Really SJVN, why just not man up and admit that Linux is just another ancient OS, where it's vulnerabilities are only limited by its simplicity, lack of functionality and it's incredibly small usage in the desktop market . Better still, just don't mention any more Linux exploits and hacks, then we won't have to put up with your convoluted explanations as to why it didn't really happen wink

Reply
Flag

0 Votes

+ -

Re: Linux v Windows etc

George Mitchell 13th Sep

@tonymcs@...

Tony, Tony ... Raid6 made a really useful and extremely objective comment above saying much the same thing as what you are saying. Unfortunately, your comment is far less credible since you come off being as much of a Windows fanboy as SJVN is a Linux fanboy. The reality is that we all have biases. SJVN is flaunting his right now as is often his habit. Yours are also fairly obvious. Personally, I don't hide the fact that I like Linux a lot. But I also give MS credit where credit is due and often credit IS due. They have come a LONG ways from the infamous blue screen days of Win 98. That said, all software is vulnerable, that is a given. How it is managed probably has a lot more to do with the level of vulnerability than whether it is Linux, Windows, or whatever. The fact that these systems were cracked is an indication that whoever is responsible for administering these systems needs to give themselves a reality check and make some changes going forward. How fast they get the systems back up is really not as important as that they have them reliably secured when they do get them back up and I would be saying the same thing if it was microsoft.com that had be compromised. In either case, we can't forget that it is the breakin artists that are the bad guys, not Linux, not Windows, not the Linux Foundation, not Microsoft. But it does no good for anybody to try to put a pretty face on it as SJVN seems to be trying to do. Personally, whether it involves Linux, Windows, or any other OS, when somebody gets hacked, gloating over what OS got hacked is the last thing on my agenda. I am just thankful that I am not in their shoes.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

YetAnotherBob 16th Sep

@tonymcs@... While SJVN is more credible than you are, you missed one gaff he made in this article. He stated that Chromebook is a high security Linux distribution. It isn't. For High security, you will want SE Linux or perhaps something based on one of the other HS versions. Chromebook is based on a chrome browser in a slightly modified version of plain Linux. It is no more secure than the admin password. If the Chromebook users are like most simple users (That's who it's aimed at), then the admin password will be the factory default password. Any cracker with a Chromebook should be able to get that in about ten minutes. Sorry Steven, but Chromebook, like Ubuntu is not any more secure than Windows.

Reply
Flag

0 Votes

+ -

Its a lesson, no doubt about that!

George Mitchell 13th Sep

The thing that defines these attacks is that they are so unsurprising. These are extremely high profile targets. Cracking kernel.org is, after all, akin to a successful crack on microsoft.com. The perpetrators must be, and frankly deserve to be ecstatic. They have made the big time. How they did it is, in some ways, less important than the fact that they did it without being detected. There is a lot of good content in Raid6's comment above. I've used Linux exclusively since 1999. During that time, MS has come a LONG ways in securing their products. That said, when your running high profile targets like kernel.org or linux.com, you had better not only pay a lot of attention to how you configure your server. You had also better be paying a whole lot of attention to *continuously* auditing your server, as in "a full time job assignment". ANY file changes in the system area should trigger an immediate response. After all, when you have a number of devs and others logging in continuously from the "world", your security is only as good as their security. If they get hacked, you are at risk AND, as Raid6 points out, you ARE at risk whether you happen to be running Linux, BSD, OSX, or Windows or whatever. If somebody gets the keys to your system due to some user's carelessness, your only remaining security is real time auditing and responding to real time red flags from the system BEFORE it is compromised to the point that it is neutered. These ain't simple desktop systems where you have to invite the malware in. These things basically "leave the lights on for you" if you've managed to swipe the right creds off of somebody's carelessly insecure desktop OR there careless browsing or email habits. No matter what OS one runs a server on, there is software like tripwire that continuously looks for unauthorized software changes and reports them. Was this type of software running on any of these high profile targets? If not, why not?

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

daikon 13th Sep

Steven, Great article.
Great job goes out to Linus Torvalds for creating Git.

Far too many folks try to draw a conclusion with little facts.

Hooah!

Reply
Flag

0 Votes

+ -

I always find it interesting

Cynical99 13th Sep

how those that have never seen the internals of Linux and only have a cursory knowledge of how it really works make consistent claims about how safe it is.

