Slashdot Mirror
FSF FTP Site Cracked, Looking for MD5 Sums
landley writes "The Free Software Foundation's FTP site at ftp.gnu.org has been "compromised", and they don't seem to have full backups. They've yanked a bunch of recent packages (and their whole alpha.gnu.org ftp site), and when I asked about it they responded 'Our FTP server was compromised, yes. We are beginning to find good MD5sums for files which have not yet been restored, and they will be available again Real Soon Now. If you can provide MD5sums for any of the files listed in MISSING-FILES, it would be very much appreciated.' " Update the FSF has
a statement
on the FTP site explaining the matter.
Sure, I've got the "correct" MD5s right here. You trust me, don't you?
Did you know that some files are just about impossible to get anywhere else?
How hard is it to script a backup of MD5 sums to removeable media? Sheesh.
Feh.
was the server running NT?
Are there no mirrors of this site?
http://threetechguys.info Come, discuss Technology. Got a technology question? Come ask!
They need lots of help... There are 689 files on the list...
Eek!
how did the crackers break into the ftp site? anyone know?
Does the name Pavlov ring a bell?
How was the site cracked? What have they done to patch it? Was it GNU software? :-D Are they writing patches for this software? MORE NEWS.
www.sitetronics.com/wordpress
GNU is the definitive location of loads of packages. Virtually everyone who uses Linux is potentially affected. It's as if Windows Update were cracked. I don't see anything on the main GNU page yet though...
I'll wait while the "wind0ze suX0rs!" 1337 Hackors try to make this sound insignificant to linux, but can blow up on MS when a virus is released.
Just a healthy reminder that nothing is 100% secure, so no point in pointing fingers (on MS OR linux).
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
I know, I clicked on the link :)
Hmm odd...one day they speak of taking sco support out of gcc, the next their ftp server gets comprised, interesting.
"Real men don't use backups, they post their stuff on a public ftp server and let the rest of the world make copies." - Linus Torvalds
01101001 01100001 01101101 01101110 01101111 01110100 01100001 01101100 01100001 01110111 01111001 01100101 01110010
Career Limiting Event?
[rimshot]
'compromised', the /. crowd would be laughing their heads off. Just goes to show that 'open source' or 'free software' isn't 100%, and the "no backups" just goes to show that poor sysadmin skills is not limited to proprietary platforms.
But do to some sort of wierd computer problem my machine keeps on restarting...
I will get around to fixing it sometime next week.
It's all good.
The site ftp.gnu.org is running Apache/1.3.26 (Unix) Debian GNU/Linux mod_python/2.7.8 Python/2.1.3 on Linux
tsk, tsk..
I've been working on a LinuxFromScratch installation, and was perplexed as to why none of the packages I needed were available. The whole alpha.gnu.org thing set me back for a while too. Thankfully I found a debian mirror with (hopefully) good packages
If thou see a fair woman pay court to her, for thus thou wilt obtain love
Taking a brief glance over my FreeBSD server, all of the entries in the Ports tree have the MD5SUMs in the "files" file. The Ports tree includes many many FSF software package installs.
Fully licensed blockchain psychiatrist
There is no warranty, we are not responsible, etc.
u ne nforceable_1.html
See:
http://www.infoworld.com/article/03/08/06/HNgpl
for problems with the GPL from the German and EU point of view.
Oh wait, this wasn't a Microsoft site that was cracked and failed to make full backups, it was the Free Software Foundation. Does this mean I can't look forward to michael writing a one liner in the story header showing that this proves that you can't rely on Free Software.
Hate it when that happends...
:D
Who wants to sell off some MD5 checksums off ebay? Let's make a few dallors!
This space is not for rent.
Surprising that there hasn't been much news of it.
the list goes on abd on and...
now, grep for 'vi' : nothing, nada, null.
Of course, what do you think? This is a conspiracy orchestrated by VI lovers, to wipe out EMACS from the face of earth!
Yea, Free Software is so much more secure than Microsoft.
Go Apple!
Move along folks, nothing to see here. alpha.gnu.org was cracked many months ago.
== I am not Me.
Can you please point me as to where it says Apache was cracked? Please? If you'd even glanced at even the summary it says "FTP server", Apache is not an FTP server.
I guess this blows the "slashdotters know what they are talking about" myth. Oh wait......
-jay
If they can't keep proper backups of things then they have the wrong people (and perhaps software) running the site.
if you understand the headline
FSF FTP Site Cracked, Looking for MD5 Sums
You just might be a geek.
There is no reasonable defense against an idiot with an agenda
:wq
and see whats been installed from where..Ho hum
Rus
Cheap UK and US VPS
Apache? What the hell are you talking about? This was an FTP breach. Absolutely nothing to do with Apache.
--Kevin
Okay, this kind of shit makes me want to start throwing bricks. Cracking the GNU FTP server? Is nothing sacred anymore? I feel like someone burned down a church.
They've done so much for humanity and some utter twit decides to compensate for his bad childhood by taking their server down.
*goes off to dock another point from his faith in humanity*
"Honey, it's not working out; I think we should make our relationship open-source."
...and sent my MD5 sum?
Was he lying?
Only as much as a priest of a false religion is lying.
Microsoft servers _do_ get hacked more than Linux servers, but this is because there are far more MS servers of an identical configuration than there are Linux servers. They also tend to crash more--especially IIS.
So, Linux does get hacked, and there have been viruses written for Linux--but there are far far more hackers and virus-writers aimed at MS Windows as opposed to Linux.
Mirror sites and rsync? one would think that the FSF has professional help for these kind of things...
Unbelievable. And I'm supposed to trust their methods and products with my enterprise?
I will donate a CDR if that helps you keep your little files...
Its hard to believe something like this actually happened, especially to the FSF... You would think... nevermind
Yes, but I'm not of anyone who claims their software is "absolutely secure" and from what has been said so far it is not apache that has been cracked (http) but their ftp server (I am unaware what ftp server they run) What makes people complain about how insecure MS systems is the fact that the insecurities occur much more often than in open source equivilants, and that ms is generally MUCH slower to patch the vulnerabilities
"The United States has no right, no desire, and no intention to impose our form of government on anyone else." - Bush 05
apache is an HTTP server, we're discussing an FTP server issue
Actually....it doesn't. They have not said if the ftp software was vulernable or it is was actually hacked. They only said the ftp server was compromised. Someone unauthorized could have gained access to the server. Who knows....
Not 100%, but 99.9%, sure.
Having just read the above, let me add: Let a thousand jokes be posted!
Dawn of the Dead
Surely there must be some mirrors that are 100% trusted? Ran by GNU staff, and the such?
Well no OS is proof against shitty passwords or real bad practices (like not running backups). As usual the most important factor is the quality of your admin, not the OS.
It IS insignificant as far as security is concerned, because it's almost certainly an inside job or a password theft. It'd be insignificant even if it were on an MS-DOS webserver. The only reason this is on /., or is significant in any way, is that GNU is the victim and evidently they haven't been doing proper backups.
we need a RTFA (and please understand the motherfucker before you post) moderation
But then, unlike you, sir, I am not an idiot.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
you claim there's no gloating when open source is hacked, but this is one of many gloats to this effect already posted.
/puts on tinfoil hat/
BUSH/ASHCROFT/CIA haxored it and put trojans in all GNU software. They are using it to track peopled down and send them to Gitmo!!!
Never, ever, EVER run an FTP server - you are committing suicide by doing so. You are asking in big bold block letters posting your IP to slashdot to get hacked. Always make your files available to the public via HTTP/SSL in a chroot filesystem that is set no-write. Uploading of new files should be via SMTP (through trusted hosts)w/ PGP or worst-case (if you're a usability freak) (OpenSSH) SSH2 + SFTP.
People use solutions other than this. I do not understand why outside of willful stupidity.
--Ryv
You do realize that Apache is a http server don't you? If you are serving FTP through your webserver I think that you have more problems than whether the software is secure.
Just yesterday there was a story runnign about FSF talking about pulling SCO support. I bet the slick SCO fellahs had nothing to do with this...
The Good Life
Who here believes Apache is absolutely secure? I see vulnerability/exploit reports fairly frequently.
Occam's razor is the blind faith in the natural selection of least resistance and in universal oversimplification. -- EF
GNUDoh!
maybe i missed something, but isnt the problem with an ftp server? and probably one that was not chrooted??
what the hell does this have to do with apache? IIS has a an ftp module...ofcourse..and it IS laughable...
so what gives? whad I miss?
is the parent just an i D 10 T?
We're like rats, in some experiment! -- George Costanza
What does apache, an http server, have to do with their ftp server being cracked?
But no, Apache isn't 100% secure. There is no such 100% server, except one unplugged from the net, encased in titanium, and buried beneath the Pacific seabed.
We would already be flooded with posts about how if this were a Microsoft server we would already be flooded with posts bashing Microsoft and talking about....oh, right, my bad.
Yes, but I'm not of anyone who claims their software is "absolutely secure"
http://cr.yp.to/qmail/guarantee.html
http://cr.yp.to/djbdns/guarantee.html
Then next time you will catch the joke...
It's all good.
