Gentoo rsync Server Compromised [updated]

costela writes "LWN points out that the Gentoo project fired out an alert about one compromised rsync server." From the message itself: "However, the compromised system had both an IDS and a file integrity checker installed and we have a very detailed forensic trail of what happened once the box was breached, so we are reasonably confident that the portage tree stored on that box was unaffected." Update: 12/03 22:54 GMT by T : One more damage report: gibson writes "The Free Software Foundation recently discovered that its software host site was compromised a month ago. The compromise appears to be the same as the recent attacks on the Debian servers. The site is shut down until Friday while they install replacement hardware and verify the authenticity of the hosted source code."

Comments

Not as big as previous posters make it sound.

[jmanning]

To correct a few misconceptions in the previous comments.

It was not their server that was compromised, just a third party server in a round robin rotation. They don't own it, they don't maintain it - just someone else who donated server space.

The primary or master server is not accessible to users, it was not compromised, and so none of the original source files had a chance to be changed.

Only the 20 users that synchronized to this server even have a tiny chance of getting bad files. Having everyone sync now that this server is out of the rotation will immediately fix the problem.

Full disclosure 24 hours later. I give them a lot of credit for such a quick response and disclosure. This is very, very minor.

~J

Re:The only reason this is news...

[mahdi13]

Only 20 people sync'd with this server within that hour it was compromised...not a big deal, expecially when the compromise did not touch the portage tree and was mearly a rootkit install and some logs edited...not to mention it is a donated server used for other purposes, the attacker might not of even known it was used for Gentoo rsync...
But the server is down and will be scrubbed and re-sync'd, just to be safe