Slashdot Mirror
SourceForge Server Compromised
justrob writes: "Looks like there was a massive security breach at Source Forge.
I wonder if this what caused the 'unscheduled maintenance event'
that has left the shell servers unavailable for a week. Here is part of an email I recieved:" (Read more below.)
"Dear SourceForge User,The SourceForge team takes security very seriously. This week, one of our systems was compromised. We have promptly taken the necessary steps to correct this situation.
You have been contacted, because according to our log files, you have used SourceForge during the past week and may have used the system that was compromised. In order to complete the security fix, we are asking all users who used the system to change their password immediately. We've reset your password to a randomly generated string. "
Here's where to go if you think your account might have been compromised.
By the very anarchistic nature of the Internet, we find that centralized targets are good ones. Look at the DoS attacks on eBay and such. The Internet was not made for single-server communications, and those who think it is, will pay the price.
OS security certification: http://www.radium.ncsc.mil/tpep/epl/epl-by-class.h tml
Kerberos on a locked down server would be preferable to splitting a login between servers. What happens when a verification server is down or gets compromised and sends incorrect results, preventing authentication?
Generally NT gets (well deserved) criticism due to MS's slow fix process and occasional outright denial that a problem exists. Couple this with administrator errors and you've got a bad situation made worse. On Linux & BSD based systems the potential for admin error is still there, but the vendor induced problems are generally *greatly* reduced.
But since he was talking about wrongs and not rights, you never know, three may well make a u-turn.
Have you ever built a Win2K kernel? I'm curious as to how long it took. How many lines of code was there? Oh, and I'm sure I'm not the only one who goes crosseyed after reading guff leik tihs: int WINAPI WinMain(HINSTANCE hInst, HINSTANCE hPrevInst, LPSTR lpCmdLine, int nCmdShow) {... oops, forgot the #define WIN32_LEAN_AND_MEAN (sic)
1 Basket.
Lovely news, but hardly a surprise.
Stupid admin is a feature lacking EVERY os.
Thats why I'm writing an os with stupid admin built in.
How dose it work?
Well you set it up and tell it what you are doing. It installs all the software etc and sets everything up at the WORST possable setting.
The os has a built in test to see if any built in back door remains.
The SysAdmins job is to find all the back doors (with that tool locked out) and close them.
The manager then unlocks the tool and checks the SysAdmins work.
In otherwords... It's an employment test...
Closed source of course...
But I suspect since sourceforge hosts MANY CVS based projects, that open-source software could be injected with outside code...
A developer with any sense is going to do a cvs diff and verify any changes before continuing on like usual. No big deal really.
--
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
How secure are the CVS trees? I assume sourceforge's CVS trees are backed up regularly. It would be horrendous if not, because any of the cvs trees on SF could have had backdoors added to them.
Perhaps the authors of the programs should check out their software to a different directory and do a diff.
I am happy to say I don't rely on sourceforge. It is a mistake for a large part of the community to rely on one site for this sort of thing. I run my own CVS server, and am about to pay a small amount ($10/m) for an ISP to host my hobbyist code. Granted, it doesn't have all the features of sourceforge, but I don't mind.
Presumably their security consulting team does not manage sourceforge. I'd imagine the two have little to do with each other.
And you've still got the problems I outlined before. And how are the login servers interchangeable? They can't all store all the pieces of the passwords, because that defeats your scheme entirely by storing the entire password, unencrypted, on every server.
I'm sorry, I just don't think this will fly. :]
Full usernames do need to be known, because you're dealing with a multiuser system where users like to interact with each other. What happens if you run 'w' on a system like the one you're describing? Using uids for most things would work, but remember that humans use this stuff, and people like to have names, not numbers. If I do an 'ls -l', I don't want to see that a file is owned by user 11203, especially if for the sake of security I don't get to look up who the hell user 11203 is.
Your system could work if applied to the passwords, but it would gain you nothing. Any sane system already uses a hidden password scheme, most commonly shadow. The system never stores the actual password anyway. What it stores is a hash (MD5 usually, these days) that it can verify another (dynamically generated) hash against. Your system does not remove this dependancy on having the hash accessible on each authentication server. You have to have the sum there to verify against. How else would your systems verify that there is a string with "those two letters in that particular position... associated with that particular cryptographic sum"? In fact, your system would have to store the two letters in question and their position to do so.
Bam. You've created a less secure system than the currently existing one, because you've just fed a brute-force password cracker two of the characters it needed for each password, if that file is compromised.
Now that my favorite project, ALSA, is also moving to Sourceforge I'm more concerned about it becoming a single point of failure. Just think about it. If Sourceforge goes down for an extended period of time imagine the chaos, not to mention the loss in 'productivity' in the OSS community. I will probably be one of the last developers moving to it...on the other hand, they provide an excellent service, one that would cost an OSS developer cash otherwise. Anyway, my only real gripe with Sourceforge is their usage of Geocrawler for mailing list archiving. Damn, that's one crappy interface!! :( Sorry for ranting...
-adnans
"In short: just say NO TO DRUGS, and maybe you won't end up like the Hurd people." --Linus Torvalds
Kind of makes concurrent development, etc. hard, now doesn't it?
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
Nifty!
The idea would be not that the server doesn't have to store the password - but that the password in plain text never reaches this machine. And, in plain text, never reaches ANY machine in it's plain-text entirety. You split the username and password into pieces, and have several different servers verify the pieces, and then report back to the central server (the one you're attempting to log in to) that this user - who never sent the central/login server a single bit of his username/password - is okay. If *any* of the verification servers (and losing one is okay, because they're all interchangeable - if one's gone, send it to another in the verification server pool) reports back "bad!", then the user is not authenticated.
:-)
Now, obviously, the details are fuzzy, but hey, that's life.
What I find particularly interesting about this whole deal is how their distributed network setup has worked against them. Reading the wording of that email closely, you notice that you are being asked to change your password because you MAY have used the system that was compromised. They don't actually know.