For all the claims, malware for Linux is real, and until the faithful wake up and admit that their cute little baby is vulnerable, no one will ever know how many Linux servers are vulnerable. Linux has no consistent security monitoring, so no one knows how many servers out there are compromised. Perhaps none, perhaps thousands. One cannot tell.

One must wonder how safe Linux really is.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

daikon Updated - 14th Sep

DFTTs

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

CommonOddity 14th Sep

@Cynical99

1. It does have consistent security monitoring. It doesn't mean it is enabled by default.

2. I have to fully agree with you- surface level knowledge folks are the ones that usually spew bits about it being secure. It actually is secure- but that shouldn't be mistaken for impervious. Remember the 'unhackable' S4L? The supposed godly kernel that nobody could chip into? Someone dipped their stubby fingers in that cookie jar, it seems happy

3. "One must wonder how safe Linux really is". I can understand your need to question everyone's claims as to how Linux is safe. I can understand using the 'wake up and smell the coffee' lines and other cliche crap you threw in. But "one must wonder how safe Linux really is"? Now that is just plain lulz.

That's just as bad as having a statistician toss up some easily quotable numbers, and someone stepping up to say something with regards to said numbers should be reconsidered.

It's just as safe as it was a while ago. It depends on the configuration, for that matter... (e.g. SELinux/Apparmor/TOMOYO, chrooting, sysctl params... blah blah blah).

Linux kernel is fine. If anything, they conjectured it blocked one of the injections (albeit, they're unsure if according to design or by accident). I'm curious as to what application was cracked to get the task done.

Cheers

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Rabid Howler Monkey 14th Sep

@CommonOddity wrote:
"It's just as safe as it was a while ago. It depends on the configuration, for that matter... (e.g. SELinux/Apparmor/TOMOYO, chrooting, sysctl params... blah blah blah).

It also depends on, in addition to configuration, patching and monitoring. Thus, my earlier comment questioning kernel.org's security policy, which should also cover the kernel devs (think of them as telecommuters).

@CommonOddity also wrote:
"Linux kernel is fine.

Is it?

http://resources.infosecinstitute.com/exploiting-gresecuritypax/

Is auditing the Linux kernel for security vulnerabilities adequate? Is the Linux kernel really a soft target?

SJVN gave a nod to OpenBSD:

http://www.openbsd.org/security.html#process

Does the Linux kernel have an auditing process similar to that of the OpenBSD project?

Both the PAX Team and the grsecurity dev have long criticized how security is handled in the Linux kernel (e.g., various articles and comment threads at lwn.net).

0 Votes

+ -

OK, so you say it's safe, do you fit the category mentioned?

Cynical99 14th Sep

@CommonOddity
You say it's all safe, depending on configuration. Have you participated in creating all these safety features in Linux and do you personally know that they work? Have you tested these features and survived hacker attacks by the pro's out there? Probably not, yet you say it's safe. Credibility lacks.

You seem to fit the category of one that has never seen the internals, really doesn't know what's inside, etc. yet spouting how safe Linux is (or isn't). Quote, " It actually is secure", but how do you know?

It seems that the Linux foundation ought to know how to secure their own site, so if they are incapable, what chance does the average Systems Administrator have?

Your defense is admirable, but incredibly weak as you seem to fit the very category that spews the "Linux is Safe" line.

As always, one must wonder because even if the monitoring systems exist, if no one uses them, the effect is the same as if it doesn't exist. In that case Windows seems safer because it's a given that attacks occur every day, where the false confidence in Linux lulls people, including professionals to sleep. Makes a much easier target when no one is watching.

Lastly, you make statements that are so far as I can see repeats of the Linux foundation statements. Have to admit, I trust them about as much as Microsoft and Google, not much. They are protecting their interests as much as anyone else.

Good luck in your land of denial. You'll need it in the brave new world.

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

CommonOddity 14th Sep

@Cynical99

I haven't done enough testing to truly calls myself a 'security professional' if that is what you were getting at. I do admit, I need to brush up more in that department. However it doesn't mean I am completely oblivious to the inner workings of the security stack.

I've several white and black hat acquaintances that deal with it, however- and I usually inquire as to their results.

What is it that I said that is so outlandish? Linux is safe != impervious. I can't stress this enough. It's simple English.

