Gnome.org Compromised?

Garden GNOME writes "The GNOME sysadmin team has just announced that the main GNOME web server has probably been intruded into, leading to the shutdown of the GNOME website, (including bugzilla.gnome.org, art.gnome.org and developer.gnome.org). The GNOME mailing lists, and CVS servers seem to be up, though the FTP server was immediately taken down as a precautionary measure (released sources are believed to be intact). This is bad, because GNOME 2.6 was supposed to be released tomorrow. Let's hope it is a false alarm."

Comments

I predict:

[Neil Blender]

The Slashbots will point blame at the admins. However, if it were Microsoft...

Re:I predict:

[Anonymous Coward]

My guess is that Microsoft was behind this. They wanted to get their hands on that release before anyone else could. We've seen this before, we see it now, and we'll see it again without a doubt

Re:Boo, Hiss.

[0x0d0a]

Well...I suppose that if this is a new vulnerability, it's better that they go after a high-profile webserver with a good admin team that can catch the attack than that they attack many poorly-adminned ones.

Re:Boo, Hiss.

[Anonymous Coward]

if Linux boxes were not attacked security would not be as good. Look at this in a positive manner. At least on Linux the problem will be remedied within hours and life goes on.

At least now

[Ethernet_Jedi]

At least they caught it now, instead of after the release. Now the code can be checked before it goes out, instead of everyone worrying about whether they downloaded compromised code

Bad news...

[Erwos]

But, just like in previous break-ins to other systems (Gentoo, Debian, Savannah), they're taking the correct actions by shutting everything down and BEING CAREFUL. I often wonder if commercial companies are always this fastidious.

You can't beat all the crackers, but handling a bad situation correctly should be commended. Good job, GNOME team!

I'm eagerly awaiting 2.6, too, I may add! :)

-Erwos

Re:Boo, Hiss.

[Anonymous Coward]

Why can't the crackers leave the good guys alone?

I've come to the conclusion that the "crackers" see no one as the good guys. There are 10 types of systems to them: "Victims and Potential Victims."

They give us other sociopaths a really bad name. :(

Gnome logo?

[xot]

Maybe someone desperately wanted a copy of the original Open Source Gnome LOGO!
Besides what would one get out of breaking into an open source server.Source code thats already available? try to corrupt that? Not a good plan.

Re:Boo, Hiss.

[rgmoore]

That's the wrong attitude to take. If a Linux-based server is compromised because of software flaws, that's a perfectly legitimate point in an argument about security, just as the compromise of a Windows-based server because of a software flaw would be. If there's a real vulnerability that let somebody crack the system (as opposed to a misconfiguration or incorrect belief that the system was broken into) it needs to be fixed pronto, rather than written off as a PR event.

Linux security

[0x0d0a]

You know...honestly...

There have been serveral major, high profile compromises of numerous FOSS servers in the past twelve months. Including a compromise of the GNU source repository.

Microsoft has not made a big deal out of these (at least as far as I've seen). Whereas every security flaw at Microsoft is treated by Slashdot as if someone got access to the crown jewels (well, admittedly the Windows source is running around all over the place...)

Microsoft has really been acting a lot nicer towards FOSS folks about security lapses.

That being said, I'm just *waiting* for a sourceforge compromise. That would be a *huge* hit, and it just plain has to happen sooner or later.

It would be nice if a couple of distributions put out basic *up-to-date* HOWTOs of best practices on how to set up minimal, secure servers using their distribution.

Re:Linux security

[ameoba]

There's a big difference. Every time a F/OSS project's box get's hacked, it's a single machine getting broken into. When there's a windows flaw, the next day there's a worm that compromises MILLIONS of computers.

The two events are incomparable, since there are numerous ways a single box can be compromised that are not directly related to an OS flaw.

Re:Linux security

[The Bungi]

In June 2001 some "Fluffy Bunny" dude rooted SF.NET, Akamai and (I think) a bunch of SETI servers, all through Apache and SSH. Shocking, I know.

As I recall the intrusion went unnoticed for a long time (at least for SourceForge) and when it was discovered SF threw out a long-winded press release that detailed how the break-in had been "detected immediately" and had not "compromised" anything of value.

So it wouldn't be the first time.

Yep, GNU/Savannah (the "really free" alternative to SF) was rooted along with the rest of the GNU/Infrastructure a few months ago. It was GNU/Terrible.

I'd just as soon not see SF.net hacked. They provide a valuable service and they manage to actually make a living at it. Actually I'd rather not see anything related to FOSS cracked and rooted.

But I do find it hilarious that whenever something like this happens the Slashbots come out of the woodwork to post things like "Oh M$ is teh worse!!1" and promptly get modded up to +5, Insightful. Of course, Linux is perfect and absolutely secure, and the crap posted on linuxsecurity.com is all lies. Blatant lies.

