Slashdot Mirror
Intrusion Cleanup Forces Delay For GNOME 2.6
An anonymous reader writes "Looks like the GNOME site (both web and FTP) is back up and running again (from a replacement system). The restoration work is still going on, and dynamic content does not work yet. Bugzilla should be up by tomorrow (it is already in testing mode). More details are available in this announcement. Kudos to the GNOME sysadmin team for such a rapid recovery." However, blurzero writes "GNOME 2.6 was scheduled to be released sometime today, however after evidence of possible intrusion on the web server, the release has been delayed by one week, until March 31st." Update: 03/24 14:08 GMT by T : An anonymous reader points to this story on the delay at ZD Net Australia.
If only MSFT (and more importantly, proprietary software companies that aren't so much in the spotlight) were as forthcoming about break-ins.
Quo usque tandem abutere, Nimbus, patientia nostra?
It makes you nervous about the big megacorps -- when their website is compromised -- do they even know... or care? I've never seen M$ shut down for a day because of a website compromise, although it must have happened several times.
Jay | http://oldos.org
I am personally disappointed in having to wait another week, however I completely respect the Gnome team on their tireless efforts. :)
I definatly agree with the idea of rolling back to a backed up copy of their site, but perhaps they do not know how long someone was able to access their systems?
Gnome team, take all the time you need. :)
-
Either way, you only have to check the backup server data itself against (externally backed-up) MD5 checksums, and ask developers to re-commit any changes made during the suspect time.
Now try and do that to a mail server, and the fecal matter hits the air-handler. But, with data that is relatively static by comparison, it takes work, but isn't too much of a trial.
$0.98 in change, please :)
Quo usque tandem abutere, Nimbus, patientia nostra?
According to Waugh, the GNOME Web servers that are hosted by Red Hat were compromised by "a dumb cracker who probably didn't realise what they got into".
Seems like he was smart enough to hack their system.
Scott Plumlee
Kudos to the GNOME sysadmin team for getting owned
Something bad happens to someone we like. Bummer.
Something bad happens to someone we don't like. Haw Haw.
Why do people make such a big fucking deal out of double standards? Should I feel equally angry toward someone who kills a stranger as I would if they'd killed a relative? No.
With all these break-ins on open source servers, it should finally let people see that just having open source software on a server does not make it more secure. The apache.org site was hacked because of an insecure default install of a web application and MySQL. Even the docs said not to leave it that way. If 1 in 100,000 people make such mistakes, popularity created more places to get in.
No post with "M$" in the body contains anything of value.
The caveat with that scenario is that you have to a) know exactly how the break-in occured in order to b) know that you can fix the system from the pre-break in state to remove the vulnrability before bringing the system back online.
Just re-imaging the server and putting it back online will result in the server being comprimised again.
Could it be that having competant, diligent system admistrators is more important than using the "right" server platform?
"Ask not what your country can do for you." --John F. Kennedy
How do you know the MD5 wasn't made after the intruder got in? It wouldn't be very valuable then, would it?
The point is, after a breakin you must determine when the breakin occured, because everything after that is suspect. The problem is it can sometimes be very difficult -- or impossible -- to determine when the breakin happened. Then you're really, really screwed.
In the end they will lay their freedom at our feet and say to us, Make us your slaves, but feed us. - Fyodor Dostoyevsky
Re-installation of the OS from media
What if the OS has a vulnribility and the attacker can get back in without issues?
a backup from a time known before the break-in
What if the attacker had installed the back door months before hand? You may not have a valid backup.
Paying taxes to buy civilization is like paying a hooker to buy love.
Of course even a reinstall still leaves the original hole open that the attacker used in the first place.
Paying taxes to buy civilization is like paying a hooker to buy love.
No, dumbass, the difference is that closed-source companies keep it a secret (or doesn't know in the first place) when their servers are compromised while Gnome and Debian are very up-front about it.
If you think this kind of thing hasn't happened to Microsoft, Oracle, etc., you're wrong. They just like to keep it quiet.
All's true that is mistrusted
The proper responce (in the majority of cases) is, image the compromised file system. Reinstall the production system from source media and patches. Get the system back in production but change all the passwords, ssl keys etc, give it some other ip then where your dns points and only let the people who *absolutely* need it know how to get at it. Remember time is money and getting back in production fast is important, even if its more limited production. Now analyize that filesystem image and figureout what happend. Go to the porduction system and patch the hole. Move to full production. This is almost always my policy, thankfully I have only had to evoke it once.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html