Slashdot Mirror
Fedora Infrastructure Compromised
Trailrunner7 writes "The infrastructure of the Fedora Project was compromised over the weekend and an account belonging to a Fedora contributor was taken over by an attacker. However, Fedora officials said they don't believe that the attacker was able to push any changes to the Fedora package system or make any actual changes to the infrastructure. The attack appears to have targeted one specific user account, which had some high-value privileges. The attacker was able to compromise the account externally, and then had the ability to connect remotely to some Fedora systems. The attacker also changed the account's SSH key, Fedora officials said."
However, Fedora officials said they don't believe that the attacker was able to push any changes to the Fedora package system or make any actual changes to the infrastructure.
What do you mean you "don't believe"? You don't have logs?
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
didn't something very similar happen last year, too?
Anybody want my mod points?
No, they have to Virtual Desktop in.
really low
And what, interject some bad code? How would anyone know?
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
1 in 7. As long we're just making up wild accusations, let's just make up some wild numbers.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Well we know that thing can't get to much worse... What would they do? Improve the system?
Actually, even Microsoft employees working remotely have to jump through so many hoops for a flaky VPN connection that there is no way anyone could get in for long enough to do significant damages. A Microsoft employee recruiting in colleges on the East coast showed me their system. You can't use a standard VPN client - even the built-in Windows one. It uses SmartCards and multiple passwords for authentication and disconnects if the card even shifts a bit in the card reader.
It would probably be easier to steal a physical device than to get into their network from outside a Microsoft office.
The first action the intruder took, changing the SSH password, set off an automatic email notification, which is how the compromise was detected. Pretty stupid.
A pity that the clueless black hats eventually learn, tho. Not that this means that open-source is totally helpless. In the past, malevolent software updates have been caught. If this becomes widespread, it just means that the development is slowed by the necessity for peer review.
I flashed on that thought but then looking at the numbers on Distrowatch the top 2 are Ubuntu and Mint (a, IMHO, crappy Ubuntu derivative) then Fedora. Unless they want to bump Fedora below OpenSUSE what would be the point?
What are the odds that you are just trolling?
Life is Reality
These things take time to analyze. Surely they will be finding out more things.
Build your own energy sources from scratch. http://otherpower.com/
The infrastructure was not compromised. One user's password appears to have been compromised and changed. That account did not have "high value privileges".
I only recently discovered what the hell does "fedora" mean apart from a Linux distro.
Build your own energy sources from scratch. http://otherpower.com/
Open Source Network Inventory for the masses! Kuwaiba
This never would have happened if they were running Lin...
Most likely it's a weak SSH password: SSH and VNC with crappy passwords seem to be the two most common ways to get into Linux machines these days... just open port 22 and watch a million Chinese hackers testing out a bazillion ssh passwords on your machine.
If Windows actually supported SSH then it would be just as vulnerable.
IIRC, something like that has happened before. The attacker managed to get RDP access to one of Microsoft's servers where they keep source code. However, when authorities were able to trace the connection back to his house, they entered to find he had died of a simultaneous heart attack, aneurysm, and stroke, with the Windows kernel source code open on his screen.
The Internet has given stupid people the resources of intelligent people.
P.S. Of course if they were serious about security in the first place they wouldn't even allow logins with passwords and would require public key authentication instead.
http://lists.fedoraproject.org/pipermail/devel-announce/2011-January/000746.html
Summary: Fedora infrastructure intrusion but no impact on product integrity
On January 22, 2011 a Fedora contributor received an email from the Fedora Accounts System indicating that his account details had been changed. He contacted the Fedora Infrastructure Team indicating that he had received the email, but had not made changes to his FAS account. The Infrastructure Team immediately began investigating, and confirmed that the account had indeed been compromised.
At this time, the Infrastructure Team has evidence that indicates the account credentials were compromised externally, and that the Fedora Infrastructure was not subject to any code vulnerability or exploit.
The account in question was not a member of any sysadmin or Release Engineering groups. The following is a complete list of privileges on the account:
The Infrastructure Team took the following actions after being notified of the issue:
The attacker did not:
Based on the results of our investigation so far, we do not believe that any Fedora packages or other Fedora contributor accounts were affected by this compromise.