And even if they did know, would that help, I wonder? Is user information distributed within the SourceForge network, or is there a more central login server that warehouses all of that information? Either case, when you think about it, is somehow not exactly what you want to have happen. If all user login information is in a central location, cracking that one location would instantly compromise everyone's account information. However, distributing user information around the network (aside from making login management more difficult) makes it more likely that if a random server is cracked at least *somebody*'s account information will be compromised.
It occurs to me that a distributed, and cryptographically fragmented form is the most desireable - because then cracking any one machine would give you exactly nothing in the way of user account information.
Now, the rest of the problem is people who use the server that has been compromised. They send their usernames and passwords to this compromised server (unawares, of course) and thus their information is compromised, obviously. But does it have to be this way?
I propose that it is conceivable to build a login system where no one server receives an entire piece of a login. The login name is split into two character pieces, for example, and sent to as many servers as necessary along with an MD5/SHA1 sum of the full username - each server verifying that there exists a login name with those two letters in that particular position, and they are associated with that particular cryptographic sum, and nothing more. Notice that the controlling server (the one that you're logging in to) never sees any piece of the login name - but is merely informed (by the client) which machines (in no particular order) the login name pieces were sent to. A similar trick could then be played with the password - sending pieces of the password to some password verification servers, with a cryptographic sum of the verified login name. So, each server never has a record of full login names, and no server ever is sent the full login name.
To bad no such system exists, eh?
Queso is very inaccurate. I have seen it give answers that can best be described as "wild-ass guesses". You are better off using nmap for OS detection. At least it has been updated on a regular basis.
"Trademarks are the heraldry of the new feudalism."
A developer can type "cvs diff -r HEAD" to see what has changed between whatever is checked in and what they have on their local store.
Actually the idea that the hackers would do this is rather silly. This was also suggested that hackers into MicroSoft may have modified the Windows source code to introduce back doors. Anybody who thinks this is possible should be writing movie scripts.
Obviously getting compromised is bad, but outside of vandalism of existing source code, like if they delete your CVS codebase, what are they going to do? Steal something you could already get through the web for nothing?
Of course passwords could be compromised, which means the silly monkeys that use "er33t" as the password for sourceforge, slashdot, freshmeat, and hotgoatsex.com will have to change the passwords in different places too.
What are the implications of this security break in? I'm open to the idea that they're larger than just vandalism of source code and passwords, but what's the bigger problem?
-- Truth goes out the door when rumor comes innuendo. -- Groucho Marx
I bet Windows systems are just targetted more than Linux and other Unix systems.
I think inferring relative OS security based on web site defacement would be a mistake.
-Kevin
I agree with what you're saying, but I still think the original poster muddled social issues with technical issues.
As far as your question about choosing between two platforms: I don't think an IT organization would make a decision based on security alone, it would be a decision driven more by cost of ownership and other logistical (e.g. in house expertise) / economic factors.
-Kevin
No, you're wrong.
Access to the authorized keys means that the intruder(s) could have added their own public keys, thus ensuring future access. The problem is not public key hashes being stolen.
-Kevin
Aye, two Wrights make an airplane.
Without you I'm one step closer to happiness without violence.
However, they were fired for relying on it.
Without you I'm one step closer to happiness without violence.
We need a good, polite, robust, idiot-proof "mirror" script so that the folks who are interested in this stuff will be the backup of last resort more reliably.
heh
That was excellent.
Given enough hydrogen, just about anything is possible.
Well, because it's just the truth.
While in my embryonic linux stage, I had two boxes cracked, and it was due to the default services (at their default configs) left on by the RH install, and then by me as I didn't know to turn them off (or how to check that they were on, how to know what the given services were for, etc.).
Of course, getting cracked was an *amazingly* effective incentive to learn how to secure a system, which is why I haven't had a box cracked since those initial two. It also planted the seed of my now-healthy sense of paranoia, which contributes greatly to my skills in system administration.
Anyways, RH's installation left a lot to be desired. It *still* leaves something to be desired, but they are improving. I'll stop there, as this subject has been discussed into the ground many times.
Given enough hydrogen, just about anything is possible.
First, just because someone makes an error doesn't mean they made a stupid mistake. Just as we don't know whether this was human error or buggy software, we don't know if this was a stupid mistake or an easily made error.
Second, robustness (i.e. lack of error proneness) is indeed a feature of all software. Human error rate when performing a task is a useful metric for evaluating software usability. An OS that is "easy to secure" has a feature that many would find advantagous.
Ideally, computers should serve humans. Making a task error prone requiring a human to go through the proper hoops or suffer a security breach is a reversal of this ideal.
-- unix is for people without a social life - Patrick van Eijk
The admin could have been on crack and posted his pasword on Usenet..
It could have been the sock people...
It could have been CmdrTaco over his contention that it's Gnu/Linux...
I'm kidding.. but you have a point...
IMHO It really dosen't matter what you use. Hire a good admin let that admin run what ever he thinks is best. It dosn't need to be a pure Linux or Windows system.. Throw in Solarus, BSD, Mac and BeOs machines if the Sysadmin thinks it'll enhance the system.
You think Windows or Linux can do everything perfictly?
If so.. stay away from me...
I don't actually exist.
Your right about the advocacy facter..
Linux advocacy rises to match that of Microsoft FUD (in otherwords no better than)
Two wrongs do NOT make a right.. three make a uturn and four make a left..
Ok why should Slashdot ever post a Windows defect anyway?
On the other hand.. Go read the stuff on Windows websites.. Every Linux defect is published as proof Linux is poor defective etc etc etc.
Getting the facts straight..
Windows can be secure Linux can be cracked..
It's the SysAdmin that make it happen...
Software is just tools...
But never tell an auto repair profesional he must use the brand of tools you picked..
Same for SysAdmin...
If the SysAdmin prefers Dos he shouldn't be forbiden from using it if it can do the job.