Why not use ProFTPD? It has a much better security track record that wuftpd, and is actively developed. Considering all the roots that happen from default wuftpd installs, one of the first thing I recommend to linux newbies is to scrap wuftpd. And setting up a chroot environment is as easy as one directive: "DefaultRoot ~"
this comment claims that this vulnerability was exploited... it's not always an inside job or password theft
Why does the FSF not use a OpenPGP signature on the files and md5sum lists in their archives? Unless the key is kept on the same (compromised) host, then it becomes easy to figure out what files are valid, and what isn't.
a sed-4.0.7.tar.gz
BTW, here is my contribution:
> md5sum sed-4.0.7.tar.gz
005738e7f97bd77d95b6907156c8202
-molo
Using your sig line to advertise for friends is lame.
A virus in windows is easy. users can delete system files. a very very simple permissions setup in linux prevents major damage to a system by a virus unless that virus has suid which is frankly a user error. think about this: if the source to windows was open, how easy would it be to write a virus to take it down? security through obscurity doesnt work in the world of open source. so, qualitatively linux beats MS here. its not just a 'number of servers' thing. bugger off.
Ahem... I believe we should be blaming this on third party software right? Tell me if I'm wrong :)
Wow.. This is actually... um... embarrassing.
:o)
Don't have full backups?
eesh!
We geeks know better than this!
Oh well. let this be a lesson to us all
do() || do_not();
...the ftp.vim.org was counter attacked by irate Emacs fans!!!
Yes, but if the site was running IIS no one would be pointing that out - people would simply post "ha ha ha - Here is more proof IIS sucks!"
the GNU people always strike me as not too bright people who only code to further their political agenda
No server is immune to Hacking it's just a question of ease. Microsoft servers are often not well configured and often not maintained. They are also a large percentage of the host avalible on the internet so a good target. This all cuppled with a apparent pollicy that ease of use is more important than security by default from Microsoft has led to the current situation. The more secure you make a box the harder it is to work with. Linux, BSD and Unix in general are somewhere in the middle by default. You could move to secure versions that are a pain to do anything on and I do mean a pain. Just think of it as a variable rather than a booleen it's not is it secure yes no but rather how secure is it and allways remember if effort is applied by a knoledgeable expert it can become more secure to a point.
No sir I dont like it.
So even if they did have full backups of the FTP site, they still need to verify that the files are correct. Unless they have backups reaching to the beginning of the archive, they can never be 100% sure that the correct files are online.
I can't say that I don't give a fuck. I've just run out of fuck to give.
$ md5sum complete-gnu.tgzf complete-gnu.tgz
deadbeefdeadbeefdeadbeefdeadbee
- Peter Brodersen; professional nerd
I guess this blows the "slashdotters know what they are talking about" myth. Oh wait......
;-)
That myth existed? Seems fairly unlikely to me...
Doesn't OpenBSD run their site off Solaris?
Hmmm. You mention Apache. This is an FTP server. What kind of tool runs an FTP server using web server software? So far as we know (given that there are no details of how the server compromise was carried out), this says nothing about the security of a particular FTP server software, Apache, GNU/Linux, or any other Free Software package.
:)
As is the case with most installations of MS Windows, other operating systems and pretty much any user level software, the security of the system is only as strong as the weakest link: usually that's the user (and the sysadmin falls into that group). Bad passwords, bad security policies, and lax attention to security patching affect every system because every system has users.
Why might Free Software Zealots be laughing when MS products are demonstrated to be insecure? Because people have paid MS billions of dollars for that software. MS has billions of dollars in the bank. You'd think a company with those kinds of resources could hire a few security experts-- or even a few thousand-- and have them really work out the bugs. Free Software, on the other hand, is largely produced as charity, costs little or nothing to obtain, and at least when the code is demonstrably insecure, you (the user) have both the means and the right to fix it. Not so with the expensive binaries you get from Redmond.
Oh, thanks for trolling. I assume this response is exactly what you were hoping for.
I do not have a signature
not Apache. Chucklehead.
I'll wait while the "wind0ze suX0rs!" 1337 Hackors try to make this sound insignificant to linux, but can blow up on MS when a virus is released.
This is not at all insignificant. Of course more detail is really needed to asses the situation.
Here are two possible scenarios:
1. Some idiot with lots of access rights does something dumb like log in in the clear. I think this is unlikely, but if it did happen this guy (or girl) should be soundly beat about the head and shoulders.
2. The software they were running has some yet not found flaw (at least is was found by the crackers). Oh well, we need to look for it and fix it. There has probably not been a single piece of non-trivial software (not just OS) written that has not had some known or unkown security flaw waiting to be exploited.
As far as blowing up when a virus exploiting an MS vulnerability, it should be the MS users up in arms. Especially when they refuse to fix some of their systems, like NT4 (I know it is EOL'd, but this last one is a major problem).
please mod this asshole down. Dude, the GNU FTP server got hacked, not their web server. A web server (Apache) is called an HTTP server, because it uses that protocol to deliver its information to other clients (web browsers if you will). Your comments have about as much wisdom as: I am allergic to elephants and catnip so I will die if I walk barefoot in my backyard with a broom in my left hand
In another thread I post a message criticizing incompetant/lazy sysadmins and now this get noticed (after nearly a week).
Could someone pass on to them that CDR/RW drives get put on sale at CompUSA for around $20 on a fairly regular basis? If you rebate the CDrs you can practically get them for free. DO A BACKUP ONCE IN A WHILE, SOMEBODY WILL BREAK LOOSE FOR THAT MUCH IN POCKETCHANGE!
It doesn't matter what you wrap your emotions around, Reality is a brick wall specifically designed to scramble eggs
just rsync with rsync://rsync.gentoo.org/gentoo-portage/sys-devel/ gcc/files
all the MD5s for more recent versions of the gcc versions are there.
...that the cream of IT people would do regular revolving backups, securing sessions and have a standalone staging enviroment for all their stuff should the connected setup get compromised. Especially files which are distributed into the entire world to run on bazillions of computers once released. That's all a big fat hairy bad-ass no-brainer.
Sorry, gnu.org team, no icecream tonight.
We suffer more in our imagination than in reality. - Seneca
From your post history it looks like you accidentally used the wrong account to post such a troll. Or maybe you are reactivating an old troll account? I've been around here long enough to remember the hot grits and petrified Natalie Portman trolls. They were funny for a while. It was a short while though...
In Republican America phones tap you.
FTP should be for anonymous downloads only, with no user accounts able to login.
SSH/SFTP is for logging in using usernames.
The details about whether this was an exploit of insecure code (i.e. buffer overflow), or bad admin practices (i.e. cleartext logins) hasn't been made public.
If the former, I expect to see an announcement soon of a patch. God help them if they were running known flawed, unpatched, ftpd software.
If the latter, then it is time for the FSF to review their policies & procedures on user logins accessing their FTP server.
Of course, it could have just been a poor password that was guessed. That means enforcing and verifying the use of strong passwords. This really should have been done before, but is the most likely of scenarios. People get lazy and unless there is a mechanism for automatically dealing with this, then poor passwords are inevitable.
Learning HOW to think is more important than learning WHAT to think.
I have to admit, it's kinda funny. Firstly, NO one has posted what the heck FTP server they were using (which might be helpful to determine if it was a security hole.) Secondly, 'bout time this happened to one of the distributer sites. Though, a Linux bigot I may be, no OS (that I've seen) is 100% secure.
Now, MAYBE gnu will decide to write a GOOD automated backup system for no other reason than keeping their junk together. (and don't give me that tar crap. I know perfectly well what it's capable of. I want an OSS equiv to NetBackup) No backups! That's hilarious!! I wanna know what kinda beating the current admin is getting!
Well, hopefully they'll be able to get it pieced back together now. I'm sure it won't take more than a day to do so. Heck, I'll email my LUG and let the Deb folks spin MD5sums for a while to send over to 'em.
Enjoy the chaos! (Least only 1 person has managed to link this to SCO so far)
-What have you contributed lately?
No one's ever claimed Linux is 100% secure.
However, the next time a virus is released that takes down 90% of Linux installs, and toasts most of the internet, let me know. Until then, your point isn't exactly valid.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Just a healthy reminder that nothing is 100% secure, so no point in pointing fingers (on MS OR linux).
You are right, there is no 100% security. But at the same time, Linux is the number server on the net (according to netcraft) yet gets cracked but a fraction of the time. MS is number 2 server, but almost 100% of the CC thefts are from MS. The cost is very high for running MS.
Comparing Linux to MS is a bit like comparing a pick pocket to Gacy or Dahmer. While both are criminal, you know which is worse.
I prefer the "u" in honour as it seems to be missing these days.
Gentoo has md5sums recorded in it's digests.
maybe im missing something here...but don't most people backup their stuff?
i mean, all the posts here are about how insecure FSF is, or OPensource sucks...or windows sucks more...
what about the bloody principle of backing up your own software? let me guess, stallman and his crew has ONE FTP server, and they never back the bloody thing up? they should all be punished for such foolishness. nobody in a corporation would allow this...what would have happened if the harddrive crashed, or the raid crashed hard on that FTP ser4ver? the same thing!!!
asking the world for MD5 sums...
tsk tsk.
oh, and I use OPen Source just about everywhere, except my workstation (manditory windows). I run a chrooted Wu-FTPD, never had too much trouble either...but, we have a tape backup, just incase...
