Slashdot Mirror
Gnome.org Compromised?
Garden GNOME writes "The GNOME sysadmin team has just announced that the main GNOME web server has probably been intruded into, leading to the shutdown of the GNOME website, (including bugzilla.gnome.org, art.gnome.org and developer.gnome.org). The GNOME mailing lists, and CVS servers seem to be up, though the FTP server was immediately taken down as a precautionary measure (released sources are believed to be intact). This is bad, because GNOME 2.6 was supposed to be released tomorrow. Let's hope it is a false alarm."
I guess the next version of longhorn will now look like GNOME.
Damn you KDE zealots!! Let us have our release!
Does anyone know anything else about how this was done? What exactely was comprimised? The word "comprimised" has a braud meaning, more information would be interesting.
Sucks, I was just going to go to art.gnome.org
Shouldn't that read Gnome.org Kompromised? No, no, that's KDE. It should read Gnome.org Gnompromised.
This has got to be the work of those KDE bastards!
The Slashbots will point blame at the admins. However, if it were Microsoft...
Am I the only one who started picturing little lawn ornament men being caught in embarrassing positions?
Shades of Toy story....
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
I wonder if they have CRC'd the source and bins yet? Christ, who attacks OPEN SOURCE? Oh....heh.
Well...I suppose that if this is a new vulnerability, it's better that they go after a high-profile webserver with a good admin team that can catch the attack than that they attack many poorly-adminned ones.
May we never see th
We've discovered evidence of an intrusion on the server
hosting www.gnome.org and other gnome.org websites.
At the present time, we think that the released gnome
sources and the gnome source code repository are unaffected.
We are investigating further and will provide updates
as we know more. We hope to have the essential services
hosted on the affected machine up and running again as soon
as possible.
The GNOME sysadmin team
23 March 2003
if Linux boxes were not attacked security would not be as good. Look at this in a positive manner. At least on Linux the problem will be remedied within hours and life goes on.
At least they caught it now, instead of after the release. Now the code can be checked before it goes out, instead of everyone worrying about whether they downloaded compromised code
A Compromised Gnome. The image is just wrong.
...Gnot today.
It's a bit disappointing that somebody was able to compromise their gnetwork, but i guess gno system can be comletely secure. I only hope people would stop putting G's in front of all the N words they use when they're talking about Gnome. It's getting on my gnerves.
Esoteric reference.
It may have been the GLF. They've been causing problems in europe..
Now the internet? Guess I'm not the only one waiting for the new release!
FREE THE GNOME!!!
But, just like in previous break-ins to other systems (Gentoo, Debian, Savannah), they're taking the correct actions by shutting everything down and BEING CAREFUL. I often wonder if commercial companies are always this fastidious.
:)
You can't beat all the crackers, but handling a bad situation correctly should be commended. Good job, GNOME team!
I'm eagerly awaiting 2.6, too, I may add!
-Erwos
Plausible conjecture should not be misrepresented as proof positive.
Oh my God! I hope they didn't steal any source code!!
MOHAWK DAN: LOL D00DS IM IN
sLiPkNoT696969: omg d00d hax0rs them
p1kap1ka: hahaha pwnage u go d00d what proxy r u using
MOHAWK DAN: WHATS A PROXY LOL
p1kap1ka: uh... it hikes ur ip
MOHAWK DAN: LOL WHATS AN IP TELL ME NOW THAT IM A HAX0R
---
Never criticize religion on Slashdot. You will be modded down for "Troll" no matter how factual it is.
Maybe someone desperately wanted a copy of the original Open Source Gnome LOGO!
Besides what would one get out of breaking into an open source server.Source code thats already available? try to corrupt that? Not a good plan.
Lord of the Binges.
I hear these hackers are going to release the source
Imagine a beowulf cluster of compromised gnome servers.
Obviously, since gnome is a GNU/linux cornerstone, it must be coming from sco. Go get'em, feds!
(logic used: same as in "sco.com was attacked by a worm -> it must have been a linux fan")
"It's too bad that stupidity isn't painful." - Anton LaVey
That's the wrong attitude to take. If a Linux-based server is compromised because of software flaws, that's a perfectly legitimate point in an argument about security, just as the compromise of a Windows-based server because of a software flaw would be. If there's a real vulnerability that let somebody crack the system (as opposed to a misconfiguration or incorrect belief that the system was broken into) it needs to be fixed pronto, rather than written off as a PR event.
There's no point in questioning authority if you aren't going to listen to the answers.
You know...honestly...
There have been serveral major, high profile compromises of numerous FOSS servers in the past twelve months. Including a compromise of the GNU source repository.
Microsoft has not made a big deal out of these (at least as far as I've seen). Whereas every security flaw at Microsoft is treated by Slashdot as if someone got access to the crown jewels (well, admittedly the Windows source is running around all over the place...)