(Some tasks are insainly low overhead and can run from a XT running Dos... very few...)
I don't actually exist.
The action plan is
- Generate a secret key. Use a strong passphrase, and keep it on a machine that you trust deeply. (Your own laptop or desktop.) Perhaps even keep it on removable media.
- Distribute the public key widely. Get other people to sign it, after checking your credentials.
- For all future releases of the software, either generate a detached signature, or put the MD5 signature into a GPG-signed release announcement.
- When you download software, check the signature before you install it.
This is not complete protection: there are still attacks involving breaking the signing machines, getting users to use the wrong public key, and so on. But if more projects started using this, it would be a real advance.Until we know, there is just as good a possibility that the site was "cracked" by someone leaking an important password, somebody walking up to one of the servers, an upset employee, the brother (or brother's friend) of someone who works admining the SourceForge project ("Hey, can I check my email?" "Sure"), or even a laptop swiped at E3 that had an admin SSH account preconfigured.
Don't assume that it's a technical problem... I've only had one and a half major successful breaks in security, and both were social, rather than technical problems. Plus the *very* common problem of cell phones, ISP and AOL accounts and such that are used for a few months past termination because HR didn't inform IT. Hell, we even had someone using our contact database (that's the half) because HR never told us, and he was running around with a company laptop and an (easily turned off) key disk.
--
Evan
"$30 for the One True Ring. $10 each additional ring!" -- JRR "Bob" Tolkien
However, the original problem is that the source is open. Since the hackers can look through the code,
You would have a case if open source projects were more subject to hacks than clesed source projects.
The general evidence is that the opposite is true.
And by "general" you mean anecdotal.
In this arena there is no other type.
Why do people do it? I dont know.
http://www.sourcefourge.net/
It will drive you crazy. I just want an option on my browser for it not to run the onLoad / onClose javascript only. I hate that damm browser take over shit.
--
_|_
The above is not worth reading.
No, I just use Debian.
apt takes care of all that for me.
Typical scenario:
[vince] I want to try some new software!
/me types apt-get install new-package
[vince] This sucks.
/me types dpkg --purge new-package
You get the idea.
Regards,
Vince.
I need a sig.
Start your own then. It's not as if Sourceforge itself isn't open source :)
There is, of course, the small matter of actually getting the equipment to run it on..
--
mysql> DELETE FROM world.human_race WHERE iq < 100;
So I am hoping that there is some external way of verifying that any changes that went in since the crack can be verified as bona-fide. Shouldn't contributed stuff in large projects be GPG signed or something? They can try insert code, but they'd have to fake/steal a key as well, at least that would narrow down what you would need to look at.
:o)
Xix.
P.S. I am largely ignorant of how it is all put together, so I am quite possibly asking some obvious/silly questions. I promise to go away and do some reading now.
"Everything is adjustable, provided you have the right tools"
Xix.
"Everything is adjustable, provided you have the right tools"
It is hard to disprove the open source myth that it leads to bad security because of easier-to-find holes when PHBs read things like this, that happen to major Linux servers.
Right...because it never happens to Microsoft. That's very clearly known.
Running queso on sourceforge.net reports :
216.136.171.196:80 * Novell Netware TCP/IP
I think 'queso' is wrong.
I don't know what PHBs you're talking about, but all the PHBs I've ever met care only about reducing their dept's spending and increasing their dept's output. They most certainly are 'interested in why not to use Microsoft', and it's called money. But they don't think there is anything else out there that they could possibly use.
In the recent past, some of them have learned of this 'Lee-nooks' thing that they might be able to use instead of the oh-so-expensive Microsoft stuff! However, they're very cautious since 'no one was ever fired for buying Microsoft', and if Linux fails (many of them worry Linux and OSS may 'fail' as a concept, but in reality it's their deployment that might fail) then it's their ass for using it. Reports like this one do make them nervous about Linux, but only because they are worried that there's no comapny to blame when this happens (they think).
PHBs may be stupid but they can add and subtract. Unless it's relevant to their business, they care very little about 'uptime' (usually) or 'reliability' (usually), but stuff like 'price' and 'liability' they are very well aware of. Linux intrigues them with the price, but they are very worried about the lack of centralized liability. That's why Redhat is doing so well, the PHBs have to have someone to
When you don't trust a host with your source or binary code, store the MD5 or SHA1 sum somewhere else.
The BSD "ports" tree is very well designed for this. The MD5 sum is stored on *BSD mirrors, and the files are fetched from various locations (like Sourceforge) . When a port has to be built, the source code is fetched and compared with the awaited MD5 sum. If the sum differs from the computed one, a bigfatwarning appears and installation stops.
I guess Debian packages fetched through apt-get have something like this, too.
For other package or source code, put MD5 / SHA1 sums on another web site. But well... unfortunately in the real world, users will never check the sum.
And this doesn't protect the CVS tree from being trojanized. But the CVS tree is another story. When a developper types 'cvs update' or 'cvs commit' and discovers odd changes (for instance on the part he -and nobody else- is working), he can discover the trojan and reset the tree to a sane state.
In all cases, the open source world depends on trusted relationships. Sourceforge has the power to put trojans in all major open source projects and it would hurt a lot. The same thing goes for Tucows, Ibiblio.org, etc. Developers have to trust these free hosting services. End users have also to trust them. End users should also trust developers. There are many popular projects with only one developper, so nobody would review the code while an hidden trojan is making disaster.
But open source developers and hosting services are clean. Everybody is trusting each other. While any of them could create severe damage to the open source world, it doesn't happen. This is a question of mentality. On some commercial operating systems, trojans and viruses are common, and people never install new software without running an antivirus.
{{.sig}}
I disagree. Not releasing the source code means that :
If you read Bugtraq you will notice that Windows applications have tons of security holes. But the number of holes is not important. The important thing is that often, a security advisory ends up with "Vendor has been contacted... no response so far... no known fix... no workaround..." . And what can vulnerable users do in this case ? Nothing. Wait. Pray that nobody will see the breach. Wait until the vendor wakes up. If he ever does.