Yes, I did re-iterate something they mentioned on the site. It's an interesting point. Did I say "hurp durp, SEE? AM PRO"? No. It was interesting to me (thus leading me to point it out) because it's possible that an injection was blocked- HOWEVER IT MIGHT HAVE BEEN A FLUKE, OR EVEN DUE TO A BUG. That is why I point it out.

How have I come to defend it exactly? I state things as they are. Security is as it was some time ago, the architecture hasn't changed so drastically to warrant any remark. "One must wonder how safe Linux really is" is a B-movie line left for really bad sci-fi horror flicks. I was just amused that you actually used it.

What is it that I denied? They got hacked. Yes, there was a (gasp) security flaw in Linux. Egads! The world is over. Nay! It KENT BE. /rage

Seriously?

What was the last line that I said aside for 'Cheers'?
"I'm curious as to what application was cracked to get the task done". What part of what I posted is denial?

Were I to say that Linux is flawless, and the best in security... Then yeah, I'd be in some pretty deep denial. FL/OSS community knows that if you want security, you go with NetBSD.

Not sure where you were going there man.

0 Votes

+ -

The advantage of Windows

WilErz 14th Sep

@ CommonOddity

I think a major advantage of Windows over Linux is that it's relatively uniform. A good Windows admin from one organisation will, in general, be able to move easily to another organisation and be a good Windows admin there as well. That's because Windows domains tend to be similar, and managed according to reasonably uniform procedures.

Linux servers are often riddled with bespoke software/scripts, sometimes closely linked to a particular admin. That can mean that when an admin leaves, it's easier for the replacement to tear down the server and build a new one. One Linux admin I was acquainted with even admitted that his primary aim was to ensure he remained essential.

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

CommonOddity 14th Sep

@WilErz

Guess I'm not crazy. I've come across someone once that did the same thing with BSD at some ISP several years back. He was giving me 'advice', saying to plant scripts and whatnot that seem cryptic.

After the eerie silence and raised brow lowering back to it's natural position, I decided to chow down on a huge rock of salt.

Terrible idea. Make yourself essential? Bloody dimwits.

I see what you mean with the uniformity being a plus. In a way, that is why I appreciated Ubuntu's philosophy. They want to become the standard. At the same time however, I actually enjoy the distribution diversity. When you have specific tasks, sometimes it's great to have a tailored distribution available.

You could do the same with Windows by rolling out preset images with installed applications and packages... But it's just not the same.

Security distros? No probalo. Knoppix and Backtrack. Storage on networks? Openfiler, FreeNAS (Aye, it's based on FreeBSD. Mighty good bundle it be). Etc etc.

To each their own though.

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

YetAnotherBob 16th Sep

@Rabid Howler Monkey and Cinical99

They know that the kernal code was not compromised because they checked with checksums that were stored on remote desktops that were not connected to the net. There was no bit change from the last update. This has been known for several days.

It's not a big worry. Hopefully, Apple and Microsoft use a similar check for changes made by system crackers on thier products. I have heard that the BSD folks do.

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Rabid Howler Monkey Updated - 16th Sep

@YetAnotherBob wrote:
"They [kernel.org] know that the kernal code was not compromised

I wasn't disputing this. Instead, I was trying to make it clear that Linux isn't nearly as secure as the fanboiz (and grlz) like to believe. cynical99 is right: Linux is a religion (for many), SJVN is a preacher (for many) and the fanboiz (and grlz) take it on faith that it is secure. Thus, the links in my posts. I am curious to hear your opinion of the content in the links I provided.

@YetAnotherBob also wrote:
"Hopefully, Apple and Microsoft use a similar check for changes made by system crackers on thier products.

I wholeheartedly agree. And I also hope that their security policies are superior to kernel.org and The Linux Foundation. What you mention is important, but is one component of an overall security policy.

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

anothercanuck 14th Sep

@Cynical99 One must wonder how you can jump to so many conclusions. For all we know at this point, some Windows PC with a key logger logged onto the website via IE. The key logger send then sent those creds to the 'hacker', who proceeded to 'hack' the system.

Personally, I am waiting for some facts before judging.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Rabid Howler Monkey 14th Sep

@anothercanuck Keylogging isn't restricted to the Windows platform. Search for the following article with your favorite search engine: "The Linux Security Circus: On GUI isolation" on The Invisible Things Lab's blog. I can't post the link here at ZDNet as my posts don't stick.