We're like rats, in some experiment! -- George Costanza
Bzzt, Wrong. There are more Apache servers (by far) than IIS servers, and IIS gets more attacks - by over a four to one margin.
It gets more attacks because it is less secure, NOT because of volume.
GPL'd web-based tradewars themed space game
I like the idea of linux, and MS pisses me off, but am too ignorant to be a true geek...
but it seems to me that there's no meaningful comparison between an individual linux system being specifically attacked (maybe not even remotely) and brought down... and... every single XP computer with internet connection being susceptible by default to MSBlast... ?
Anyone have an address where we are supposed to send MD5sums?
Also, does this effect GCC sources?!?! See Ken Thompson's Reflections on Trusting Trust.
-molo
Using your sig line to advertise for friends is lame.
not according to netcraft
Well that blows the "There's a "slashdotters know what they are talking about" myth" myth...
++ Say to Elrond "Hello.".
Elrond says "No.". Elrond gives you some lunch.
MSBlaster hacked millions of computers WITHOUT human intervention.
Linux IS SECURE. If people can't set it up, don't blame the OS.
MS needs to get patched >>=====> CONSTANTLY.
All we have in this story is the list of packages whose authenticity they haven't been able to confirm yet (I'd guess that they'll get the MD5SUMs from whoever is trusted to upload them in the first place).
Someone commented that the attack was through a known wu-ftp (not GNU software) exploit. I've often wondered why people run ftp servers instead of http ones to distribute stuff; http supports the same operations in a simpler way, and apache is much more cleanly written than wu-ftp.
See, they should have been running OpenBSD. Even with the wu-ftpd exploit, the W^X protection in current would have prevented it from happening!
woops, posted wrong *BSD, but openBSD uses openBSD or netBSD, according to netcraft
Oh, gosh. Look at this. A site running Linux was hacked. Gee, that must mean that Linux is fundamentally insecure and that OSS is just no good. After all, everyone knows that FTP access is provided directly by the kernel. Let's everyone use Windows.
Oh, come on, trolls. Give it a rest.
and where are all the M$ bashing fanbois when linux gets hacked. Sure is quiet on this thread. I guess they are all too busy thinking up clever replies to the MS blaster worm article. I like linux dont get me wrong but if this was a MS exploit this thread would be 3 pages already due to fanbois posting MS sucks a thousand times as if I forgot that linux was the end all be all to all life's problems. Funny how things work here....
As an advocate of open source in a business that doesn't "smile" at the thought of open source software, I have to say that this is an illustration that my supervisors may be right.
Making good backups is >basic control. If FSF doesn't have even that level of competency, how can I argue that software advocated by that group is good enough for our enterprise.
Who the !#@$@ doesn't make backup anyway...
Hate to say it: Idiots.
for them not to have made backups of the MD5SUMS at least? Especially considering how tiny that would be, especially in a tarball?
No you're not. You're not supposed to trust the FSF, you're supposed to trust commercial distributors like RedHat.
The FSF is the Free Software Foundation. They don't exist to help your business, they exist to provide... well... Free Software.
Whatever happens to FSF's own servers is completely irrelevant. Your distributor is the only thing that matters.
What I have heard in irc the cracker had user level access to system and used linux ptrace bug to gain root. It is sad that this happened. Cracker probably used at least some of GNU tools to do his work.
...if this was a site hosted on IIS, then we would already be flooded with posts laughing at how insecure M$ systems are and gloating how this doesn't happen with open source systems.
Actually, this happens on a daily basis to literally 1000 of MS systems. The real problem is the accumulating costs of this stuff. Horrible.
Almost everything related to The HURD is gone (the ISOs were off the root of the server). Not sure how I feel about that.
I want all of the power and none of the responsibility.
much, MUCH worse:
It was running wu-ftpd.
wu-ftpd. just. say. no.
Friends don't let friends use wu-ftpd. Or ProFTPD. Not even the OpenBSD ftpd. Instead, they make them use publicfile.
Does my bum look big in this?
So, what are you getting me for myth myth?
Need a Python, C++, Unix, Linux develop
Okay, then it is likely a vulnerability, in which case I hope it is fixed soon; consider my words eaten. Vulnerabilities are ALWAYS worth noting, because though you can never find them all, the ones that are found can be sealed.
Depends on how you define secure. If a major windows site gets broken into like this, you don't hear about it. You only hear about Windows problems when a.) Microsoft decides to release a "security fix", or b.) when large corporations and state governments are brought to their knees.
The real story is (and this groks with your point, by the way), how do you trust someone trying to proselytize you with an alien philosophy of computer use when they still run wu-ftpd and don't do backups?
who are those slashdot people? they swept over like Mongol-Tartars.
pretty cool.My calendar is reporting that today is August 13, 2003. or maybe that was your point and I'm an idiot.
Penguins are so sensitive to my needs - Lyle Lovett
Perhaps my favorite link to checkout new releases from the FSF hasn't been working the past week or so.
"Provided by the management for your protection."
I downloaded gcc 3.3.1 yesterday or the day before, then installed it. :( They'd better get me those md5s fast!
Can't you just get a fairly recent GNU archives cdroms from cheapbytes or somewhere, then get the source and MD5 sums from the maintainers of each package that has changed since that last archive snapshot was taken?
You mention poor sysadmin as being the cause of proprietary platforms problems, yet you mention that the systems were "compromised" because 'open source' or 'free software' isn't 100%
Don't you think poor admin skills could be the reason for the "intrusion" aswell (we have a good case here), or is it only where you say it is?
You shouldn't use that analogy. It compiles to "you get what you pay for - and you're no better off if you don't pay for it anyway".
Oh, and comparing free software to "charity" is also a bad idea.
This just shows that anything can be broken whether Windows or other OS.
I'm surprised that they're backup scheme was this shoddy. Possibly something where they didn't save back far enough to be sure, or something fairly recent that can't be verified as non-hacked in their backups.
Of course, I'd be wary of any MD5dsums sent in unless sent in from various verified sources. Of course they might not be trusting their own MD5sums and want to verify from the outside as well?
Certainly a black eye for the FSF, but I'm sure they'll learn a lesson from this in any case.
6. Recognize it for what it is - stupid admins.
Don't label something "offtopic" unless you know the topic well enough to tell what's on topic.
OpenBSD isn't a security panacea, but on the x86 it's the next best thing.
Really, though - a tool is only as good as its user, and running an FTP server is always suicide.
--Ryv
Then we would be up shits creek without a paddle.
Liberty.
Also nicely demonstrates the pointlessness (and stupidity) of serving out your MD5sums from the same machine.
Actually that's:
In Democratic America, GNU Mirrors you.
Are you sure you mean servers rather than web sites?
Most of the www.my-crappy-little-domain.com type sites are hosted on Apache, but they're hosted by the hundreds on the same (usually sun) box.
It gets more attacks because it is less secure, NOT because of volume.
It also gets more attacks because the sites hosted on IIS tend to be owned by higher-profile outfits (e.g. MS) - nobody cares about hacking someone's personal home page.
Turn that pee-cee thing off and go to bed RIGHT NOW!
/pull covers over head and laptop/
Yes mom....
(1) you should make a backup every day.
Dear SCO,
You hacked our FTP site. We're suing you for the damages, and demanding that you return our original files and the MD5 Sums. Unfortunately due to this being our IP and trade secrets, we can't tell you which files and MD5 Sums we want. So instead, we're going to start charging your stockholders a license fee to use your stock.
Love,
Free Software Loving People Everywhere
Though don't bother if it only toasts about 50% of Windows installs and bring down only a significant portion of the internet. That's becoming too common place.
MS is number 2 server, but almost 100% of the CC thefts are from MS
Care to back that up with a link, source, or other credible method?
you realized you just proved his point, right?
I doubt its wu-ftpd. From http://vsftpd.beasts.org/ it appears that ftp.gnu.org uses vsftpd. They may also use wu-ftpd but that is very bad choice on their part since wu-ftpd has a very bad record of security.
I wonder what the linux crowd will do if it ever gets over a 1% market share and hackers start to REALLY target it. What are all these fat cheap bastards sitting in their mom's basement on a 486 gonna do then? As it stands now a hacker really has nothing to gain by learning to hack linux. Windows on the other hand has 90% of the market and some very non technically savy individuals using it. Hmm, what OS would I pick to hack? Seems obvious... but just watch and see if linux ever becomes even 1/5 as popular as MS then you can bet your ass exploits will be popping up left and right. Especially if the new linux crowd is even half as retarded as the MS users nowdays. No OS is 100%...at least people using MS are willing to admit it unlike the linux crowd.
mmmm....honkey crackers and cheese....*ghgllhglhglhg*
...and that's the way the cookie crumbles.
I'd like to thank every single reply to my parent comment!
You truely help make the only true point I was trying to make. It doesn't matter if this was a hole built into the kernel that was the size of Texas, the fact that it happened on Linux will be downplayed and if the slightest thing happens on windows you blow up on it. The poll running right now (worst zealot) is pretty pertinant to this conversation, isn't it?
Good quote, too many chars. Seriously, the slashdot 120 char limit sucks!
Should we ever trust these stupid people?
Because we all know that a worm by definition spreads only when it takes over an OS that acutally DOES own 90% of all OSes out there.