Also, remember that most closed-source encrypto schemes were hacked (decss, anyone ?) .
{{.sig}}
No sense in making it easier for the crackers. "Here's what's broken! We've just narrowed your list of 384 possible exploits to try down to one!"
No, not yet. I know some of the people working SF, they already know how to fix this sort of thing and don't need /. posters telling them how to do their job (including me *grin*). And if I were in their place, I would first fix the server, then fix the other servers that haven't been compromised yet, and only then announce what the problem was.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
Here is part of an email I recieved:
Remember the rule: "i" before "e" except after "c" or when sounded as "a" as in neighbor and weigh. This site fairly cries out for an editor.
Hopefully OpenSource's luck will change soon. This is starting to get depressing.
That's a little dramatic, don't you think? Lets wait and hear what the error is before the condem the free software movement.
Geocrawler was originally meant for one mailing list. That it's still around is incredible. I talked with a guy responsible for Geocrawler about it in Boston earlier in the month, and he assured me it's going away in favour of something they've been developing to replace it.
;)
Which is a good thing, since it's down for 8 hours every day doing magic things
--
--
Internet Explorer (n): Another bug -- that is, a feature that can't be turned off -- in Windows.
well, as with all community systems, there is one problem:
- users are dumb
so, they tend to forget their passwords, and one strategy is to send them to the dumb user via e-mail. this requires plain text storage. There are other ways, but the dumber the user, the plainer the storage, because no site admin would want to answer all the dumb user emails about forgotten passwords.
Whoever compromised the system should post their exploit on SourceForge.
Feed the need: Digitaladdiction.net
It depends if installing a root kit counts as "personal use" or "distribution". If you constructed the kit from GPL code and made modifications then you're only obliged to release the code if you pass on the program.
:)
It could be argued that installing a root kit on someone's machine is not distribution, since you don't intend that anyone else notice it. In this case, you don't need to release the source.
Of course, if you're a good person (and who isn't?) you'd just release the source. The GPL FAQ states that it's sufficient to only supply source in the same way you provide the binaries, so dumping the full source in an obscure directory (say, "/usr/share/fonts/...") on some machine you've cracked is probably sufficient to fulfill your obligations in this respect.
I'd love to see this get tested in court.
Wasting your time since 1997.
Wonder if anything like that happened in Redmond, today.
My hat's off to SourceForge along with my gratitude. I'll get back to work tomorrow after my 3-day weekend's over.
These poor bastards had to work, and, all 21k+ of our OSS projects are still in tact: I've checked mine.
It's a shame the butthole(s) who did it couldn't have called a truce and gone and done some fishing on a particularly beautiful weekend.
Linux rocks!!! www.dedserius.com
www.dedserius.com
VB != VisualBasic
So what? Your response is just another typical meta-Slashbot reaction.
Haven't I already heard what you've said before 50 times in other threads? -50, Redundant dude!
But I suspect since sourceforge hosts MANY CVS based projects, that open-source software could be injected with outside code...
Will they be changing their name to ForgedSource, then?
-- Insert witty one-liner here. --
Ok, I read more details about this on the bus on the way home at 6:30 this evening , and 5 hours later no one's mentioned them? Slackers... :)
From C|NET:
From this, I'd have to guess that SourceForge allowed telnet in, and the cracker was sniffing on the cracked ISP's box. It's also possible that the admin was tricked into using a trojaned ssh client from the ISP's box, but the former sounds a little more likely from the limited details in the article. If so, I'd have to blame SourceForge for allowing incoming telnet.
If it's the latter, it gets harder to blame SourceForge, but we still can. :) If the admin was doing admin-type functions, he shouldn't have been using an ssh client that he didn't have complete control over.
Gumbo
I'm sure some silly kids wanted to get the source code of the hosted projects !
"Naughty, naughty, naughty, you filthy old soomka !"
Actually, I'm waiting to find out what the cause was.
Stupid admin errors happen both on NT and UNIX - they're not a feature of the OS.
Software problems are a different story. And we don't know which yet, so I'm waiting. Mostly. :)
This applies to both 'white hats' finding, reporting, and fixing the holes, and to 'black hats' finding, exploiting, and sharing the exploits.
In general, intentionally added backdoors in open-source software have a relatively short lifespan, while backdoors in closed-source products can live on indefinitely.
As I was quoted in a print magazine nearly a decade ago "The holes are already there, it's simply a matter of who finds them first".
One advantage of OpenBSD is that a primary goal of the committers is to pre-emptively find and fix problems that have the potential to be holes.
I do not deploy Linux. Ever.
Guys, calm down! That's what version control is for! If you maintain a project on SourceForge, just look at the diffs to make sure nothing malicious was done in that time frame! (Assuming of course that the SourceForge guys did a decent job of keeping backups.)
Education is the silver bullet.
I've heard people decry the fact that most Open-Source projects are now hosted on Source Forge (primarily I think because they were worried about the company suddenly going out of business or doing something crummy and underhanded). I guess this is one of the other consequences of having a centralised repository.
SourceForge needs to be a lot more forthcoming with is report on what happened and how they responded. I assume that the crackers got root access?
/etc/rc, changes to source code on the system that the cracker guesses will be compiled and run, additions in ~/.profile's, daemons left running, the list goes on and on. Tripwire cannot detect everything, and that's only relevant if you've been using it in the first place.
According to security theory, the hard drives of the servers affected need to be wiped. The OS needs to be reinstalled, reconfigured, and the backups need to be brought back onto the system auditing configs & data as you go for cracker changes.