I have verified this behavior on my Debian system. And by removing package 'xinput', I have removed the behavior without any ill effects.

0 Votes

+ -

This is amazing

kevibdubose Updated - 14th Sep

This is amazing,I just got a $ 829.99 i-P??d2 for only $ 103.37 and my mom got a $ 1498.99 HDTV for only $ 251.92, they are both coming with USPS tomorrow. I would be an id!ot to ever pay full ret??il pr??c??s at plac??s like W??lm??rt or B??stbuy. I sold a 37" HDTV to my boss for $ 600 that I only paid $ 78.24 for. I use I use http://alturl.com/ot3vc

Reply
Flagged

0 Votes

+ -

umm...

tdeemer 14th Sep

Did you read the article? It was likely introduced via a compromised client PC (most likely Windows), which then likely granted the cracker access to high level passwords. That's not "bringing down Linux hard", that's getting lucky with a password file and then accessing servers. It's easy to bring down any system when you have credentials.

Reply
Flag

0 Votes

+ -

Which begs the question:

ye Updated - 14th Sep

@tdeemer: It was likely introduced via a compromised client PC ( most likely Windows ),

Why are they using Windows? Is Linux inadequate?

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

anothercanuck Updated - 14th Sep

@ye Perhaps they work for a company with MS only people making all the IT decisions. You know, the millions of IT people with no confidence in their skills, so they must think 'inside the MS box only'.

0 Votes

+ -

Nut job alert

Raid6 14th Sep

@tdeemer

Brute Force attacks are typically focused on a compromised Windows system? Really?

Huh, interesting.

Its an attack from the Internet, but the compromise was from a Microsoft Windows based computer.....I am sure you are correct. It is after all a problem with Windows.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Home Grown IT 14th Sep

If you are working diligently with law enforcement & tracking down the perpetrators it might take a few days to get things in order. In the mean time being offline facilitates the process of a forensic audit. Do none of you have in the smallest clue? Security has probably already been fixed, but hunting and arresting the attacers may take a few more days. The fact its taking some time might suggest a larger organized attack took place.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

Home Grown IT 14th Sep

If you are working diligently with law enforcement & tracking down the perpetrators it might take a few days to get things in order. In the mean time being offline facilitates the process of a forensic audit. Do none of you have in the smallest clue? Security has probably already been fixed, but hunting and arresting the attackers may take a few more days. The fact its taking some time might suggest a larger organized attack took place.

Reply
Flag

0 Votes

+ -

Anecdote - My own experience

Raid6 Updated - 14th Sep

I am by no means a qualified "hacker", not by a mile. And hacking in and of itself is not inherently an evil thing, it just depends on what color your hat is.

In school we were authorised to provide a proof of concept that we could successfully attack our school's own student portal. This was of course fully sanctioned by the school and our activities were monitored by the appropriate staff.

In this effort a group of us, four students, proved that we could inject javascript into a text <input> field on one of the forms pages. In doing so we were successful at redirecting traffic to any location we wanted, any web URL, and it was perfect.

Oh, and this was a portal written in Java, hosted on a Linux (Red hat if memory serves me) server.

Of course the machines we were using in our labs were MS Windows XP. But why would that matter? It doesn't!

Does this mean that Unix Linux* is not safe and secure?

What about Java, is that where the blame should fall?

Please. It is an easy lesson to learn - bad policies, bad code, bad security.

It has nothing to do with the platform technology but the use and implementation of the technology.

* Reviewing my own post I saw I referenced Unix when I should have referenced Linux as this was what the Student Services was operating on. It does not matter because the principle is the same - bad code, bad frameworks, bad implementation, bad security, lazy and inexperienced programmers and web masters, lack of proper network configuration, and so on all contribute successful hacking.