So you're going to be waiting a long time my friend and it's not because linux is more secure =)
this is quite worrying, i undertand it was the ssh v1 crack (probably some script kiddy inspired by the matrix reloaded) and i was told that savannah (which currently used ssh v1 for cvs commits) will be upgraded to ssh v2 in the near future.
damn, i was gonna commit this story :-), but didnt have any more news besides the emails i got.
NO TEXT.
How about next time that happens to windows, in those numbers, you let me know. In the meantime, why don't you be a little more realistic and a little less biased in your numbers?
-----BEGIN PGP SIGNED MESSAGE-----
.tar.gz, .tar.bz2, diff's, etc.) on ftp.gnu.org with a known good data. The file, .asc, contains a list of files
... REASON]
Hash: SHA1
To the Free Software Community:
Summary
* gnuftp, the FTP server for the GNU project was root compromised.
* After substantial investigation, we don't believe that any GNU
source has been compromised.
* To be extra-careful, we are verifying known, trusted secure
checksums of all files before putting them back on the FTP site.
Events Concerning Cracking of Gnuftp
A root compromise and a Trojan horse were discovered on gnuftp.gnu.org,
the FTP server of the GNU project. The machine appears to have been
cracked in March 2003, but we only very recently discovered the crack.
The modus operandi of the cracker shows that (s)he was interested
primarily in using gnuftp to collect passwords and as a launching point to
attack other machines. It appears that the machine was cracked using a
ptrace exploit immediately after the exploit was posted on bugtraq.
(For the ptrace bug, an root-shell exploit available on 17 March 2003, and
a working fix was not available on linux-kernel until the following week.
Evidence found on the machine indicates that were cracked during that
week.)
Given the nature of the compromise and the length of time the machine was
compromised, we have spent the last few weeks verifying the integrity of
the GNU source code stored on gnuftp. Most of this work is done, and the
remaining work is primarily for files that were uploaded since early 2003,
as our backups from that period could also theoretically be compromised.
Historical Integrity Checks
We have compared the md5sum of each source code file (such as
ftp://ftp.gnu.org/before-2003-08-01.md5sums
in the format:
MD5SUM FILE [REASON,
The REASONs are a list of reasons why we believe that md5sum is good for
that file. The file as a whole is GPG-signed.
Remaining Files
The files that have not been checked are listed in the root directory as
"MISSING-FILES". We are in the process of asking GNU maintainers for
trusted secure checksums of those files before we put them in place.
We have lots of evidence now to believe that no source has been
compromised -- including the MO of the cracker, the fact that every file
we've checked so far isn't compromised, and that searches for standard
source trojans turned up nothing.
However, we don't want to put files up until we've had a known good source
confirm that the checksums are correct.
Alpha FTP Site
The Alpha FTP site at ftp://alpha.gnu.org/ has been a lower priority for
us, but we plan to follow the same procedure there.
- --
Bradley M. Kuhn, Executive Director
Free Software Foundation | Phone: +1-617-542-5942
59 Temple Place, Suite 330 | Fax: +1-617-542-2652
Boston, MA 02111-1307 USA | Web: http://www.gnu.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE/OnYb53XjJNtBs4cRAqplAJ95PHJhIwRiwjKBqSIx ZH SVlTOtxACgyouK
QAfYhiLJcwPHio6fsk+s2uY=
=DUMO
- ----END PGP SIGNATURE-----
> Bzzt, Wrong.
FYI, this makes you sound like an ass.
>There are more Apache servers (by far) than IIS servers
Assume you are referring to Netcraft, which counts SITES, not SERVERS.
Fact is there are far more IIS SERVERS running on intranets and personal machines, not under the control of a professional administrator. That makes it a much more juicy target for an automated attack like a worm.
You know, those who question the bias and fanatical pro-FSF, anti-MS lunacy on Slashb^Hdot.
Wouldn't it be nice if texinfo went missing and nobody noticed?
takes down 90% of Linux installs and toasts most of the internet
Maybe when Linux comes anywhere astronomically close to the share that Windows computers have they might (a) do some serious damage and (b) be worth crackers' time to use.
My pet OS has never had an exploit and has never caused any massive Internet interruptions. That doesn't make it more secure than Windows.
check www.openbsd.org. It's Solaris.
Just how long has the server been cracked? Backup media and its proper storage can be expensive, and it's perfectly likely that they don't have backups that are older than the crack. Even if they did, they can't necessarily be sure that they know for a fact when the the crack happened.
Note that they are asking for valid MD5 sums. You do know what MD5s are used for, right? They're used to verify that you haven't downloaded a compromised copy of the application. So, it's very likely that they have archives of the applications. The problem is that they don't know if their applications are compromised, and they can't use their backed-up MD5s because they could be compromised too! That's why their requesting valid MD5s -- so that they can verify that their archives are good. They also can't just recompile everything because they don't know if the source code has been compromised too, and reading it all or even doing diffs against other official archives is unfeasable due to the man-hours it would involve.
They also can't just grab files and MD5s from their mirrors because their mirrors could have compromised files too. Without MD5s for quick verification, they're screwed.
If it's for-profit but free, you're not the customer -- you're the product (e.g., the Slashdot Beta's "audience").
I don't even take a dump unless I am certain I have backups.
/dev/nst0 /
Odd, I take a dump when I run backups...
% dump -0anf
Why do we still use ftp?
Could someone more 1337 than me explain how could they crack it using the ptrace exploit? Isn't it local only? Does this mean that someone who had an account on the ftp.gnu.org did it? Are they not disclosing the exact method of attack? Why? Of all people FSF should be happy to tell exactly what happened, no?
I passed the Turing test.
[root@localhost src]# cat md5sum
Dickie Stallman why do you make this possible? Start making money and fix your software!!
Last time I checked, it was wu_ftpd that had the vulnerability, not Linux. It doesn't matter if you were running it on Cygwin, *BSD, HURD, or Linux. Geesh. Stop calling everything OS Linux, because it isn't.
You need to restart your computer. Hold down the Power button for several seconds or press the Restart button.
If they new what they were doing they would have been using Pure-FTPd.
From http://ftp.gnu.org/MISSING-FILES.README
.tar.gz, .tar.bz2, diff's, etc.) on ftp.gnu.org with a known good data. The file, .asc, contains a list of files
... REASON]
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
To the Free Software Community:
Summary
* gnuftp, the FTP server for the GNU project was root compromised.
* After substantial investigation, we don't believe that any GNU
source has been compromised.
* To be extra-careful, we are verifying known, trusted secure
checksums of all files before putting them back on the FTP site.
Events Concerning Cracking of Gnuftp
A root compromise and a Trojan horse were discovered on gnuftp.gnu.org,
the FTP server of the GNU project. The machine appears to have been
cracked in March 2003, but we only very recently discovered the crack.
The modus operandi of the cracker shows that (s)he was interested
primarily in using gnuftp to collect passwords and as a launching point to
attack other machines. It appears that the machine was cracked using a
ptrace exploit immediately after the exploit was posted on bugtraq.
(For the ptrace bug, an root-shell exploit available on 17 March 2003, and
a working fix was not available on linux-kernel until the following week.
Evidence found on the machine indicates that were cracked during that
week.)
Given the nature of the compromise and the length of time the machine was
compromised, we have spent the last few weeks verifying the integrity of
the GNU source code stored on gnuftp. Most of this work is done, and the
remaining work is primarily for files that were uploaded since early 2003,
as our backups from that period could also theoretically be compromised.
Historical Integrity Checks
We have compared the md5sum of each source code file (such as
ftp://ftp.gnu.org/before-2003-08-01.md5sums
in the format:
MD5SUM FILE [REASON,
The REASONs are a list of reasons why we believe that md5sum is good for
that file. The file as a whole is GPG-signed.
Remaining Files
The files that have not been checked are listed in the root directory as
"MISSING-FILES". We are in the process of asking GNU maintainers for
trusted secure checksums of those files before we put them in place.
We have lots of evidence now to believe that no source has been
compromised -- including the MO of the cracker, the fact that every file
we've checked so far isn't compromised, and that searches for standard
source trojans turned up nothing.
However, we don't want to put files up until we've had a known good source
confirm that the checksums are correct.
Alpha FTP Site
The Alpha FTP site at ftp://alpha.gnu.org/ has been a lower priority for
us, but we plan to follow the same procedure there.
- --
Bradley M. Kuhn, Executive Director
Free Software Foundation | Phone: +1-617-542-5942
59 Temple Place, Suite 330 | Fax: +1-617-542-2652
Boston, MA 02111-1307 USA | Web: http://www.gnu.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE/OnbO53XjJNtBs4cRAkZaAJ0ZdQ98ZNe4GRgAT2bR 4h BHRqo/aQCglWnU
kmOLmrVCzPxrJ/S68R1q42w=
=+pu6
- ----END PGP SIGNATURE-----
From the MISSING-FILES.README on ftp.gnu.org:
Events Concerning Cracking of Gnuftp
A root compromise and a Trojan horse were discovered on gnuftp.gnu.org,
the FTP server of the GNU project. The machine appears to have been
cracked in March 2003, but we only very recently discovered the crack.
