Slashdot Mirror
Debian Project Servers Compromised
Sean was one of many to pass along
the bad news
from the debian-announce mailing list: "Some Debian Project machines have been compromised. This is a very unfortunate incident to report about. Some Debian servers were found to have been compromised in the last 24 hours. The archive is not affected by this compromise! In particular the following machines have been affected: 'master' (Bug Tracking System), 'murphy' (mailing lists), 'gluck' (web, cvs), 'klecker' (security, non-us, web search, www-master). Some of these services are currently not available as the machines undergo close inspection. Some services have been moved to other machines (www.debian.org for example). The security archive will be verified from trusted sources before it
will become available again." They were going to announce 3.0r2 this morning; they've checked it and it's unaffected but obviously they're still postponing that release.
dave
Tech stuff
You're assuming here that the average script kiddie actually has a reason other than mindless vandalism.
Thanks for that insightful interpretation of events, Captain Obvious.
Sorry, but I had to say it.... a Microsoft release has never been delayed because one of their servers were compromised.
Let's just remember that before we extoll the virtues of how great open source is.
getSexySig();
But when the three other random posters are debian devels... ;-)
Except that anonymous coward person. I've never seen *him* in the keyring...
because he did it, duh!
Was any code stolen? OH wait...
There are a huge number of yeast infections in this county. Probably because we're downriver from the bread factory.
Cracked from M$
In response to the dastardly assault against the twin (mini-)towers, the President of Debian drew a line in the sand and immediately announced the invasion of Slackware.
I ran apt-get and my machine was converted to Windows 2003!
/* It's amazing the damage someone with a stunted sense of humor and mod points can do to your karma. */
Funny, my apt-get using h4x0r3d.debian.org was working perfectly....
My beliefs do not require that you agree with them.
bill g4t3z takes credit!
This should read "Bi11 g4T3z". Please respect the proper "3l33t" spelling. Thank you.
Another public-service message from your friendly spelling nazi. Or N4zi.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Quick patent this idea! Put the words "over the internet" in it somewhere and you're set.
Tom
Someday, I'll have a real sig.
The backdoor attempt on the linux-kernel was NSA-levels of sophistication.
If the NSA decides to puts a backdoor in linux or anything for that matter, you won't ever know it. And if you find it, you won't live to tell anyone.
Not that they need a backdoor anyway...
The server that pushes .debs to archive is running debian/sparc (donated by sun btw), so probably the cracker didn't know how to port his leet exploit to sparc (all the comprimised machines were 1386).
You mean there's some value in those "unnecessary" non-i386 arches that Debian supports? Gee, maybe they have a good idea after all...
Jay (=
But security holes exist, there is no getting around this, no matter how paranoid you are...
trust me..
I am a sitting in a faraday cage right now...I built it in my apartment to keep those pesky NSA spooks from uplinking with the nano-chips they implanted in my brain....
most of us are now implanted...you can't dig them out...i've tried....
to this compromise as it occured on a wednesday of an odd month, and was devised by a malicious user who never even worked at Apple, in the hopes that this would prod Debian users to cross-grade to 10.3...and then buy the PDA that Apple are developing with the help of a homeless guy who has been dumpster diving...and they are not even going to support the 'compromise' on anything before 10.4...CONSPIRACY!!!
;)
or so says CNet
Sorry...
We apologise for the fault in this post. Those responsible have been sacked. -- Signed RICHARD M. NIXON