Ah well. The higher you think you are the more it will hurt when you hit the ground.

Re:Linux security

[The Bungi]

There's a big difference. Every time a F/OSS project's box get's hacked, it's a single machine getting broken into. When there's a windows flaw, the next day there's a worm that compromises MILLIONS of computers.

Yes, you're right. You're absolutely right. 100%, certified right.

So let us extrapolate this. Hmmm. Let's say that Linux was the leading consumer desktop OS. And someone found a vulnerability in the kernel, SSH, Apache, whatever. And a distro (like RedHat) that allows me to set IPTables to allow SSH requests. Because, you know, Linux rules now so people write stuff for it and there's this cool app that everyone uses that requires SSH. Or whatever.

Would you say that MILLIONS of computers would be compromised? How would you get your MILLIONS of users to patch their machines quickly so as to avoid Armaggedon?

Fascinating!

Re:Linux security

[LinuxHam]

Every time a F/OSS project's box get's hacked, it's a single machine getting broken into

Not necessarily true. Remember the Debian compromise? The hackers used a weak password to run a privilege escalation exploit that had been in the kernel running in MILLIONS of computers. Turned into a major kernel patch.

Re:Blame windows it already looks like Gnome

[Anonymous Coward]

You can't compare a Linux distribution with hundreds of packages to Windows, which is basically a kernel/GUI/browser combo.

Try using (for Linux) the number of kernel/X11/Mozilla vulnerabilities instead and at least you'll start making sense.

Re:Not GNOME!!

[Anonymous Coward]

You are a typical slashdot idiot. People don't attack other guys because they are enemy. This has been the case since the early days of the internet. You guys are really too stupid. People attack because they can, and there is always this weird satisfaction of attacking a site, being able to own it using different methods. That's the glory for most of the people who do this.

Linux probably will face more and more of these as people use Linux more often. Businesses that use Linux will have more of these as they switch to linux from Unixes.

Windows joke

[bonch]

I fully expect a bunch of lame Microsoft jokes.

But let's be real, here. Last year in the span of six months, Debian, Gentoo, and GNU (twice!) were compromised. Now GNOME.

Can you honestly rail on Microsoft? When was the last time their servers were compromised? I only vaguely recall something in 2000 about alleged stolen source code, and a real good that has turned out all these years later. As for this year's stolen source code, Slashdot never reported this but it was taken from a Linux computer at MainSoft.

Just funny how things are viewed around here, with a certain bias some people don't even realize they have.

Re:Windows joke

[krlynch]

I understand your point, but to be fair you should have noted that Microsoft is under no obligation, as far as I am aware, to tell anyone when they have been compromised. Microsoft's servers could have been cracked once a day, once a week, or once a month, and you would never know.

Re:Windows joke

[brokenwndw]

Let me offer some pseudo-arithmetic here:

(number of server compromises you hear about) = (number of servers in existence) * (relative vulnerability of servers) * (willingness of those running servers to reveal compromises)

I realize there are some people who have biases they don't appreciate. But data, taken at face value, is famous for having those same biases. No?

Re:Windows joke

[Fourier]

When was the last time their servers were compromised?

When's the last time MS hosted their source code on a publically-viewable CVS tree, or offered anonymous FTP access? This is not a fair comparison.

Re:Windows joke

[merdark]

Well, for one, their servers always seem to be up. www.microsoft.com going down would normally make news. Also, it's more than likely that someone cracking the MS site would do SOMETHING to let it be known that they did it. Few hackers are purely malicious, most want some sort of fame.

(Yes, I used hackers instead of crackers, get over it, the work hacker is used by popular culture that way)

Re:Windows joke

[ferratus]

I am in a position where I currently get to use all three major platforms everyday (Linux, OSX, Windows) ans while I will admit to have a bias against Microsoft, I think there's a few key differences between OSS and Microsoft-like cies.

First, I don't pay to get linux on my servers. Nobody said open source software were flawless, the key is that many here (including me) believe that you can get a more secure server if the source is open.

Second, the Gnome project is not "linux inc." whereas Microsoft *is* Microsoft inc. That is to say, Microsoft controls all the aspect of their security, Gnome doesn't. Did the sysadmin patch everything ? Did they perhaps forget to update apache or some other software ? In microsoft's case, they provice all the security update, so when they are hacked, they are directly responsible.

Thirdly, remember that this is a third party site. If we would get report of all the windows servers that are getting hacked everyday, we'd here much more news like this. We are hearing about this because GNU, Gnome, Debian, etc. are public projects... othewise, this would be just another hacked site.

Considering the amount of software present on a current-day OS, expecting any of them to be flawless and completly secure in a real-world scenario is a bit ridiculous. They point is, I believe you get more for your money with an Open Source OS (of which linux is one alternative) than with a Microsoft OS.