In theory, once a computer is compromised at root level, there is no way to know whether you have completely eradicated all traces of the cracker. If you find 56 backdoors and take them all out, you might miss #57. Trojan binaries replacing system binaries, entries in inittab and inetd.conf, introduced kernel modules, additions to
Yes, in some cases I've worked on compromised servers for companies and they don't or can't take it offline right away so it has to stay up. I'm guilty of the post-hack one-day sweep where you clean out the crud and lock it down, warn the client profusely of the dire nature of such actions, and hope for the best. But that's not ideal security procedure.
SourceForge is the single most highly rated, most visible, most acknowledged and respected source repository and project worksite in the OSS community. If a compromise lingers that were to introduce snippets of code into main()'s as source was compiled into binaries, we could be fscked. How embarrassing would that be for the community? Imagine if a newpaper reporter downloads an rpm from SourceForge expecting to run a cool new app and it tells him that ALL YOUR HARD DRIVE ARE BELONG TO US.
For years, my manager refused to support Microsoft solutions because they weren't standards-based. Unfortunately, we couldn't use Unix either because he didn't want to build or support anything in-house ... as a result, we didn't have anything. Our users were furious, but eventually his teflon wore off :-)
Corollary to Moore's Law: The IQ of new computer owners is declining.
surely you cuold download the Source to mozilla from sourceForge and change it yourself
.oO0Oo.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
you don't need a kick ass mainframe you just need a good distributed OS.
.oO0Oo.
try plan9 where no user programs run AT ALL on the file server. CPU servers can be added anywhere on the network and used by anybody who's allowed. Yesterday's files are read only on the WORM.
Unix & Windows both had security ADDED to the model and so kludge the matter.
Oh, you're a super user, here : read, write or delete anything you like, kill a few processes too while you're at it.
That's a lot of power for an 8 digit password.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
I agree you can't "steal" open-source software. But I suspect since sourceforge hosts MANY CVS based projects, that open-source software could be injected with outside code... correct me if I'm wrong, but that seems pretty damn serious.
cheers,
metric
Everyone keeps saying "No trojans! Just diff the source! Version control!". People, if the server has been compromised and the cvs server has been compromised, they can modify EVERY version back down to .01 alpha. So you diff it and it comes out clean. Fubar. When you read the source you can easily miss the change between something like:
memcpy(fu, bar, length - 1);
to
memcpy(fu, bar, length);
And now you have a possible buffer overrun.
The only way to effectivly diff is if you had copies of the source stored elsewhere.
Careful not to feed the trolls too much are they'll get a stomach ache. Or something.....
No thanks. I don't smoke anymore.
Sourceforge is probably not withholding information because they don't want people to try it again. Whenever there is a complicated compromise, it can take weeks to figure out what has been compromised and how. Generally the priority is to get the system running again, which typically requires a completely fresh start for the operating system. When a system is compromised, it is easy to tell for some thing what probably has been compromised (such as the password files in this case). But most hackers hide their presence from logs as much as possible - even script kiddies do that. Otherwise they would be detected before they got very far, and it would be easier for the victims to figure out how they were compromised.
For non-trivial webfarms, the OS running on the servers often has little to do with the TCP/IP packet signature, because of transparent proxies, firewalls and/or load balancers in the path. In this case, SourceForge is most likely running Novell ICS or some other variant on the old "BorderManager" theme. That, or your signature tool is just a bit confused -- not surprising, as different Linux kernel/patch levels have dramatically different signatures.
That said, there is some difference between securing a development server where a gazillion people have shells and need to be able to run arbitrary code, than it is to secure something that, say, only needs to spit out HTML pages.
Bert Driehuis -- All I asked was a friggin' rotatin' chair. Throw me a bone here, people.
How dose it work? Well you set it up and tell it what you are doing. It installs all the software etc and sets everything up at the WORST possable setting.
I see the settings are also available for spelling and grammar checking.
--
As a matter of fact, I am a lawyer. But I play an actor on TV.
I thought that's what they were doing with the email - alerting their client base to the problem. Unless you mean when it comes time to reveal the nature of the compromise....
--
As a matter of fact, I am a lawyer. But I play an actor on TV.
J.S. Wurzler Underwriting Managers, one of the first companies to offer hacker insurance, has begun charging its clients 5 percent to 15 percent more if they use Microsoft's Windows NT software in their Internet operations. Although several larger insurers said they won't increase their NT-related premiums, Wurzler's announcement indicates growing frustration with the ongoing discoveries of vulnerabilities in Microsoft's products.
How about this one ?
Konqueror provides almost exactly such a facility, allowing you to disable the Javascript window.open() method whilst otherwise retaining full Javascript functionality. Say bye-bye to annoying popup-windows... for good!
As I remember, such a feature was proposed for Mozilla some time ago too, but the idea was rejected by the Netscape engineers building Mozilla's Javascript support on the basis that it was a poor idea commercially. Indeed, Netscape's own homepage frequently uses window popups.
I think from this and other examples (not least Konqueror's other advanced Java, Javascript and cookie management) one could make a strong case that non-commercially-developed Free Software is superior from a user's point of view, as the user dictates to the software what to do rather than a commercial organisation dictating what the software should do. The conflicts of interest that plague other software just aren't there.
I find it remarkable that such a wonderful yet tiny and easily-implemented feature can be missing from every other major browser. Ask yourself why this is.
No, I believe you are wrong. If Windows systems are targeted more often, then that in itself is a security problem, is it not? If you had 2 different platforms that were of 'equal security' but one was targeted much more frequently than the other, which would you choose?
In the security game, it pays to be able to keep your head low and out of trouble, no matter how tough you are.
Note that attrition.org do have an OS pie chart, which show 59% of the servers are NT and 24% is Linux.
That's a pie chart not showing overall OS/Webserver marketshare during that time period (Aug 99 - May 01) but rather the share of all the defacements attributable to each OS - so 59% of all the defacements between Aug 99 and May 01 were on NT servers (which here means NT and Windows 2000 combined), and 24% of all the defacements were on Linux servers.
This only goes to prove the point further.