Reply
Flag

0 Votes

+ -

RE: Some Linux Foundation crack attack details emerge

erica55 15th Sep

Mainly because products are rattling straight forward, locomotion, to see our own elements connected with coach factory outlet ???? you can actually just make an effort to accomplish without this.The reputation of the coach outlet with the good old bag, was actually the original inspiration came from a softball glove, Cheap replica Coach ******** features soft. coach factory outlet online ???? is actually a stylish Coach online store to sell high quality and discount Coach ********, Coach bags, Coach wallets etc. If you love Coach, you will like to get the best price on it. coach factory outlet store ???? comes from the prestigious American which has constantly introduced its classic series of works by their innovation. For your consideration is the Cheap coach purses ???? which is made in USA . It is crafted in traditional monogram canvas and has natural cowhide leather.Though ******** are basically an accessory item of girls, there are many modern ******** and wallets for males too as it has become the ultimate fashion accessory at coach factory outlet ????. coach outlet online ???? is the eldest, voice of reason, and authority of the Left 4 Dead 2 team, playing a similar role to Bill in Left 4 Dead. coach outlet ???? can provide the coach exactly the same is expected in a retail store. It can help you find bags of various colors, shapes and designs, which prove once again that the coach is actually a selection for the housekeeper. Are you still worrying about where to buy yourself a Coach? Then coach bags ???? Online offering top-quality goods and first-class service can be your way-out.He went rapidly up the stairs, walked into his unlocked coach ******** ???? room and at once fastened the latch. It's for you to obey, trembling creation, and not to have desires, for that's not for you!Almost everyone has identified effectively about this, below, among the best to make sure you will get much more information about coach outlet ????.I received the Coach purse I ordered at the coach outlet store ???? yesterday.I like its fashionable style as well as fine workmanship very much. coach outlet ???? has become a popular shopping experience for consumers around the world, and a desirable distribution channel for manufacturer's and retailers.There certainly are a amount of methods to acquire affordable coach products at coach factory outlet ????,it could possibly the most effective options.the most vital cause may be the reality that you simply can purchase genuine coach products at there.Coach ******** from the coach factory outlet online ???? are popular now because of the colorful fabric. It is fashionable and beautiful. You can see the opening of the bag like wave, which is its special design.Coach bags of coach factory store online ???? successfully conbine modernity and classicality and are quite suitable for fashionable young girls and ladies. coach outlet ???? can provide the coach exactly the same is expected in a retail store. It can help you find bags of various colors, shapes and designs, which prove once again that the coach is actually a selection for the housekeeper.If you want to have the latest Coach arrivals, coach factory outlet online ???? may be a good choice. It provides its members with actually beneficial?prices?and high quality services. coach factory outlet ???? can design new and original products that are also functional. The stylish appearance of products, sophisticated workmanship, superior quality and highly competitive prices have won the customer's trust and love from consumers at home and abroad. So you can rest assured that purchase. coach factory store online ???? is sensible for female for you personally to elect to possess the bigger purses and ******** compared to scaled-down types. The most incredible knack about the coach bag of coach outlet online ???? is that it would excellently please your minds beyond your mind's eye. For example, if you want to become the Angelina Julie, you will immediately need to wear the coach handbag around your shoulder.In terms of the quality and superior design that make more and more customers are satisfied to coach factory outlet online ????.Welcome!Coach is a leading American designer and maker of luxury lifestyle ******** and accessories.There is no doubt that here coach factory outlet ???? is the exact place you should visit. coach outlet ???? has a zippered closure and buckles for extra security. Shiny brass hardware, rounded leather handle, and an interior pocket. It also includes a limited edition Hawaii luggage tag and lock. No one can deny the shopping at the coach factory outlet ???? is satisfactory. For the low prices and good quality.Bright colors, exquisite workmanship, durable material and up-to-date style all lead to the great fame of the goods in coach outlet ????. coach factory outlet online ???? is one of the most popular and successful leather brands in the U.S. market.Coach stands for the most-admired innovative style and conventions in American fashion. coach factory ???? is the premier source to review all new Coach and other stylish brands of ********, Purses, and accessories to capture fabulous styles at even more fabulous prices. If you want to have the latest Coach arrivals, coach factory outlet online ???? may be a good choice. It provides its members with actually beneficial?prices?and high quality services.With the safe door to door shipping, the coach outlet ???? will send the products to your hands, which are of top quality and at competitive factory prices.That experts claim coach factory outlet ???? shopping is in the changes they are available in, which can make it well suited for benefit from to be a'luggage'bag.Highest classic, modern design and best quality are the goals of coach factory store ????.It's distinctly that these Coach Crossbody with distinct design and style.

