Slashdot Mirror
Fedora Infrastructure Compromised
Trailrunner7 writes "The infrastructure of the Fedora Project was compromised over the weekend and an account belonging to a Fedora contributor was taken over by an attacker. However, Fedora officials said they don't believe that the attacker was able to push any changes to the Fedora package system or make any actual changes to the infrastructure. The attack appears to have targeted one specific user account, which had some high-value privileges. The attacker was able to compromise the account externally, and then had the ability to connect remotely to some Fedora systems. The attacker also changed the account's SSH key, Fedora officials said."
However, Fedora officials said they don't believe that the attacker was able to push any changes to the Fedora package system or make any actual changes to the infrastructure.
What do you mean you "don't believe"? You don't have logs?
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
Oops...
Surprised? No I am not.
...because I thought this was about shoddy hats.
didn't something very similar happen last year, too?
Anybody want my mod points?
No, they have to Virtual Desktop in.
really low
And what, interject some bad code? How would anyone know?
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
1 in 7. As long we're just making up wild accusations, let's just make up some wild numbers.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Makes you wonder if anyone RDP's into Microsoft's code repository to make some "changes."
FTFY
Well we know that thing can't get to much worse... What would they do? Improve the system?
Actually, even Microsoft employees working remotely have to jump through so many hoops for a flaky VPN connection that there is no way anyone could get in for long enough to do significant damages. A Microsoft employee recruiting in colleges on the East coast showed me their system. You can't use a standard VPN client - even the built-in Windows one. It uses SmartCards and multiple passwords for authentication and disconnects if the card even shifts a bit in the card reader.
It would probably be easier to steal a physical device than to get into their network from outside a Microsoft office.
The first action the intruder took, changing the SSH password, set off an automatic email notification, which is how the compromise was detected. Pretty stupid.
A pity that the clueless black hats eventually learn, tho. Not that this means that open-source is totally helpless. In the past, malevolent software updates have been caught. If this becomes widespread, it just means that the development is slowed by the necessity for peer review.
I flashed on that thought but then looking at the numbers on Distrowatch the top 2 are Ubuntu and Mint (a, IMHO, crappy Ubuntu derivative) then Fedora. Unless they want to bump Fedora below OpenSUSE what would be the point?
What are the odds that you are just trolling?
Life is Reality
These things take time to analyze. Surely they will be finding out more things.
Build your own energy sources from scratch. http://otherpower.com/
The infrastructure was not compromised. One user's password appears to have been compromised and changed. That account did not have "high value privileges".
This is about Red Hat, not the tin foil hats.
They should have been running a BSD.
This never would have happened if they were running Lin...
Oh. Right. Never mind.
Microsoft fanboys, begin your modding up now! Linux fanboys, begin your modding down now!
Open Source Network Inventory for the masses! Kuwaiba
IIRC, something like that has happened before. The attacker managed to get RDP access to one of Microsoft's servers where they keep source code. However, when authorities were able to trace the connection back to his house, they entered to find he had died of a simultaneous heart attack, aneurysm, and stroke, with the Windows kernel source code open on his screen.
The Internet has given stupid people the resources of intelligent people.
http://lists.fedoraproject.org/pipermail/devel-announce/2011-January/000746.html
Summary: Fedora infrastructure intrusion but no impact on product integrity
On January 22, 2011 a Fedora contributor received an email from the Fedora Accounts System indicating that his account details had been changed. He contacted the Fedora Infrastructure Team indicating that he had received the email, but had not made changes to his FAS account. The Infrastructure Team immediately began investigating, and confirmed that the account had indeed been compromised.
At this time, the Infrastructure Team has evidence that indicates the account credentials were compromised externally, and that the Fedora Infrastructure was not subject to any code vulnerability or exploit.
The account in question was not a member of any sysadmin or Release Engineering groups. The following is a complete list of privileges on the account:
The Infrastructure Team took the following actions after being notified of the issue:
The attacker did not:
Based on the results of our investigation so far, we do not believe that any Fedora packages or other Fedora contributor accounts were affected by this compromise.
While the user in question had the ability to commit to Fedora SCM, the Infrastructure Team does not believe that the compromised account was used to do this, or cause any builds or updates in the Fedora build system. The Infrastructure Team believes that Fedora users are in no way threatened by this security breach and we have found no evidence that the compromise extended beyond this single account.
As always, Fedora packagers are recommended to regularly review commits to their packages and report any suspicious activity that they notice.
Fedora contributors are strongly encouraged to choose a strong FAS password. Contributors should *NOT* use their FAS password on any other websites or user accounts. If you receive an email from FAS notifying you of changes to your account that you did not make, please contact the Fedora Infrastructure team immediately via admin@fedoraproject.org.
We are still performing a more in-depth investigation and security audit and we will post again if there are any material changes to our understanding.