While the user in question had the ability to commit to Fedora SCM, the Infrastructure Team does not believe that the compromised account was used to do this, or cause any builds or updates in the Fedora build system. The Infrastructure Team believes that Fedora users are in no way threatened by this security breach and we have found no evidence that the compromise extended beyond this single account.
As always, Fedora packagers are recommended to regularly review commits to their packages and report any suspicious activity that they notice.
Fedora contributors are strongly encouraged to choose a strong FAS password. Contributors should *NOT* use their FAS password on any other websites or user accounts. If you receive an email from FAS notifying you of changes to your account that you did not make, please contact the Fedora Infrastructure team immediately via admin@fedoraproject.org.
We are still performing a more in-depth investigation and security audit and we will post again if there are any material changes to our understanding.
--
Jared Smith
Fedora Project Leader
You can't have my Fancy Fedora. :|
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
Exactly. For example, any machines I have which have to have an Internet facing ssh port are definitely not going to be accepting passwords. Tools like ssh-guard are nice, but it isn't hard for a determined attacker to just keep coming from different IP ranges. To add a little bit of security, port knocking is a nice ability to have, just so an attacker doesn't see an open port to start having fun with.
What would be ideal is if OATH support would advance to the point where I can just enter my username, then my password and then the random key from a SecurID or other token. This way, an attacker would have to go from passively looking at passwords as they float by to actively MITM-ing the connection.
Careful what you wish for. They could permanently fuse that damn paperclip to the desktop.
I read TFA and all I got was this lousy cookie
Yeah, turns out the mercury used was driving the hatters mad.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
My first thought was "How will Bogart cope with a compromised fedora infrastructure?!"
Then I remembered Bogart was dead.
Then I remembered Fedora is a Linux distro.
"The Infrastructure Team took the following actions after being notified of the issue:
1. Lock down access to the compromised account
2. Take filesystem snapshots of all systems the account had access to
(pkgs.fedoraproject.org, fedorapeople.org)
3. Audit SSH, FAS, Git, and Koji logs from the time of compromise to the present
Here, we found that the attacker did:
* Change the account's SSH key in FAS
* Login to fedorapeople.org
The attacker did not:
* Push any changes to the Fedora SCM or access pkgs.fedoraproject.org in any way
* Generate a koji cert or perform any builds
* Push any package updates .."
I only recently discovered what the hell does "fedora" mean apart from a Linux distro.
You encountered a red fedora?
CC.
TaijiQuan (Huang, 5 loosenings)
I will be releasing Fedora 15 Desktop Edition next week. Standby for download links.
Nah, MS uses Team Foundation Server for all of their version control. I have not ever met another single person or company that also uses TFS, nor have I really seen any good documentation on how to use it.
or someone made the social-engineering mistake of registering at another site with an email address, and then using the same password at that site as the login for their email address (and in this case, the rest of their fedora resources) uses....ie, could have been an extremely good password. If I have a random 400 character password and then post it on a public internet page, it's not the password that is weak.
to find he had died of a simultaneous heart attack, aneurysm, and stroke, with the Windows kernel source code open on his screen.
And people say that it's selfish of MS to keep it to themselves...
If you compromised an account, why would you change the key, an action that would quite likely trigger some sort of alert (as it did). Wouldn't you just silently look around until you knew what you wanted to do with it and then do all your damage at once before they could cut you off?
Are you sure he didn't die laughing?
Any insufficiently advanced magic is indistinguishable from technology.
I only recently discovered what the hell does "fedora" mean apart from a Linux distro.
Red Hat Fedora
Apple MacIntosh (McIntosh Apples)
Sun SOLARis
There are a lot of plays on words out there in the tech field.
Are you sure he didn't die laughing?
That's an excellent alternative ending.
The Internet has given stupid people the resources of intelligent people.
Apple MacIntosh (McIntosh Apples)
Bonus points for noticing the difference in the spelling!
The web UI where one uploads SSH public keys, however, uses a password. It was that password that the attacker changed.
See also: weakest link.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Nah, if that was true, he would have installed Ubuntu on the system he compromised.