Tell me - did you not have any coffee this morning or do you find it difficult to understand graphs and statistics?
Those graphs are very misleading, because they lump NT4 in with Windows 2000. It is widely known that NT4 had serious issues, which isn't surprising, since it was designed prior to the real internet explosion -- IIS was originally an add-on.
That's a ridiculous argument. Regardless of what it was originally designed for, Microsoft ended up selling NT4 as an Internet server OS. If, as you readily admit, it had serious issues, then why were they promoting it as a premium Internet-capable OS in the first place? Further, when the server technology changes again in the future (and believe me, it will), how can you possibly trust Microsoft to get it right given the mess they made of transitioning NT4 to the Internet and webserving?
Second, I should point out that Linux, and indeed every other Unix and Unix-alike, was designed before the 'real internet explosion' too. Indeed, if you trace back the lineage of 'proper' Unix, it was around when the internet was just being born, and many years before the arrival of TCP/IP, let alone HTTP. A webserver is still an add-on for most Unices and yet they seem to be able to cope quite adequately and securely with it.
Third, all the other OS stats combine current and previous versions of the OS together. Given that Windows 2000 is merely NT5, why should it get any different treatment?
Finally, go have a look at Attrition's website defacement stats for May 2001 so far (although Attrition are no longer mirroring defaced websites, they are still compiling statistics on defacements). Here NT and Windows 2000 are treated separately. You will notice that although NT is by far the most defaced, Windows 2000 comes second with some 29.55% of all defacings (all this information correct at time of writing). This compares to a total of 8.99% of all defacings for combined versions of Linux. This is a quite remarkable achievement for Windows 2000, to achieve this in just 18 months since its release - over 3 times the defacement rate of Linux. Well done Redmond!
Oh yes, for those of you who need a reality check about market share in the webserver market, this is the latest Netcraft survey. Sadly, the statistics by OS are not available without paying Netcraft (come on, we know it's the SSL survey that you make money from, please give us some hard OS information for non-SSL sites). However, it would be conservative to assume that approximately 60% of all Apache sites run Linux, and that figure still gives Linux twice the market share of NT and Windows 2000 combined. If we make another very conservative assumption, that Windows 2000 is half of that combined Microsoft figure (the following figures get worse for Windows 2000 the lower that share is), then we get this rather amazing figure:
Taking even very conservative estimates, a Windows 2000 webserver is currently at least 12 times more likely to be defaced than a Linux webserver.
I think that says it all.
This is a useless measure, as all that is stored in the authorized_keys files are the public key hashes, which cannot be used to compromise any other systems. (Not unless they get more data about the key or find a way to reverse the encryption, but I count that as highly unlikely.)
The only thing that could come out of having the public key hashes stolen is that we could maybe login to the systems of the bastards that hacked SF and get our revenge.
Thusly, SF has wasted a chunk of time for everybody by obliterating our public keys.
ICQ# : 30269588
"I used to be an idealist, but I got mugged by reality."
ICQ# : 30269588
"I used to be an idealist, but I got mugged by reality."
(C'mon, please? I've never had a law named after me before.)
--
--
fat lenny's gonna lick your brain today.
The password file is an obvious point of vulnerability, but it isn't the only one.
---
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
But I suspect since sourceforge hosts MANY CVS based projects, that open-source software could be injected with outside code... Hm ... maybe this was done by someone who couldn't get people to apply their patches...
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
No, not releasing the source would hide many security problems. Probably only temporarily.
-Gabe
With sourceforge being hacked, it makes one wonder why companies should trust valinux to do security, if they can not even secure their own network. They have been advertising pretty heavily about their
security consulting services, and I wonder if there is any reason to believe they can secure their clients' systems any better than they did their own.
kinda like they sometimes bust drug lords for tax evasion ;)
SSL Certificate
My IIS server got hacked! Of course I never tried to secure it cause I had nothing on it....
Jan 18th:Apache/1.3.14 PHP/4.0.4pl1 mod_ssl/2.7.1 OpenSSL/0.9.5a
Mar 29th:Apache/1.3.19 PHP/4.0.4pl1 mod_ssl/2.7.1 OpenSSL/0.9.5a
I havent seen any apache security issues, maybe it's a convenient time to update...Interesting nonetheless.
Mooniacs for iOS and Android
I didn't know apache ran on Novell. HTTP/1.1 302 Found Date: Mon, 28 May 2001 22:56:25 GMT Server: Apache/1.3.19 (Unix) PHP/4.0.4pl1 mod_ssl/2.8.1 OpenSSL/0.9.6 X-Powered-By: PHP/4.0.4pl1
Great. Now instead of red-baiting we have RedHat-baiting. How this gets modded up to "5, Insightful," is beyond me.
I do not have a signature
It was Shoeboy!
sulli
RTFJ.
Insightful because it's the sad yet ironic truth. The supposedly most popular distro is the most pokey of them all. I don't know shit about linux aside from awkwardly setting up Apache and a few mods, yet it's easy to see that RedHat is patchwork-quality when compared to any other distro. Heck, Mandrake's modus operandi is to take RedHat's offering and clean it up, make it nicer. That sure tells alot about RH.
-Billco, Fnarg.com
I'm not saying this is the case, I'm just speculating.
No, but google would have a license to use the password.
yvan eht nioj
216.136.171.196:80 * Novell Netware TCP/IP
Coincidence ?
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
Well you set it up and tell it what you are doing. It installs all the software etc and sets everything up at the WORST possable setting."
I think someone beat you to it.
-atrowe: Card-carrying Mensa member. I have no toleranse for stupidity.
As a side note, you're absolutely right. Security breaches are a fact of life on the Internet and no site is 100% secure. Just remember this the next time there's a story about a MS site getting cracked and try not to get all high and mighty about it because Linux, just like every other piece of software is NOT 100% secure.
-atrowe: Card-carrying Mensa member. I have no toleranse for stupidity.