The modus operandi of the cracker shows that (s)he was interested
primarily in using gnuftp to collect passwords and as a launching point to
attack other machines. It appears that the machine was cracked using a
ptrace exploit immediately after the exploit was posted on bugtraq.
(For the ptrace bug, an root-shell exploit available on 17 March 2003, and
a working fix was not available on linux-kernel until the following week.
Evidence found on the machine indicates that were cracked during that
week.)
Given the nature of the compromise and the length of time the machine was
compromised, we have spent the last few weeks verifying the integrity of
the GNU source code stored on gnuftp. Most of this work is done, and the
remaining work is primarily for files that were uploaded since early 2003,
as our backups from that period could also theoretically be compromised.
d00dz
I have plenty of common sense, I just choose to ignore it. -- Calvin
It compiles to "you get what you pay for - and you're no better off if you don't pay for it anyway".
...comparing free software to "charity" is also a bad idea.
No, what it compiles to is "Wow. Those people spent lots of money and it didn't do so well. Apparently you don't always get what you pay for. "
How is it a "bad idea"? The FSF is a charity. Much free software is developed for no pay and given away freely. You make it sound like charity is a bad thing. It's not.
I do not have a signature
WTF? No BACKUPS? What kind of a stupid idiot doesn't make backups. Somebody needs to get fired, or at least kicked out of the room. Missing a recent patch, understandable. No recent backups, unforgivable.
Reminds me, I need to go do backups!
Why is the FSF, a forerunner of innovation, using an weak and insecure hash algorithm like MD5? Why not SHA1, which is considered to be strong?
-73, de n1ywb
www.n1ywb.com
[snip]
(For the ptrace bug, an root-shell exploit available on 17 March 2003, and a working fix was not available on linux-kernel until the following week. Evidence found on the machine indicates that were cracked during that week.)
Given the nature of the compromise and the length of time the machine was compromised, we have spent the last few weeks verifying the integrity of the GNU source code stored on gnuftp. Most of this work is done, and the remaining work is primarily for files that were uploaded since early 2003, as our backups from that period could also theoretically be compromised.
(emphasis added). So in other words, they were cracked in the brief space between the exploit post and the patch, and didn't find it right away. Now, they are carefully vetting all their backups from that period to remove any possibility that a compromised backup could be redistributed.
So, to answer your poorly-researched questions:
Which part of this would you not consider a disaster recovery plan?
However, the next time a virus is released that takes down 90% of Linux installs
I'll be happy to, just as soon as Linux is worth writing a virus for...
-B
Why yes, I _am_ wearing flame retartdent underwear. Why do you ask?
Bzzt, Wrong. There are more Apache servers (by far) than IIS servers, and IIS gets more attacks - by over a four to one margin.
I said "of identical configuration."
How many Apachae instances are running exactly the same combination of modules?
ftp as a protocol is far simpler to implement than ssh2 for example, so if you have no authentication to do, use ftp.
/much/ better. its very simple and designed from scratch to be secure above all else. afaik it has never had a security bug found, and I would say is as close to secure as it is possible to be.
Using ssl is good if you have eg. passwords to hide, but other than that it just introduces complexity. more complexity tends to mean more possibility for bugs, which means more possible exploits.
However, don't use bloated, over-complicated stuff like wuftpd etc. something like vsftpd is
-- MartinG To mail me: echo kewyjlcxyzvjfxbqwh | tr bcefhjklqvwxyz
The Free Software Foundation is not about IT. It's about development. They are different things.
That is, they know all about how to write software, and not much about operating a public Internet site.
(such as for disgruntled BSD h4x0rs and so on)
If that is the case then I don't understand why the call for copies of the files. Should they not just pull them from their backup?
No. The real $64,000 question is why didn't they have reliable backups and a disaster recovery plan
So wait, now you're telling me that asking the community for backups of my files isn't a disaster recovery plan? Great...now I have to go make one up...
# grep ircflood *.c
gcc.c:#include "ircflood.h"
I can't believe it.
For the love of God, stop moderating all the stupid questions/comments about lack of backups, or incompetant server admins, interesting/insightful. Until you've RFTA'd, you can't possibly know what an insightful question is.
I'll sick my cat on them....
Don't become a regular here, you will become retarded. -- Yoda the Retard
They do have more than one sysadmin, but none of them are full-time, I believe.
There are also some "interesting" schools of thought regarding security over in gnu.org land, and I'm sure there's tension between them as well. For example, savannah has to have some level of security, but their shell machine (not savannha) has almost zero "sysadmin-added" security: important configuration files are world-writable[*], because RMS doesn't believe in restricting individual actions of users on that machine. The only security is what's provided by the default installation, minus the world-writabilities.
So it should come as no suprise that the shell machine has been compromised multiple times. All from local users exploiting holes. The most recent was done in April, but they didn't find out about it until a few weeks ago. They're still recreating accounts.
I don't know about the ftp machine; I assume it's neither the same system as savannah nor the shell box. But it wouldn't surprise me to find the same situation: some important people gnu.org don't believe in locking down machines, some important people do, but (gripping hand) it almost doesn't matter because none of them have the time to do so.
(If you wonder why the GCC manuals, web pages, etc, on {savannha,www,ftp}.gnu.org are occasionally out of date, it's because gcc.gnu.org (the master) is not admin'd by the same group. Events like this are why it's not admin'd by the same group.)
[*] Backups are done by having little Emacs hooks in comments in the files. When you edit the file -- and of COURSE you're using GNU/FSF Emacs, not XEmacs or any other editor in the world, cuz it's a gnu.org machine -- Emacs knows to make backup copies. I have no idea whether real backups are done, or how.
You cannot apply a technological solution to a sociological problem. (Edwards' Law)
And why are there no mirrors of ftp.gnu.org?
Did no one head Linus' advice?
In this interview on KDE's site, RMS admits that he was forced to use passwords on his systems after a few bad experiences.
We have to appreciate the man for his ideals; it's really sad that they have no place in this world. If there's one person whom I can give God status, it's RMS. He's a pain in the ass, alright, but that's characteristic of all Gods (look up Greek mythology, Hindu mythology, etc.).This is another illustration of why Configuration Management should be beaten into the head of anyone taking Computer Science or Engineering. Many of the security problems I have to fix at customer sites are caused by systems having different versions, no one knowing what version is correct, not keeping backups, etc. This is not rocket science, folks. Buy a damn DVD-RW drive and back stuff up. Keep the checksums. Know what is the latest version.
End of sermon.
and proud of it... this has nothing to do with your post, it has to do with your sig. I can't stand misquotes, especially not from The Simpsons. You cannot simply say that the quote was from "The Simpsons", there have been 14 seasons of episodes to choose from. The quote in question was delievered by Superintendant Chalmers in Season 5, episode 19 "Sweet Seymour Skinner's Baadasssss Song" upon hearing Ned Flanders (the interim principle of Springfield elementary) thanking God for another glorious day.
Now that I have proven that my geek is bigger than yours, please for the love of the gods mod me down so no one else will ever be able to read this.
The chains are broken
Loki is free
Ragnarok is at hand...
I have an account on gnu.org and below is a summary of the details from an email sent out on Sat Aug 2, to all account holders by Bradley Kuhn:
The crack occured on March 2003 but was only recently discovered. It was an inside job (local user) using a ptrace exploit. The cracker was using their account to gain access to other systems.
The machine was re-installed over the weekend and all account holders had to re-instate their accounts starting the following Monday.
In addition to not doing backups, the FSF also doesn't have any real way of determining whether the files they offer are correct or not. Wow. I'd have expected something a litle more professional than that.
If they a.) backed up their server now and then, and b.) ran Tripwire regularly, they wouldn't be in this situation. There *is* a GPL'd version of Tripwire, after all, it's on SourceForge, it's not hard to find.
Maybe they can take the $10 I give them every month and figure out how to do a backup of their server...
being overworked, underpaid, or anything else is not an excuse for having an unpatched machine
RFTA before critisizing their admin(s):
Is the lack of a patch an excuse not to be patched?
Probably was Microsoft, we all know how 'closed-minded' they can be...
;)
sorry, bad joke
Marge, get me your address book, 4 beers, and my conversation hat.
Slashdotters!!! Act now!!! Send your MD5sums along with $9.95 shipping and handling to the following address and receive your free "Bill Gates is a Weeney" mug!!! But that's not all, if you act within the next five minutes, you'll also get a free "I HATE SCO" T-Shirt
FSF MD5Sum Recovery Center
C/O RMS
One True Way
Cambridge, MA 12345
Sure, this incident demonstrates that the person(s) in charge of the maintenance of ftp.gnu.org is/are incomptent
Given that there wasn't yet a patch available when they were cracked, they in fact did discover the crack, and they in fact do have complete backups, on what basis do you conclude that the admin(s) "is/are incompetent"?
Check it out
It explains that the system was compromised back in March by a vulnerability that had not yet been patched at the time. The cracker left a behind a trojan to keep getting in, even after the software was patched. Unfortunately, the FSF people didn't realize it had been compromised until recently, so all the backups for the past few months can't be trusted, hence the verification.
RFTA before critisizing their admin(s):
Please note the "article" is an UPDATE to the initial post, meaning some posts to this thread couldn't read the "article" before posting.