--
Jared Smith
Fedora Project Leader
It is official; Netcraft now confirms: *BSD is dying
One more crippling bombshell hit the already beleaguered *BSD community when IDC confirmed that *BSD market share has dropped yet again, now down to less than a fraction of 1 percent of all servers. Coming close on the heels of a recent Netcraft survey which plainly states that *BSD has lost more market share, this news serves to reinforce what we've known all along. *BSD is collapsing in complete disarray, as fittingly exemplified by failing dead last in the recent Sys Admin comprehensive networking test.
You don't need to be a Kreskin to predict *BSD's future. The hand writing is on the wall: *BSD faces a bleak future. In fact there won't be any future at all for *BSD because *BSD is dying. Things are looking very bad for *BSD. As many of us are already aware, *BSD continues to lose market share. Red ink flows like a river of blood.
FreeBSD is the most endangered of them all, having lost 93% of its core developers. The sudden and unpleasant departures of long time FreeBSD developers Jordan Hubbard and Mike Smith only serve to underscore the point more clearly. There can no longer be any doubt: FreeBSD is dying.
Let's keep to the facts and look at the numbers.
OpenBSD leader Theo states that there are 7000 users of OpenBSD. How many users of NetBSD are there? Let's see. The number of OpenBSD versus NetBSD posts on Usenet is roughly in ratio of 5 to 1. Therefore there are about 7000/5 = 1400 NetBSD users. BSD/OS posts on Usenet are about half of the volume of NetBSD posts. Therefore there are about 700 users of BSD/OS. A recent article put FreeBSD at about 80 percent of the *BSD market. Therefore there are (7000+1400+700)*4 = 36400 FreeBSD users. This is consistent with the number of FreeBSD Usenet posts.
Due to the troubles of Walnut Creek, abysmal sales and so on, FreeBSD went out of business and was taken over by BSDI who sell another troubled OS. Now BSDI is also dead, its corpse turned over to yet another charnel house.
All major surveys show that *BSD has steadily declined in market share. *BSD is very sick and its long term survival prospects are very dim. If *BSD is to survive at all it will be among OS dilettante dabblers. *BSD continues to decay. Nothing short of a cockeyed miracle could save *BSD from its fate at this point in time. For all practical purposes, *BSD is dead.
Fact: *BSD is dying
Careful what you wish for. They could permanently fuse that damn paperclip to the desktop.
I read TFA and all I got was this lousy cookie
1 in 7.
Many Eyes...
"The Infrastructure Team took the following actions after being notified of the issue:
1. Lock down access to the compromised account
2. Take filesystem snapshots of all systems the account had access to
(pkgs.fedoraproject.org, fedorapeople.org)
3. Audit SSH, FAS, Git, and Koji logs from the time of compromise to the present
Here, we found that the attacker did:
* Change the account's SSH key in FAS
* Login to fedorapeople.org
The attacker did not:
* Push any changes to the Fedora SCM or access pkgs.fedoraproject.org in any way
* Generate a koji cert or perform any builds
* Push any package updates .."
I will be releasing Fedora 15 Desktop Edition next week. Standby for download links.
would you trust the logs if you had them?
RFC 5848 defines how to sign log messages to help with integrity (and replays, etc.).
There's also "msyslog", where you can initialize the system with a key (stored offline) to sign logs. For every log entry after initialize, you take the hash of the previous entry, concatenate the new entry, and generate a new hash (redacting the old one). If you think you've been compromised, you run a checking program whereby you "walk" the logs after entering the passphrase (or reading it from a file). If the logs have been tampered with, the checksums will start failing.
So:
H(passphrase) = h0
H(h0, log entry 1) = h1
H(h1, entry 2) = h2
H(h2, entry 3) = h3
...
H(hN-1, entryN) = hN
An intruder can certainly delete local log entries, but it'd be quite the challenge to alter them such that the hash chain would still be valid. Of course all values are questionable after any compromise, as any message can then generated, but at least you've probably got decent data up to that point for analysis.
Msyslog (supposedly) uses the L-PEO and PEO-1 algorithms for integrity checking. Personally I haven't heard of them.
If the initialization is done via the KickStart process before even the first 'real' boot of the system, then you can automate the initialization without the initial key being exposed to the system.
Nah, MS uses Team Foundation Server for all of their version control. I have not ever met another single person or company that also uses TFS, nor have I really seen any good documentation on how to use it.
to find he had died of a simultaneous heart attack, aneurysm, and stroke, with the Windows kernel source code open on his screen.
And people say that it's selfish of MS to keep it to themselves...
If you compromised an account, why would you change the key, an action that would quite likely trigger some sort of alert (as it did). Wouldn't you just silently look around until you knew what you wanted to do with it and then do all your damage at once before they could cut you off?
Are you sure he didn't die laughing?
Any insufficiently advanced magic is indistinguishable from technology.
Are you sure he didn't die laughing?
That's an excellent alternative ending.
The Internet has given stupid people the resources of intelligent people.
The web UI where one uploads SSH public keys, however, uses a password. It was that password that the attacker changed.
See also: weakest link.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Nah, if that was true, he would have installed Ubuntu on the system he compromised.