Microsoft has really been acting a lot nicer towards FOSS folks about security lapses.
That being said, I'm just *waiting* for a sourceforge compromise. That would be a *huge* hit, and it just plain has to happen sooner or later.
It would be nice if a couple of distributions put out basic *up-to-date* HOWTOs of best practices on how to set up minimal, secure servers using their distribution.
May we never see th
You can't compare a Linux distribution with hundreds of packages to Windows, which is basically a kernel/GUI/browser combo.
Try using (for Linux) the number of kernel/X11/Mozilla vulnerabilities instead and at least you'll start making sense.
must.. resist.. temptation to moderate...
I wonder if they are running a Debian based or Debian itself, and Debian has another hole in it.
Funny. Too bad that was just a regular kernel hole, not one special to Debian's kernel. Any other distros can simply count themselves lucky the attackers didn't choose them.
When Microsoft undergoes a security breech, their source code spills out and leaks across the entire Internet.
When gnome.org undergoes a security breech, their source code is more *difficult* to get.
Fun, eh?
May we never see th
I fully expect a bunch of lame Microsoft jokes.
But let's be real, here. Last year in the span of six months, Debian, Gentoo, and GNU (twice!) were compromised. Now GNOME.
Can you honestly rail on Microsoft? When was the last time their servers were compromised? I only vaguely recall something in 2000 about alleged stolen source code, and a real good that has turned out all these years later. As for this year's stolen source code, Slashdot never reported this but it was taken from a Linux computer at MainSoft.
Just funny how things are viewed around here, with a certain bias some people don't even realize they have.
My bad, won't happen again.
-KDE
Error 407 - No creative sig found
From Netcraft:
Apache/1.3.12 (Unix) (Red Hat/Linux) mod_ssl/2.6.4 OpenSSL/0.9.5a PHP/3.0.7
Could it have anything to do with the old version of OpenSSL, and the numerous vulns found lately?
guess next you'll tell us that ASP.NET is the better plattform for web services =)
while (!asleep()) sheep++
Why cant these idiots find something else to do with their time then screw up systems. ( be it some OSS project or a commercial behemoth )
Perhaps we just need to forget the courts, and find people that do this and take care of the problem.
All it does is make everyone's life harder, it doesn't get 'them' anywhere...
Disclaimer: I'm not even a Gnome fan.. it's the principle.
---- Booth was a patriot ----
Not to pick nits, but that error didn't come from ASP.Net, it is from classic ASP and is actually an ADO (data access) error.
Heaven forbid that someone make a disparaging comment about Linux and make a joke about its stability/reliability/security with regards to windows where Linux looses.
Help Brendan pay off his student loans
...sorry.
The Gnome team didn't mix all the web sites (where user custom shell scripts are always a risk) with the cvs box.
Just a thought, and I haven't been around very long, but if a major software company had reason to suspect their security had been compromised the day before a major release, which is to say sometime after major effort and bucks went into promoting the release, would they publicize it?
It seems to me that since Gnome is open-source, they don't have a lot to lose by delaying the release until they know their product has not been compromised.
The Dalai Llama
Just thinking out loud, try not to get any on your shoes
My sig could be your sig!
With OSS, an intrusion, even a full bore compromise of the code base is more likely to be caught. I would hope that there are diligent OSS people that cross-compare their copies of the source to the CVS copies and look for disrepancies. A distributed analysis of all changes (including the officially sanctioned ones) would help uncover malicious code.
In contrast, the users of proprietary code have only the manufacturer's word on what changes occured, who made them, and what those changes do. We users have no easy way (short of reverse engineering the code deltas on the binaries) of determining what happened between version X and version X.1. The security of non-OSS code is in nontransparent hands and that makes it insecure.
Two wrongs don't make a right, but three lefts do.
If windows came with SQL and Exchange server, Office suite and various other add-ons and softwares, it'll be easily as big. But that doesn't matter since you cannot download non-trial version of Windows from MS in the first place.
1f u c4n r34d th1s u r34lly n33d t0 g37 l41d
Lucky anyhow that the server is unavailable 'before' it got slashdotted.
This is NOT the best sig in the world, but this IS a tribute to the best sig in the world.
You've never "discussed" Windows on Usenet, have you? Windows supporters outside of Slashdot are just as obnoxious and idiotic as the worst anonymous cowards here.
Here is what the devolopers should do.
Each time they submit a file that they have made changes to in the cvs archive, then also hmac it and sign it with their private key. Then later on if the system was compromized you could go back and computer the hmac of the file to make sure it matches that which the programmer submitted it to be.
And then even if the system was compromised you wouldn't have to question which ones were changed or not since it can be checked just by confirming the hmacs.
The best design for security have perfect forward security. And a signed hmac would prove the validity of the file unless the signing key was compromised.