Re:Windows joke

[red tiger]

And not only the companies. The Soviet Russians were exactly like that, and they haven't changed much.

For example, Chernobyl:

• The first day they didn't tell anyone.
• The second day they said: "Yes, something little has really happened..."
• .......

Re:Windows joke

[Thagg]

Merdark says Also, it's more than likely that someone cracking the MS site would do SOMETHING to let it be known that they did it. Few hackers are purely malicious, most want some sort of fame.

Note that the compromisers of the debian, GNU, and now Gnome sites did not let it be known. They are either not driven by publicity or have longer term goals. Believing that systems are secure because crackers don't announce themselves is foolish at best, mendacious at worst.

thad

Re:Windows joke

[leandrod]

> their servers always seem to be up

Do you realize how many servers MS has? Free software projects are lucky if they have two.

> it's more than likely that someone cracking the MS site would do SOMETHING to let it be known that they did it

And get black helicopters hovering over your backyard?

> I used hackers instead of crackers

You insensitive.

Re:Windows joke

[Ender Ryan]

But let's be real, here. Last year in the span of six months, Debian, Gentoo, and GNU (twice!) were compromised. Now GNOME.

I take your point, however... Wasn't at least one of those not a software exploit, ie. someone "inside" messed up and a password got into the wrong hands? And wasn't the Gentoo exploit just one of the mirrors, said mirror not even running Gentoo?

Can you honestly rail on Microsoft?

Sure! Their business practices are detestable, their software is geared towards vendor lock-in instead of providing customers with what they need, and thier complicity in the SCO fiasco is deplorable and deserving of harsh punishment, possibly jail time. They have engaged in fraud, conspiracy, perjury, and corruption, if not more. Not to mention being a convicted predatory monopoly, and now they are a predatory monopoly that uses political influence to gain near impunity.

When was the last time their servers were compromised?

Really, how the fuck is anyone supposed to know that?

Hotmail just had a huge downtime, we don't know why it was taken offline. Perhaps it got "hacked." There's no reason to take anything they say at face value, they are known liars.

Just funny how things are viewed around here, with a certain bias some people don't even realize they have.

It seems to run both ways these days. Any pro-MS response seems to get modded up without consideration of merit - personally, I think it may be because a lot of the newcomers here are intimidated by the prospect of something different than what they're used to, ie. MS, Windows, Apple, proprietary development, etc.

Re:Windows joke

[Tony]

(Yes, I used hackers instead of crackers, get over it, the work hacker is used by popular culture that way)

By that logic, scientists should start using "theory" instead of "hypothesis," simply because popular culture uses it that way. Or "velocity" when they mean "speed." Or "light years" when they mean "months" (as in time). Or maybe they should start using "pounds" as a unit of mass.

Or in the computer industry, maybe we should start using the word "CPU" when we mean "computer case." Or "RAM" when we mean "hard drive." Or "cup holder" when we mean CD/DVD drive. Or.... getting the idea?

Just because the public uses a word incorrectly does not mean folks in the industry need to follow suit.

Re:Windows joke

[nathanh]

Everytime something happens w/ linux "oh its only debian.org", "oh thats only local", "only 3 kernel advisories this month, that should be all for a while". We _can not_ keep brushing things off and pretending they are not significant.

We are not brushing things off and pretending they are insignificant.

Some people brush it off. Some people do not. This is not a collective. We do not all share the same opinion.

I was never of the opinion that the debian.org incident was something to casually dismiss. Luckily, the Debian sysadmins agreed. They treated it very seriously and took several Debian servers offline to fix it. The gnome.org sysadmins are being equally professional.

Just because you can read /. user-id 702942 saying something stupid like "M$ is dumheds and Lunix Rulze" does not mean that WE are all of the same opinion.

So shut the fuck up.

Re:Windows joke

[Anonymous Coward]

"Also, it's more than likely that someone cracking the MS site would do SOMETHING to let it be known that they did it. Few hackers are purely malicious, most want some sort of fame."

The difference is that there really isn't that much of value on the Microsoft websites. They're a corporation and deliver most of their product via sales channels. They are smart enough to keep only information on their websites.

For FOSS, it's different. Everything is available to everybody else because their distribution system is the web.

This is a good reason why distributions should be made available via BitTorrent, which is encrypted to ensure that what the tracker says you're getting, you get. Then users only need to validate the tracker instead of downloading some ISO's and checking the md5sum's (and how many of us always do that?). Of course the intelligent/paranoid would still check their md5sum's, but this way you won't waste time downloading corrupted files. You check beforehand through a secure channel (signed by a private key or the equivalent) so even if the web server or ftp server is compromised, you can still count on the digital signature.