They've already done more than what is the usual for most companies.
Those graphs are very misleading, because they lump NT4 in with Windows 2000. It is widely known that NT4 had serious issues, which isn't surprising, since it was designed prior to the real internet explosion -- IIS was originally an add-on.
In contrast, Windows 2000 is much more secure and infinitely more stable out of the box than NT4. Of course there are some issues that need to be patched, but that's life.
Bottom line: don't try to mislead people by pretending that those numbers are for Windows 2000; most are a result of widely-known NT4 holes that admins haven't bothered to patch.
-------
-- russ
"You want people to think logically? ACK! Turn in your UID, you traitor!"
Natural != (nontoxic || beneficial)
Plus the fact that when you buy Microsoft, you get lots of features that are guaranteed to work together and meshed in a nice, easy to use package. Microsoft offers end-to-end solutions with little overhead -- something that none of the Open Source distros can come close to claiming yet.
As far as features go, the ones that ensured we wouldn't be adopting Linux are: ACLs, Directory Services, and ease of use.
-------
-- russ
"You want people to think logically? ACK! Turn in your UID, you traitor!"
Natural != (nontoxic || beneficial)
If they didn't provide full source for it, we could bust 'em for violating the license ;).
+5:offtopic,but anti-American
Damn right they're not. The phrases "End-User Error" and "PEBKAC:Problem Exists Between Keyboard And Chair" both exist for a reason. Computers, properly built, are infallible -- they do exactly what they're told (forgetting manufacturing defects and hardware faults). We the people, the coders, the software developers, are the ones who introduce failings into the machines. OTOH, a computer without software is just a boat anchor.
MCH/VO S* W- N+++++ PEC+++ D(s++/r) A a+>+++ C* G++(++++) Q+ 666 Y
"Clearly opensource developers' intents are noble."
Give me a break. In what way are open source developers more noble than other developers?
Somebody might have got some of the sourcecode from the projects!
Oh, wait.
This has nothing to do with open source. Securing a machine where people are shelling is difficult, even with chroot'd environment. It would have happened just as easy on Solaris, Aix, or BSD.
I do think it is important for sourceforge that they make a public post explaining the exploit and how to stop it. My guess is that they will as soon as they figure it out.
political_news.c: warning: comparison is always true due to limited range of data type
Sometimes it isn't easy to figure out exactly what did happen after the fact. In addition, they could still be in the proccess of fixing the problem even though they've publicly stated it has been fixed. Remember all those times when your dialup ISP told you it was your telephone company's problem to get you stuck in a loop of call centers to get some time while they fixed a few authenication servers that went down at the ISP. :P
- darellik
One of the good things about open source is the possibility to learn from mistakes that others made.
:)
Let's start Open Security. Document all the security mistakes you know. From programming errors to mistakes in configurations.
This way everyone can learn from a hack.
Sooner or later some kiddy wil publish it anyway and sooner or later an other admin will make the same mistake.
So maybe someone can make a fully documented security-site?
---
Privacy is terrorism.
I'm sure they will - once they are sure that the problem is fixed. Let's say they announce a vulnerability in script "foo.cgi"; the upshot of that is going to be lots of haxxors going after one, potentially buggy, target.
Of course, on the other hand, that is a lot of free debugging too...
UNIX? They're not even circumcised! Savages!
OPEN SOURCE means there's nothing to steal? Unless the modified code *gasp*, but you _do_ have backups... right?
/. backs up! ( :
Even
Yes, of course I should remove everything except the apps I actually use... you've done that, right? Every time you want to play with / explore some new app, you install it from the CD, apply patches, and then carefully remove it when you're done with it, right? I *don't* think so :)
--
"I'm not downloaded, I'm just loaded and down"
The problem is, I tend to forget to remove software; or rather, I never quite get around to deciding that I'm done evalling them. "Ooh, can't delete that just yet, I didn't ever get to grips with $feature..."
--
"I'm not downloaded, I'm just loaded and down"
PHBs aren't interested in why not to use Microsoft. That is why they're PHBs. They look for reasons not to use Linux, and that perceived myth is one of them. So if Microsoft has security problems or not isn't an issue since PHBs _want_ to stay with it and can overlook the shortcomings.
And what security flaws can you cite in Linux? Not Apache, not pine. Actual security flaws in Linux itself, please.
Kernels in and of themselves, as they have no way of communicating with the outside world, are completely secure--they don't become insecure until you at least add drivers.
And if it was posted via Google, would the system password be owned by Google?
Slashdot Hypocrisy at work?
Seems like SourceForge is making no mention of it on their front page.
As a user that hasn't used SourceForge for more than a week, this makes me a bit worrysome. I strongly hope that they used one-way, 128+ bit encryption on the passwords.
SourceForge is a very large operation. Remember that. No big operation is perfect, them included. Even RSA has been cracked (their website, rather.)
No operating system, not even our beloved Linux, is totally secure. It's only secure until the next bug is found. Remember, security is a concept.
Now, I have noticed there are some Windows zealots trolling Slashdot right now about the insecurities of the open source model, a la Microsoft. As a user of Windows 9x/NT, Linux, OpenBSD, FreeBSD, and a number of various other OSes, I can tell you right now that neither is more secure.
It only takes more time to find the holes if the software is closed-source. At least with open source, they're generally found quickly and patched quickly.
Neither closed or open source is more secure. And no OS is completely secure. Not Windows, not Linux -- not even BSD. Sorry!
Do you like German cars?
When we yell about this site or that site getting cracked while using MS products, it is typically tied with a report explicitly stating that it was, infact, a MS product that had the security hole.
But right now, we don't know anything about this attack. We don't even know if software is to blame. It could be a bad admin, it could be a buggy kernal patch, it could be someone sniffed an admin's root password while they unknowingly used a cracked copy of MS Terminal on a Windows box...
Until we know what actually happend we can spin it any which way.