At least as far as I been aware it never been a a OS that was at fault.
nitpicking? Well yes. But just ask yourselve this. Gnome runs Red Hat. If there was a hole in Red Hat then why is only gnome under attack and not every Red Hat box in the world? Are linux hackers more easily satisfied and think 1 box is enough?
So what do you think has happened here. Someone found a fault with Red hat or did someone find a fault with the Gnome setup of their Red Hat server?
Only fools blaim MS for users who download a "keygen" that turns out to be a virus. However we do blaim MS for making holes in their software that affects every damn installation of windows out there.
That is the difference.
As for your howto suggestion. They exist. They just are a lot of work and most people don't bother. Hell if you follow such howto's then Windows can be made secure (rule 1 Windows is not an internet OS, run it behind a firewall that means not a firewall ON windows but windows BEHIND a firewall). I follow them. My windows/dos box has never been compromised. Neither has my linux box.
Then again neither of my machines is supposed to do what gnomes machines are supposed to do. It is easy to secure to the outside world when nobody is supposed to access it. Fort Knox is secure because nobody is allowed in there. The highstreet bank is a lot harder to secure.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
I'd actaulyl think the code might have been touched. The timing of the hack is interesting because it is so close to a release. If I was going to try and plant something I'd wait until just before it goes out the door in a mssive release. Less chance of getting caught and biggest dispersal oppurtunity. Sigh
His paper is a good example of how hard it is too change a open source projekt of today - since the compiler nowadays is separate from the rest of the code.
It's mucher harder today since one need to crack the security on soo many webbsites because of the distibuted development that is done in free and open software today on the Internet.
His example also shows that it only works if the same developer makes both the OS and the compiler.
Linux are not developed that way - however a large competetitor to Linux is....
Just saying it like it are.
So, when is the FBI going to accounce their special task force to track down these dangerous hackers? After all, isn't that what they did when the Microsoft code was leaked? Something tells me this won't even make the FBI's radar, though...
"Save the whales, feed the hungry, free the mallocs" -- author unknown
We have to remember that most of the people working on Gnome and/or maintaining the servers are volunteers. That said, I have to tip my hat to these people for the very professional action they provided post the compromise. Taking down the compromised server, informing the community, and, most importantly, not releasing premature statements of blame or excuses (which is more than what I can say for a lot of professional companies).
Just check the ftp server and its mirrors. All of the 2.6 components are out (nautilus included) with the version bumped up to 2.6.
You can get it and run it now...
AFAIK both Windows and Linux have their vulnerabilities, strengths and weaknesses. I've made my choice and you've made your's. That's cool.
I've got nothing against windows fans it's just their operating system I can't stand
My hyperlinks aren't worth the paper they're printed on.
First it's "Microsoft bundles too many things with Windows" and now it's "You can't compare Windows to a Linux distro because it only has 3 packages: kernel/GUI/browser"
Pick one.
Even if I accept that as true, Windows still isn't nearly as good in this area as just about anything that tries a little harder for POSIX compliance.
If you are comparing OSS code to Solaris or AIX or something, you might have a point. But not much of one.
Dunno when the last time it was hacked. They didn't tell anyone.
were when I did a cvs diff last !
Hi, I just noticed it is back online. I guess it wasn't anything too serious, hope it doesn't delay Gnome 2.6
The fact that this would be a good time to TRY to touch the code does not mean that they had any success.
There's a lot of that around here. Every time a program in a Linux distro has a problem we're reminded that it isn't really part of Linux. Every time someone says Linux doesn't have as many features, suddenly those flawed programs are reclassified as part of Linux again.
A metric assload of posts talking about how all (800,000ish and counting) Slashdot readers are one person (the infamous Slashbot).
:)
:)
A bunch of "hey, Linux has problems, so stop saying anything negative about Microsoft" posts getting moderated to +5.
At least 100 people posting "Linux projects have been hacked many times in the past year, Microsoft none", while ignoring the complete and utter lack of Code Red, Slammer, Blaster, or any Warhol-type worm ever appearing for a *nix-based system, even though the majority of the internet is run off *nix. And no, the Morris worm doesn't count - Microsoft didn't even have a TCP/IP stack back in those days
A fair number of posts by > 500,000 UIDs, coincidentally almost always as a Microsoft apologist. Hmm, wonder who the new people are
Oh yeah, and (give or take) 20 different moderations to this post, varying between -1, Flamebait to +1, Insightful. I'd kill to see the UIDs of the moderators on something like this, because I'd bet a lot of money that I could guess the UID based on the moderation.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
Isn't it pretty obvious that they're pulling a Valve(tm) ? ;/
As seen on gnome-announce
Now, now... There's no such thing as an uncrackable machine. Linux boxes can be compromised just as Windows boxes can. I think it's actually a good sign when the GNOME security team voluntarily takes steps to minimize damage even if it causes bad press. After all, they're trying to build good software, and shutting up about problems is not the way things get fixed.