This is getting annoying

[nurb432]

Why cant these idiots find something else to do with their time then screw up systems. ( be it some OSS project or a commercial behemoth )

Perhaps we just need to forget the courts, and find people that do this and take care of the problem.

All it does is make everyone's life harder, it doesn't get 'them' anywhere...

Disclaimer: I'm not even a Gnome fan.. it's the principle.

OSS - Security through lack of motivation

[The-Dalai-LLama]

Just a thought, and I haven't been around very long, but if a major software company had reason to suspect their security had been compromised the day before a major release, which is to say sometime after major effort and bucks went into promoting the release, would they publicize it?

It seems to me that since Gnome is open-source, they don't have a lot to lose by delaying the release until they know their product has not been compromised.

The Dalai Llama
Just thinking out loud, try not to get any on your shoes

Re:OSS - Security through lack of motivation

[The-Dalai-LLama]

Sorry, should have been more explicit.

This story highlights the fact that the Gnome folks went out of their way to actively inform the community that their product may have been compromised.

My point is this: proprietary vendors have an incentive to hide from their customers security compromises; OSS software makers have an incentive to alert their customers to potential security compromises.

The idea is related to the "more eyes examining it" argument, but also subtly different.

The Dalai Llama
willing to create a cute metaphor or analogy, if that will help

Re:Should have been running a windows box

[Anonymous Coward]

"I've got nothing against Linux... it's just its fan club I can't stand."

You've never "discussed" Windows on Usenet, have you? Windows supporters outside of Slashdot are just as obnoxious and idiotic as the worst anonymous cowards here.

GNOME code

[endrek]

I'd actaulyl think the code might have been touched. The timing of the hack is interesting because it is so close to a release. If I was going to try and plant something I'd wait until just before it goes out the door in a mssive release. Less chance of getting caught and biggest dispersal oppurtunity. Sigh

Re:Microsoft vs gnome.org

[Anonymous Coward]

Actually, that was a Linux security breach at Mainsoft. But, hey, all the same thing when you are a Linux zealot.

FBI Task Force

[theCoder]

So, when is the FBI going to accounce their special task force to track down these dangerous hackers? After all, isn't that what they did when the Microsoft code was leaked? Something tells me this won't even make the FBI's radar, though...

Re:OpenSSL Vulnerabilites

[Mike Hawk]

Wow, I heard a story once where someone said something about attacks only resulting from announced and patched vulnerabilities. Of course, that claim was quickly "debunked" by the slashbots. Weird.

Kudos to the Gnome team for their timely reaction

[RichiP]

We have to remember that most of the people working on Gnome and/or maintaining the servers are volunteers. That said, I have to tip my hat to these people for the very professional action they provided post the compromise. Taking down the compromised server, informing the community, and, most importantly, not releasing premature statements of blame or excuses (which is more than what I can say for a lot of professional companies).

Re:Should have been running a windows box

[Tandoori Haggis]

AFAIK both Windows and Linux have their vulnerabilities, strengths and weaknesses. I've made my choice and you've made your's. That's cool.

I've got nothing against windows fans it's just their operating system I can't stand

Re:Blame windows it already looks like Gnome

[Foolhardy]

First it's "Microsoft bundles too many things with Windows" and now it's "You can't compare Windows to a Linux distro because it only has 3 packages: kernel/GUI/browser"

Pick one.

Good News!

[Anonymous Coward]

> This is bad, because GNOME 2.6 was supposed to be released tomorrow.

Actually, it is good news. Imagine the chaos if Gnome 2.6 was released, then a crack was detected. This way around Gnome 2.6 can be released at a later date with confidence.

Re:Yet more proof in the security fallacy of OSS

[ArekRashan]

Even if I accept that as true, Windows still isn't nearly as good in this area as just about anything that tries a little harder for POSIX compliance.

If you are comparing OSS code to Solaris or AIX or something, you might have a point. But not much of one.

Re:Should have been running a windows box

[wampus]

Dunno when the last time it was hacked. They didn't tell anyone.

It's Back

[benguru]

Hi, I just noticed it is back online. I guess it wasn't anything too serious, hope it doesn't delay Gnome 2.6

Re:Blame windows it already looks like Gnome

[Anonymous Coward]

There's a lot of that around here. Every time a program in a Linux distro has a problem we're reminded that it isn't really part of Linux. Every time someone says Linux doesn't have as many features, suddenly those flawed programs are reclassified as part of Linux again.

Re:Should have been running a windows box

[wtrmute]

Now, now... There's no such thing as an uncrackable machine. Linux boxes can be compromised just as Windows boxes can. I think it's actually a good sign when the GNOME security team voluntarily takes steps to minimize damage even if it causes bad press. After all, they're trying to build good software, and shutting up about problems is not the way things get fixed.