Reply
Flagged

0 Votes

+ -

Linux vs Window security

bartonphillips@... 15th Sep

When recent versions of Microsoft Windows are configured and setup correctly by someone who know what he is doing and has been trained by Microsoft it is a secure as any OS. The big problem with Windows is that Microsoft has made no effort to help the "average" non-professional home user secure his/her systems. Out of the shrink wrapped box Microsoft Windows is insecure while most modern Linux distribution after installation are somewhat secure. That "somewhat" means a lot. That "somewhat" keeps most attacks at bay.

Making any OS really very secure takes a great deal of effort. The effort must be weighed against the worth of the information the system contains. If your system as National Secrets, or bank accounts etc. you better really work hard to safeguard that information. Home systems don't usually have truly critical information and therefor being "somewhat" secure is often good enough. However, being an open book like most home Windows systems are is not enough.

I suspect that the attack on the Linux Foundation and kernal.org etc. was not done by a "script kiddie" but rather by someone or some organization that had a substantial amount to gain from the attack. If this were the work of a "script kiddie" then same on the site administrators, but I don't think that is the case.

Reply
Flag

0 Votes

+ -

I'd say it's the other way round.

WilErz 17th Sep

@ bartonphillips@...

Both Windows and Linux can be configured to be secure, but out of the box, Windows is probably more secure. The hacking of kernel.org is a case in point of how insecure Linux distributions often are by default. Whichever they use at kernel.org, novices should avoid it.

The administrators of kernel.org failed for weeks to notice trojan scripts in rc3.d. This is such an obvious attack that it almost certainly would have been discovered immediately by any Windows AV software, and the backups and audit logs would make it fairly easy to follow the trail.

Even a lazy/inept Windows administrator with no idea of how to keep a system secure would have been warned to install AV software and configure backups. That doesn't of course make a system suitable for a high security environment by itself, but it would almost certainly be enough to prevent an attack as obvious and amateurish as this one.

As an aside, one of the biggest problems with some volunteer Linux distributions is that the support periods are ridiculously short. I once had to do some work on a Linux server running a distribution without commercial support. The 'Linux guru' running it was very proud of its uptime, but I was less thrilled by the idea that the kernel had not been updated for some time. When I logged in, I discovered that nothing on the machine had been updated in at least a year, and that it was full of gaping security holes.

The problem with this server is that it was running a distribution without commercial support, which had been installed maybe two and a half years earlier. With the particular distribution this admin had used, however, the support period is so short that it's measured in months rather than years. After that, updates stop. This particular server had not been upgraded to a new version, so it had simply stopped getting updates.

Needless to say, I was not pleased with the prospect of working on a machine in such a state. However, when I looked into the upgrade options, I discovered that it had fallen outside of the upgrade window, so couldn't be upgraded to the current version. The only way to bring it up to date was a clean install.

When you combine policies like that with lazy/incompetent admins, you get very insecure systems that even 'script kiddies' can easily break into if they try.

Reply
Flag

Page 1 of 2

Join the conversation!

Subject (Max length: 75 characters)

Formatting + Comment

BB Codes - Note: HTML is not supported in forums

[b] Bold [/b]
[i] Italic [/i]
[u] Underline [/u]
[s] Strikethrough [/s]
[q] "Quote" [/q]

[ol][*] 1. Ordered List [/ol]
[ul][*] · Unordered List [/ul]
[pre] Preformat [/pre]
[quote] "Blockquote" [/quote]

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Vendor Showcase

TECH VISUALIZER Sponsored by Brocade

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources

The Best Ways to Migrate Lotus Notes Applications to SharePoint and Office 365Migrating Notes to SharePoint Online/Microsoft Office ... (Quest Software)Download Now
Conquering the Challenges of Data Center ComplexityVirtualization and Cloud are two popular IT trends that lower costs and ... (Hewlett-Packard (HP))Download Now
Office 365 Migration Guide: Approaches, Techniques and ChallengesNo Headache, No Hassles Microsoft 365 Migration

Your company is ... (Quest Software)Download Now

ZDNet is available in the following editions:

Special Reports

Hot Topics

Some Linux Foundation crack attack details emerge

More from “Linux and Open Source”

Topics

Disclosure

Steven J. Vaughan-Nichols

Biography

Steven J. Vaughan-Nichols

Vendor HotSpot

Related Discussions on TechRepublic

Join the conversation!

Just In

fdsd

Join the conversation!

The best of ZDNet, delivered

Vendor Showcase

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources

Featured Articles

Services