Slashdot Mirror
SourceForge Down After Attack [Updated]
Animats writes "SourceForge, a hosting site for many open source projects, is down today. Management claims they were attacked: 'We detected a direct targeted attack that resulted in an exploit of several SourceForge.net servers, and have proactively shut down a handful of developer centric services to safeguard data and protect the majority of our services.' Currently, CVS and SVN access to source code, even for reading, is unavailable, and there is no announced restoration time." (SourceForge and Slashdot are both part of Geeknet, Inc.) Update: 01/27 22:17 GMT by T : Mark Ramm of SourceForge contributes an update and some clarification: the site is up, and SVN is available, though CVS isn't. There's also a follow-up post on the site's blog.
Now who would go and attack SourceForge? Microsoft? Oracle?
I just don't see why anyone would target an OSS repository.
One hopes they have checksums when they come back up to make sure people have slipped shit in.
What the hell did sourceforge ever do to anyone?
I guess this could have been an attempt to spread some malware or something (by poisoning popular projects)?
Off topic: how many people actually download directly from sourceforge any more. I have to imagine the majority of users (even before the mass ubuntu influx) get their stuff second hand through their favorite distro’s repository these days. I know I haven’t been there with any regularity since my `ol slackware days *tugs pants up past waist*.
Whoever you are, out there, you're not a clever geek, you're just an asshole.
Do not mock my vision of impractical footwear
Because it's a high-profile site, and presumably staffed by people who know what they are doing? Eg., for the kicks?
Emotions! In your brain!
Possibly a misdirection and general smoke and mirrors technique but I doubt it... Could be that they hit the wrong IP... network order error and it was 60.181.34.216 that is inside China that was the true target and not sourceforge.
Now with that IP one could glean some more info WHY an attack was necessary.... and so on.
That was my thought. Everyone talks about how OSS is so secure. If you had a bone to pick with that notion, why not go over one of the highest profile examples of OSS? I'm sure that they're running Apache, right? Probably MySQL too? Surely they aren't hosting their sight on IIS and powering it with Asp.Net, are they?
It would be great if situations like this brought the entire computer using community closer together. The reality is that no matter how epicly great your software might be, there are people out there looking to bring it down. It doesn't matter if you run Microsoft, Apple or OSS. There are bugs in your applications and there are incentives for finding and exploiting those bugs.
Since they took down SFTP access, presumably someone got their hands on passwords/the password database.
Emotions! In your brain!
Good thing Slashdot is still up and running!
Unless... it was replaced with an impostor with some bad design decisions!
http://www.exploit-db.com/papers/15823/
You would think that the authors of Ettercap, one of the most popular
whitehat pentesting tools, would know the basics of security.
Apparently they don't, or they just don't give a shit about what
happens to their users.
So, why is their website so insecure? Ettercap's message board is
hosted at Sourceforge, so they share a server with thousands of other
customers. Every single customer is able to execute commands and
access the other project directories. Pretty stupid, eh? You only need
to find one hole in one hosted site and you can access ALL the project
databases. Of course that isn't ALoR's fault, it's Sourceforge's
fault. Regardless, people who care about security and data integrity
wouldn't use such a shitty provider, would they?
Site seems to be up and working fine for me. All the way through to downloading code and executables.
This was posted on Full Disclosure 4 days ago. http://seclists.org/fulldisclosure/2011/Jan/424
Seems they left the backdoor open even after being notified.
It isn't hyperbole when it is trotted out time and time again as one of the benefits of OSS. Stability and Security are two of the corner stones that OSS advocates build their arguments against "closed source" on top of. Some of the others are cost and portability of data.
To say that "nobody" has claimed that Apache is best ever is just as extreme of a statement as the original one I made about "everybody" talking about how secure OSS is.
I think for some projects, Linus' Law does apply -at least, it makes sense- but it obviously doesn't mean any OSS code is perfectly secure nor even that the average OSS project is more secure than proprietary code.
But I don't see how a single attack on SF proves anything; you'd have to make a study across a statistically valid sample of projects to determine if, eliminated all other variables, OSS code has or nor a better track record.
Dilbert RSS feed
A study using proper sampling wouldn't necessarily mean anything, either.
Software project A could have more vulnerabilities than project B. If attackers are more interested in B for some reason, maybe it's more popular or the sites running it are more interesting, B could have more "discovered" vulnerabilities.
A correct study would have to pay someone to do a thorough security audit of source code for n major open source and closed source software projects, which would be extremely expensive, and getting that many NDAs from major closed-source companies would be difficult.
Only a government or some large corporation could pay for that. I think I recall reading that simply doing a FIPS validation of openssl (or was it mozilla's nss?) would have cost around 1-2 million dollars if they hadn't been an open source project and had free help from various entities. And FIPS certification is a functional audit, not a security audit.