My
You see, I only ordered one file, but they sent me two, so i'm selling this one on for next to nothing...
Go on, man, this stuff's golddust you know. You Can't get this just anywhere...
"God is dead." - Nietszche
If you can't see this, click here to enable sigs.
Hopefully OpenSource's luck will change soon. This is starting to get depressing.
http://www.linuxsecurity.com/advisories/redhat_adv isory-1151.html
d vi sory-1306.html
http://www.linuxsecurity.com/advisories/other_a
BTW, I would assume that Win2K kernel is much more secure than the Linux kernel. Reason being that Win2K is a semi-mirco-kernel, while Linux is a monolitic kernel.
Micro kernel means that the kernel is as small as possible, and everything is loaded via "modules" (not exactly, but close enough).
Linux, OTOH, incorporate much into the kernel.
For example, take TCP/IP. If you want to remove that from the kernel, you need to rebuild it (so with Linux, at least, you do have a way of communicating with the outside world via kernel alone). On Win2K, you don't need to rebuild the kernel in order to remove TCP/IP.
--
Two witches watched two watches.
Which witch watched which watch?
Haven't built one.
Win2K kernel has a totally different design than Linux has. You can't adequately compare it.
--
Two witches watched two watches.
Which witch watched which watch?
Someone on the local lug list reported that someone hit their userid and it send the email with link to reset their password. At the same time they reported a DOS against their mail server causing mail to backup on their secondary. This was in April.
What is pirate software? Software for inventory of stolen treasure?
They can't, it very easy to destroy and very hard to create. By destroying things, they show thelr lack of skill and inability to do useful things.
I know that I'm preaching to the choir here, but when an exploit like this happens, the developers are quick to patch the program that caused the security hole. Just look at Sendmail!
However, the original problem is that the source is open. Since the hackers can look through the code, they can find all the exploits. Sometimes I wonder if the GNU/Linux community wouldn't be better off taking a cue from professional developers and just releasing binaries. Not releasing the source code would solve many security problems.
--
Dragging people kicking and screaming into reality since 1996.
Also it is a commercial product (Windows) So I think a product that one has to pay for and touts itself as a "solution" Better be secure. And of course it sucks If something is free you shouldnt bitch about it and conversly if I pay for something and I have a loss due to that crappy product then that products manufacturer should be held responsible
This is not a Sig.
Well, the SourgeForge hack was probably a result of the amount of freedom SourceForge gives its users. I don't know of any free web host which gives its users a shell account, probably partially because it's too much of a security risk (well, that is except for me, but I only give webspace to trusted friends). With the amount of freedom SourceForge gave its users, this was bound to happen. This is not a suggestion that SourceForge reverse its policies. Instead, I believe that this is a testament to the honesty of open source developers (and the work of SourceForge) that this doesn't happen too often.
--
Big web sites have these from time to time, shake things up, keep everybody on their toes, give us all something to think about. It's too bad it happens to ones on our side, of course. Guess something besides their source was left open, huh?
spacefem.com
No, they should not provide more details until they have the situation under control and have completed their forensic audit of the intrusion.
When a system is cracked, basic OS binaries can be replaced with one that does the same function except it will now have a backdoor. And since we're talking about Linux platforms, with rapidly mutating code, it may be difficult to completely root out the compromised binaries. It can even be as simple as a subtle permission change on a device file or subdirectory.
Someone else also mentioned that the CVS trees for projects could be compromised! And remember that a clever cracker could have compromised the system months ago without attracting attention; that could mean the backups are compromised as well. Add rebuilding "n" platforms from scratch (the only way to ensure the platform is trojan free), we're talking about a week or two of work, without even factoring in the time for the forensic investigation!
A complete report of all details to the users (without completing the analysis and securing the platforms) informs the hacker to the progress in securing the systems and if a hole was left behind. Only debriefing the project owners is still not a reasonable option; the hacker could be someone that has a project in sourceforge.
I hope they got some security heavy hitters to look into this and didn't decide to handle it in-house.
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon
This is NOT flamebait.
Now, let's wait for them to post how it was done, like Apache did.
Open Source Security isn't infallable... but at least we know why when all's said and done.
yeah, i agree. i'm in australia and everytime i get on the internet in the evening's, which is peak time here, they're always doing nightly database maintanence! very annoying
Perhaps SourceForce is victim to the same worm that was trying to plug up Linux security holes by traversing source and identifying nasty undocumented source and sending remindergrams to authors to document their work?
Of course they store their passwords in plaintext, and for the same reason - how else can they mail you your password?
43rd Law of Computing:
The sourceforge admins should look through the logs and find out at what point, by who, and how their servers were compromised. Post all the information publicly including IP's and let the hacker become the hacke. Seriously, I couldn't think of a worse group of people to piss off than programmers that have created most of the internet. Plus like mose Linux users hacking skills are second nature. I've just been looking for an actual reason to use them.
I was unable to find any kernal flaws in Win2k. However, the software bundled with Win2k, including WMP, is full of security flaws. I stand corrected.
I'm the stranger...posting to
The crackers might have used an alternative such as IP spoofing to gain access.
I'm the stranger...posting to
Sourceforge really should provide more details about how security was breached. They probably are reasoning that if they give details, other people will do the same thing. However, anyone who's interested in this sort of nonsense probably already knows.
So, why not let the legitimate Sourceforge users have a bit more information about what happened? Perhaps some of the users might have an idea for a fix, or at least a way to protect their own work. Heck, we don't even know the nature of the breach, do we? Was data stolen? Corrupted? What? Inquiring minds have a legitimate need to know.
I'm the stranger...posting to
its very sad to see that great projects such as sourceforge are compromised by scriptkidiots (?), however it is very hard to maintain machines secure when we provide local access, the best they could do from now on, is removing SSH access to the user accounts, and keep the software
up-to-date.
good luck.
"After twelve years of therapy my psychiatrist said something that brought tears to my eyes. He said, 'No hablo ingl