Slashdot Mirror
Fedora Infrastructure Compromised
Trailrunner7 writes "The infrastructure of the Fedora Project was compromised over the weekend and an account belonging to a Fedora contributor was taken over by an attacker. However, Fedora officials said they don't believe that the attacker was able to push any changes to the Fedora package system or make any actual changes to the infrastructure. The attack appears to have targeted one specific user account, which had some high-value privileges. The attacker was able to compromise the account externally, and then had the ability to connect remotely to some Fedora systems. The attacker also changed the account's SSH key, Fedora officials said."
Logs can be faked. How about a bitwise comparison to the known-good package system?
No, they have to Virtual Desktop in.
And what, interject some bad code? How would anyone know?
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
P.S. Of course if they were serious about security in the first place they wouldn't even allow logins with passwords and would require public key authentication instead.