Whereof we cannot speak, thereof we must be silent. --Ludwig Wittgenstein
about it. Private companies get hacked, held ransom all the time but you never hear about it because they are afraid (rightfully so) it will scare their customers. At least the FSF had the courage to admit it.
"Thanks to the remote control I have the attention span of a gerbil."
----------
Together, we will drive the rats from the tundra.
So in the grandparent post you were talking out of your ass. How can we be sure of anything you're saying now??
Are you fucking MAD, man?
Please do not go near the software advertised in the parent post.
--
almost 100% of the CC thefts are from MS.
Who would trust a Linux server to store credit card numbers on? Certainly very few people, hence there just aren't CC numbers to steal off Linux servers.
or GNU/compromised. GNUws at 11.
The only XP computers 'suspectable to MSBlast' are those that are unpatched, which is significantly fewer than 'every single machine'. Just the same as the only Linux servers (known) to be susceptible are those without current patches applied. And there are plenty of Linux boxes out there that aren't kept up to date. Nobody told the people who put them online that the 'free' operating system was going to require 10 hours a week of reading Usenet security groups and update websites and applying patches.
A Good Intro to NetBS
So maybe RTFA isn't the right acronym: how about "WUYHAIBSOATTM" (Wait Until You Have Actual Information Before Shooting Off At The Mouth).
Posting that things like this are hypocritical, and/or that the admin is an idiot, is stupid regardless of whether or not the statement was available yet. I don't see how leaping to unjustified conclusions is defendable regardless of whether it's due to inavailability of actual facts, or just laziness.
Ignorance is ignorance, and wild, ignorant speculation doesn't help any issue.
Sorry for shouting but there are so many messages here chastizing FSF for not backing up. They were backing up but they were compromised in March '03 and they can't trust backups that were made since the intrusion.
We don't see the world as it is, we see it as we are.
-- Anais Nin
Since when is OpenBSD FreeBSD?
Correct link: Netcraft (but it says they use Solaris on their site?)
Seems like each section of the computing populace is getting slapped around.
But there are some exceptions. Maybe the next target will be Apple users working on a Banyan VINES network or maybe some VAX junkies working on ARCnet!
Serisouly though. Most of the lessons I've learned tell me that it's not all to be blamed on programmers, nor is it all to be blamed on sysadmins and endusers. But God knows I subscribe to every security mailing list possible provided by me hardware/software vendors.
The next time a virus takes down 90% of Windows installs and toasts most of the internet, let ME know...
that might be kind of hard with all those Windows boxes hiding behind linux firewalls?
I'm not trying to judge the FSF sys admin at all. I _am_ making a statement about the Slashdot community however -- regardless of whether someone has complete information, if it's a Windows problem, there are NO excuses...but since this is a linux-related problem (obviously not directly related to the kernel) no one wants to rush to judgement.
;-))
My only conclusion is that there are some hypocrites that post here (and I'm not refering to you
Whereof we cannot speak, thereof we must be silent. --Ludwig Wittgenstein
The whole idea of a mirror is that it actually mirrors what is on another site. If they've been rooted since March 2003, then it is somewhat unlikely that the www.mirror.ac.uk is actually going to have files any different than FSF.
Unless of course, the mirror hasn't been updated since sometime in mid-March.
Yes, but if you read your E S Raymond and drink heavily of his magickal kool-aide, you would recognize that the Open Source movement is inherently more secure.
It's very easy to point out other people's "mistakes" like this, but I wonder how many people actually take all these various precautions that they're so quick to accuse others of not implementing?
The fools! They forgot to install a firewall!
The fools! They didn't purge all the old user accounts!
The fools! They didn't install the latest security patch! On all the boxes in the office!
The fools! They didn't require 10 character passwords, to be changed every 15 days!
The fools! They didn't update their virus definition files! Within the last 24 hours!
The fools! They didn't make triple-redundant off site backups!
The fools! They didn't have a plan C!
The fools! They don't know where their towel is!
Now granted, if you're being paid the big bucks to think about nothing but information security all day then all of these things should probably cross your mind... but I would be willing to bet that most people who are so quick and proud to show off their shiny, impenetrable suit of dragon scales have a soft vulnerable spot on their bellies.
Neither the OP _nor_ the moderator think it important to note in front-page post that the box was compromised in _March_ 2003? Jeez, is this /. or -.?
Must-not-watch TV!
did you miss the "by default" part?
AFAIK, linux generally doesn't leave unsecure ports open by default. what happens if someone reinstalls XP at some point in the future - could MSBlast come back when all the fuss has died down?
I don't read a single second of usenet security groups, let alone 10 hours a week. SuSE YOU takes care of all that for me automatically.
I let YOU do updates automatically because I trust it, whereas I turn off Windows automatic updating because I don't. since when is Media Player 9 and IE6 a "critical" update? plus windows updates often require a restart, and many need to be applied one at a time.
once I did install IE6 to see what it was like and immediately there were another ~10 critical security updates that I required, so that was hardly a step forward for security imo.
They did patch. However, shouldn't admins check their systems for exploits after applying the patch? I mean, are you supposed to apply a patch and just assume you were not compromised?
If you were me, you'd be good lookin'. - six string samurai
My only conclusion is that there are some hypocrites that post here
No argument there... but comparing a root due to a just-published exploit to comments about Windows compromises--most of which (at least what's posted here) tend to be about old vulnerabilities that people didn't bother to patch, is (IMO) not the best way to make that point.
But I'm all for fewer hypocrites and less ignorance on Slashdot :)
This is the STUPIDEST THING I have heard all day. For a major entity such as the FSF to not have backups is pure stupidity. These people, who at least try to sound like intellectuals, should know better.
So, not only are they not doing backups, they're running ftp daemons as root?
DUH DUH DUH DUH DUH... FOOTBALL!
If you think him an idiot, then why do you address him as sir? To show respect to an idiot is to be one.
Slackware 3.6, and any version of Slackware before version 4.0 came out, didn't assign a root password, or prompt the installer to assign a root password.
I happened upon a friend's system one night (after determining her IP address by reading a recent mail header) and on a lark telnetted in and typed 'root' as a user name. Bip! I had root access to her Slackware box. She'd been online through a PPP connection for several weeks with her box in that state.
I am sure this is not the only anecdotal evidence of security problems with Linux distributions. There are so many versions of Linux out there now, that I'm sure there are stories to tell with any of them.
A Good Intro to NetBS
Thje bastards deleted all the HURD code!
US-UK-Israel: The real Axis of Evil
Maybe they should be using some open source backup software like DIBS or Bacula.
Half of the posts I am reading now pertain to not backing up or not patching. No one RTFA or follows the linked FSF statement.
Are you listening to yourself? The only XP computers suspectible to MSBlast? It seems those are a very large number of computers. One would think this would clue Windows apologists in that something is wrong in Windows security as well as the methods of updating. And 10h a week to read usenet? Most linux boxen will be brought up to date with a couple of shell commands. It's quite embarrasing that a FSF server is exploited, but in this case I'd say that whoever administered it has fucked up quite majorly.
The stars that shine and the stars that shrink
in the face of stagnation the water runs before your eyes
I found cvs-1.11.5.tar.gz that I had downloaded March 10th, looked for the email or ftp upload directory or /somewhere/ to send it. It's not listeded anyway. I email gnu@gnu.org with it but it seems that there would be a better place. Anyone?
Yes, but those are IDE CDR drives, and everybody knows that (for god knows what reason) the maintainer of cdrecord only directly supports SCSI CDR drives. Is it still necessary to use the 'SCSI emulation kludge' in a recompiled kernal to get your IDE CDR to work in Linux? It's been a few years since I tried.
A Good Intro to NetBS
The question isn't whether BSD is dying but whether people keep going back and realizing/appreciating all the elegance and cleverness in BSD's evolution. Sure, its dying, but it's constantly reincarnating too, isn't it!
Post a reply if you would like me to send you an RPM for a Red Hat compatible PORTS tree...
No really: I have lots of old FreeBSD CDROMs with a veritable history of (the best) GNU software and MD5 sums. I can go back to FreeBSD 2.2.2. Check your timeline. BSD subscribers save the day HA!
--- Nothing clever here: move along now...
The premise is wrong. Looks like neither of you read the explanation.
(For the ptrace bug, a root-shell exploit was available on 17 March 2003, and a working fix was not available on linux-kernel until the following week. Evidence found on the machine indicates that gnuftp was cracked during that week.)
This indicates that a patch was not available yet.
Yeesh guys, go easy on these people. They bust their asses every day for us. Their GPL enforcement queue is usually about 50 cases deep. They're on the phones and on capital hill every day educating and lobbying industry groups and politicians. Say what you will about the GPL, you don't even have to like it or agree with it and perhaps you even think RMS is a narrow minded prick (for the most part RMS isn't even involved in the day to day operations at the fsf). They are making life easier for all of us.
Rather than boast about all of the work they do, they quietly work behind the scenes just so you can play Monday morning quarterback. They have one fulltime systems administrator who is *INCREDIBLY* overworked. They are doing everything they can to keep the boat together. Last year they were over $315,000 in the red. Thanks to the FSF associate program and some skillful fundraising they're back in the black.
Want to help? Go get your FSF associate membership. It's not that expensive and it goes a long way towards helping to protect your freedoms.
Incidentally, this is also old news. They had MD5 sums verified, and the servers were patched up and back online almost two full weeks ago. None of the software was trojaned.
Who am I? Just another hacker who bothered to pay for an associate membership (#1142)...
*Condense fact from the vapor of nuance*
how much anecdotal evidence for windows insecurities do you think we could come up with if we're going all the way back to 1998?
I don't think the point is that linux is 100% secure, just that it's much more secure than windows.
Unsophisticated users use windows.
You don't think that giving those same users Linux instead of Windows will result in lot's of unpatched, wide open linux installs?
And 90%? You must have been the same person who counted lines of SCO infringing code in Linux. Insightful my ass.
1) Why did it take so long to find out they were compromised? 2) I hope they have a safe copy of the MD5 checker, 'cos this would be a fine place to put a Trojan . Coward - but still using Windows !
...that it's just b.o. from all the creatine supplements that you're taking.
Did you go running to mommy?? Boo hoo hoo, buy me a Latitude! Buy me a Powerbook!
Fuck Beta. Fuck Dice
you shouldve been modded up...your post was funny and dead on the truth. I plan to punch the next linux user I meet just for you. That's if one ever comes out of his mom's basement.
SCO filed suit against IBM on March 6, you know.
I'll let someone else make a lame joke about the new contents of "README.SCO".
Between this and SCO, Linux sure doesn't seem to be having a good year. Compromised since March? How many other distros may have used gnu's site as a source between today and then? Good gravy!
lol, right on brother...fuck you stupid linux asslicks.
"At first, we thought it was just another snake cult."
and yes i was totally serious...*cough* not
"At first, we thought it was just another snake cult."
If I had mod points today I'd mod this as high as I possibly could. No matter how good you are at your job, no matter how much you get paid, no matter what you do, there is always something that could be done better. Let's face it: mistakes happen, a patch is missed, they forgot to delete a user account, etc. I'd be willing to bet that almost everyone out there has worked in at least one place where user accounts were not removed until well after the door had hit the ass of the former employee on his last day.
The FSF don't say (and probably shouldn't say) whether they know who did it. I hope they do, because if they don't the mistrust which will be engendered will cause a lot of unhappiness, and will distract maintainers from looking after the packages we all use.
If the FSF don't know, I hope the culprit has the guts to own up, and own up quickly.
I'm old enough to remember when discussions on Slashdot were well informed.
It was fixed months ago. It was the local root ptract exploit.
The only reason they got cracked was because they allowed local shell accounts, and due to questionable reporting practices, an exploit was released before linux kernel people had a chance to fix it.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Ok - let's say that you have 10 SuSE Linux 8.2 systems. In July, patches were released on 8 days for this product (the 3rd, 9th, 11th, 14th, 15th, 16th, 21st and 25th). For arguments sake, you need to install at least one of the patches each day as some days there were multiple patches released. Based on the logic above, you would have to perform 8 total security audits in July. I don't know too many admins that have that kind of time on their hands.
Actually it was Linux. A local-only kernel exploit.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
Yeah but it looks like a local user exploited it - why would ftp.gnu.org have local users?
Also its the entire MD5 signing system which is stupid - so they got hacked, that happens to the best of us. - the software up on ftp.gnu.org shouldn't have MD5 signature files - anyone with access to the server , the actual archive files should be crypto signed with public/private keys.
Nope, nothing so sinister, just posting whilst half asleep.
Thinking "ftp", but typing "apache".
The rest of my points still stand though. As proven by many of the posts on this thread - people falling overthemselves to declare "It must be an inside job", only shutting up when the official announcement of what happened is posted - yet, it was a bug in some open source software, which caused their system to be compromised5 MONTHS ago.
Now, hands up all those who would be so happy to absolve any M$ box admins for not detecting that they had been compromised 5 months ago?
Just pointing out the inevitable hypocricy of it all - for evidence, just dip into this topic and read some of the many "It must have been an inside job" posts - they are hard to miss...
People should not be afraid of their governments - Governments should be afraid of their people.
yea! someone used the proper term, 'CRACKED', for a change.
---- Booth was a patriot ----
shaddup ya arrogant coont.
Not to slam the FSF, but for important distribution sites is it feasible to host the files from read-only media? Like burned CD-R or perhaps (for ease of update) a SCSI HD with the write disable jumper in place?
Seems like keeping the authoritative archive on machines unconnected to the 'net would be the way to go. Hard to beat physical security. But maybe this would be too much a pain-in-the-ass.
Anybody know of a site using a similar strategy?
Why not make the whole site read only by making bootable cdroms/dvds with the entire environment and files so that it can't be compromized so easily? The drawback is updates would appear maybe daily instead of instantaneously. There's a site somewhere that shows how to do this...
Y'all raise your hand if you think SCO or Microsoft did this or had reasonable intent to do it...
Torch for you... fork for you... shovel for you...
to download pictures of little boys who get sucked off by older women.
Sorry to break it to you kid, but your mom isn't dead, because I just saw her in alt.binaries.pictures.erotica.yno.trolling
As it stands now a hacker really has nothing to gain by learning to hack linux.
So you mean it'd be of no value to root RackSpace or Verio and launch a massive attack from systems with redundant backbones as opposed to a bunch of crappy dial-up boxes? I wasn't responding to your so-called claims because they are groundless and uninformed.
1) Linux runs like on shit on a 486 and nobody does it anymore except to brag about it. You can buy spare PII and PIII systems for less than the time it takes to get the 486 booted up, even at minimum wage. Asshat.
2) 1% marketshare is more like 5% of all Internet facing machines, and about 25% of all machines with decent bandwidth. Also, holes that can hit Linux may also be applicable to FreeBSD (think Yahoo, Akamai), so that might be even higher in terms of oppurtunity.
3) Which linux users who actually know anything claim that it's unbreakable? I sure don't. And for the longest time, Microsoft was claiming the opposite. So now they are owning up to a terrible security record. Thanks a lot, we know that already, hhuhuh, talk about pot calling the kettle black.
You might have noticed that a lot of the positively moderated comments for this story are lamenting FSF's policies on backups and patches, and urging them to get on the fucking stick instead of being apologetics.
At least it wasn't a remote root exploit (cough RPC cough).
Fuck Beta. Fuck Dice
I can't fucking wait until Q**** gets cracked. I'll go to DJB's house and take a picture for prosterity.
Especially when they refuse to fix some of their systems, like NT4 (I know it is EOL'd, but this last one is a major problem).
1 c3 333-4892-431f-ae93-bf8718d29e1a/Q823980i.EXE
If you are talking about 'this last one' as in the blaster worm, you can easily get a fix for any version of NT4, it appears. The following link is for NT4.0 Server/Workstation:
http://download.microsoft.com/download/6/5/1/65
This file is available right from the link located on MS's homepage, and they also have downloads for other OS's there as well. There might not be a fix for old-ass NT3.5 or other ancient OS's, but there is no need to spread disinformation about something that can be verified so easily.
What, you think Unix has no vulnerabilities, and that's why there haven't been more cracks?
As the "general spiffiness" and "in widespread use" factors increase for a platform, which they are for Linux, this sort of thing is going to happen more frequently. Don't assume the wonderfulness of open source/many eyes/separate address spaces/better fundamental design constitute a suit of armor.
As we make executable content availabe in email messages (Flash, Evolution, anyone?), as we make lots o' hooks for pieces of software to play with each other (Gnome, anyone?), we open up the possibility of some unexpected interaction biting us in the ass.
Similarly, as more and more organizations deploy Linux, it becomes a juicier target to attack.
(The lesson being: developers (especially developers of cool shit) should not relax about security.)
John.
I'm sure there are plenty of stories to tell. However, most Windows exploits are rather weak. Very few give the cracker a bash prompt, with C Compiler and all the tools that a root shell exploit on a Linux box gives.
A Good Intro to NetBS
Once again, it should not come as a suprise that ftp.gnu.org was compromised. Hackers target centralized source code and binary distribution sites. That way, they can backdoor 200,000 birds with one stone. cvs.openbsd.org was hacked last summer too. My advice: build everything from source.
I agree
But I'm all for fewer hypocrites and less ignorance on Slashdot :)
;)
Daring to dream the impossible dream, are we?
Pretty much all of the worms exploit known and fixed problems.
So, it's not totally Microsoft's fault.
Well maybe if you dumb (L)users would stop using windows and start using Linux you wouldn't have this problem!
Ohh... wait....
Karma means nothing to me, so suck it...
and wu_ftpd has what to do with this?
...
The exploit that owned the gnu guys was a local-user kernel hole. You know, kernel. As in Linux.
That sure as hell ain't *BSD, HURD, Cygwin, etc.
But since it was mentioned... only a bloody idiot would run wu_ftpd anyway. It's always been swiss-cheese as far as security goes.
But then, this was gnu.org
Yes. From the OpenBSD FAQ:
Serve Gonk.
...and not just because it points out the disparity in tolerance for MS holes vs. others, but because it points out the emotional difference. Either way, the LINUX zealot is grabbing his torch. But in the MS case it's their fault. In this case, it's for the perp.
I think only the BSD proponents have it right and so what... it's not snobbery if you're right.
Off that topic tho... the problem is... what about all the GNU software installs that have gone down since March? If you buy the GNU line here, it's all suspect. And let's be clear here that this includes GNU software for any platform, including Win32! Imagine if a library used in a cross platforn GNU-distributed product has "malcode" inserted! If I stretch my imagination, I can believe that a sizeable percentage of the *X/BSD crowd will know to get fresh everything that might be suspect... but Joe Windows who wanted to try GIMP, oOo or something to avaoid paying for the commercial offerings?* Forget it, he'll never know the diff... and besides, he's r00+3d six ways from sunday anyway already. But now if someone in the know ever hips him to the fact, he'll probably blame the GNU installs.
I'm a Windows user a lot of the time, but there's no denying that the mean value of intelligence of users on the platform is far below that of most others.
*(note -- I'm leaving out the other great GNU software that runs on Windows like Apache, MySQL, just to name a few because the caliber of moron we're talking about here has no need for a web server or DB engine, etc. then again, MS would install it by default until recently...)
Can I bum a sig? I left mine at the office.
Well, I must say that I've never met Mustafa at work... the people who run the UK Mirror Service are, however, there for all to see on the UKMS Crew Page
In all seriousness, you have until some time tonight (on BST, which is UTC+1) before we should be fully synced, including any files that have been pulled, with the source site. There are some exceptions, but I don't think they will apply in this case. And if any files were compromised, they are compromised on our servers as well.
WARNING: SHAMELESS PLUG: If you are a fan of the Mirror Service, or even just a user, please note the message on our homepage, as we are about to be able to serve even more users, at higher speeds.
In that case, as I suspected, social engineering and/or an ID10T error was to blame,
Also I use linux all the time, at work and on my laptop, and that 2000 box is dual boot.
So *pbbbbt* on you.
I just like to flame trolls and/or idiots. Can you just LET ME FLAME!?!?!
Fuck Beta. Fuck Dice
Surely they had a responsibility to announce this compromize as soon as it was discovered so that those that had downloaded potentially compromized files could take appropriate action immediately?
FTP software is very much part of the operating system. Just like the web browser, media player, and Solitare.
See? Everything is easier with Windows.
Yes there are, but they've been "rooted" for the last three months, and any malitious code would have propergated to the mirrors as well.
09F91102 no, 455FE104 nope, F190A1E8 uh-uh, 7A5F8A09 that's not it, C87294CE no. Ah! 452F6E403CDF10714E41DFAA257D313F.
Compromised for 5 months and didn't know it.
That is about as shameful it gets.
I am... speechless.
Read all the FSF source and understand it. When you're sure it's safe, hand-execute the build-cycle for the linux kernel and gcc. Enter the resulting binary into your computer using the toggle switches on the front panel (you did hand-build your computer to be sure the manufacturer didn't sneak anything malicious into the ROMS, didn't you?). Then, and only then, can you build the rest of the distribution without the risk of a trojan compiler.
The great advantage of free or open-source software for the superconduting lead hat paranoid is that you can't do a clean build like this for Windows. Only if you have the source can you be sure your compiler is not sneaking malicious op-codes into your machine.
The FSF statement says that an exploit for the ptrace vuln. was available on 17 March and that a working fix wasn't available until a week later.
But my search through linux-kernel and bugtraq shows that Alan Cox published the vuln. along with a patch on the 17th. Although the patch didn't apply cleanly on 2.4.20 it was very easy to fix and a clean patch was posted the next day.
The earliest exploit I can find was posted to Bugtraq on the 19th.
I understand that sometimes servers get hacked but they shouldn't imply that it happened because the linux developers were slow.
Well this is /. for Bob's sake. You'll have to giggle on the inside; just like you have to cringe on the inside when a stupid admin does something dumb with an MS product, or MS marketing does something that makes you fear for the future of humanity.
From: AP Satline
Subject: Microsoft was right, GPL is viral.
Redmond, WA.
In the latest development in the war for users,
Microsoft today announced they were correct two years ago when they called the GPL viral.
Microsoft PR spokesman "Matthew Stewart CollinsEdward" (MSCe) had this to say. "You see thier Web Site has been hacked, the GPL was just sitting there at www.gnu.org for anyone to modify". "You just can't trust any license thats not certified". "With our EULA, your guaranteed no changes in between versions". "Because of this flaw we are going to get those Linux Server users to change back to our five user version of WinXP2k+Plus."
When asked about the Windows Worm earlier this week Matthew responded "Thats not our fault, we used a modified version of the RPC specification wich was Open Sourced. Obviously it's not our fault when the GPL has been compromised".
When asked for a Linux comment Larry Allen Mark Petry (LAMP), a linux user/admin said this. "Oh man, the press is getting it all wrong. It was an FTP server problem, not a Linux one". "I, think Microsoft was behind the attack". When asked for proof, Larry said this, "Proof, you want proof, just look who is behind the latest SCO lawsuit!". He then mumbled something about "Bush" and wondered off.
When asked for interviews, Bill Gates (tantrum) and Richard Stallman (bath) were not available for additional comments.
End: AP Satline.
No o/s's were harmed during the making of this news flash.
It's just the normal noises in here.
I think you still do, but honestly if they're not going to invest in an automated jukebox to back up the system, or mirror to a secured site, then having someone sitting in front of a CD-RW feeding 800MB disks to the monster all night would be fitting punishment for lack of foresight.
Besides, It fits well into the "LINUX is cheap and (mostly, almost) works" mentality.
I wonder if any of their sysops are currently rethinking the "trusted ftp" architecture? I suspect idealism just met the legendary brick wall of reality.
It doesn't matter what you wrap your emotions around, Reality is a brick wall specifically designed to scramble eggs
don't slam them for messing up, but then again don't hold back and feel from giving good criticism out of a fear their wittle feelings will be hurt. To me it is highly ironic that in such a distributed environment as FSF development and not to mention their philosophy, that there is not a distributed or mirrored redundancy system in place. Physician heal thyself
Do you keep 5 months worth of backups? Well? Do ya?
Well, cut them some slack, then!
"Avoid employing unlucky people - throw half of the pile of CVs in the bin without reading them." -- David Brent
LOL -- in Canada, we do all of these things from time to time (well, we don't lock our doors, ever... and most of us have our car key hidden behind the plates... as for stores? well, yes, i've walked into a store and left my money on the counter.)
:)
The sad part is that you think a world where such things are possible is *undesirable.*
I would *love* to trust my fellow man, personally
cannot find the right friends (or relatives)
to live like this, maybe, you should look for
new friends and relatives.
I don't want to live in my house suspecting
everyone as if they are crooks or thiefs.
And you treat your friends like potential thiefs, don't expect
much in return.
P.S. I'm just kidding. Turn the flame throwers off
To use OpenBSD from now on !!
" but this is too much for me" -- if you can't take it get the fudge out. Linux people have courage, that's why we can face the storm.
"I think de Open Source Goeroes" -- who the fuck is Goeroes????
"are technical not so good as I thought" -- I bet they can make clearer sentences than you. And "technical" YOU are full of it
"I think de Unix technolgy is a lost path" -- and YOU are a lost case, too bad nobody cares.
In fact i'll just stop commenting on this shit, I have better things to do.
B0mbtruck
--
I set YOU up the b0mb.
It is highly recommended that checksums be stored on a different server!
Many high profile sites surprisingly do not do this.
By keeping checksums separate from the files themselves, it makes the cracker's job more difficult, because they will have to crack two machines in order to Trojan a file. It is also recommended that these two machines be running different operating systems, such as Linux and OpenBSD, so that an exploit affecting one will hopefully not also affect the other.
If only one server is compromised and the files or the checksums are changed, but not both, people will be able to detect this by the mismatched sums. When the checksums are on the same server as the files themselves, the cracker can replace the checksums at the same time as the files, and nobody will know that the files have been compromised.
Also, GPG keys should be used to put some cryptography into guaranteeing that the files haven't been tampered with. The cracker will have to forge a GPG signature, much more difficult than regenerating a checksum. I am glad to see that the GNU project will do this for future files, to help prevent a situation like this from happening again. Of course, the GPG public keys should be on a different server than the signed files!
Dr. Demento On The 'Net!
I believe most GNU projects have CVS repositories (or any other source versioning system), and they are not located on the compromised server.
Then with a little scripting, all archives can be rebuilt.
It would take some computing time though but would be an automated process.
Rooted in March 2003 by a "local user". They started restores 12 days ago. Without telling anyone.
This is worse than anything that Microsoft has ever done.
They started restores 12 days ago and didn't tell anyone.
I cannot trust the FSF, ever again.
They started restores 12 days ago and didn't tell anyone .
There is no difference in practice between the FSF and Microsoft. The experiment is over.
If you were blocking sigs, you wouldn't have to read this.
Fair enough that they were compromised, it can happen to anyone, even the most security-minded individual - I'm not going to go into the insider job ideas.
They're human. meh.
They're using back-ups that they know are safe, meaning that they are also out of sync with their more recent uploads...so my question is this:
Between you guys (and madams), what should they have done/do to get it up and running faster (and remove the clouds of the loss of trust from over their heads)?
Why did it take so long to realize they were compromised? Does FSP really run Windows under the hood?
this is not a sig
Be sure to mention that to Hitler while you're fellating him in Hell
But they ALREADY work for Microsoft's "research" department.
Friends don't help friends install M$ junk.