Slashdot Mirror

← Back to Stories (view on slashdot.org)

Linux Foundation, Linux.com Sites Down To Fix Security Breach

Posted by timothy on from the bringing-back-spanking-might-help dept.

An anonymous reader writes "All Linux Foundation sites seem to be down due to a security breach, which occured on 8 sep. (according to a notice displayed on the site)." From the email I received this morning, sent to all Linux.com and LinuxFoundation.org users: "On September 8, 2011, we discovered a security breach that may have compromised your username, password, email address and other information you have given to us. We believe this breach was connected to the intrusion on kernel.org. As with any intrusion and as a matter of caution, you should consider the passwords and SSH keys that you have used on these sites compromised. ... We have taken all Linux Foundation servers offline to do complete re-installs. Linux Foundation services will be put back up as they become available. We are working around the clock to expedite this process and are working with authorities in the United States and in Europe to assist with the investigation."

101 comments

  1. SSH keys? by betterunixthanunix · · Score: 2

    Uh...isn't the point of using public keys that you do not have to keep them secret to remain secure? If people uploaded their public keys to the compromised systems...how is that a problem?

    --
    Palm trees and 8
    1. Re:SSH keys? by smash · · Score: 1

      Ahh, but if you were a dumb ass and placed your private key for linux.org on say, kernel.org (to log into one from the other), then if kernel.org got hacked, your key is gone.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    2. Re:SSH keys? by maswan · · Score: 1

      It is an unfortunately common case that people copy/create private ssh keys on servers to login (or scp) from those to another remote host. These keys are of course compromised.

    3. Re:SSH keys? by kestasjk · · Score: 1

      Why would you do that?.. Usually people sacrifice security for convenience, but that is less convenient..

      --
      // MD_Update(&m,buf,j);
    4. Re:SSH keys? by Anonymous Coward · · Score: 1

      Dumbass is right. That's why OpenSSH has agents (and the ssh agent does NOT expose your key, it does all crypto and returns just the result). SSH private keys should NEVER leave your own box. You don't reuse openssh keys, either. It is one private key pair per host.

      That would not have saved HPA's keys since his laptop was the entrypoint of the kernel.org breach, but if some people were not lazy assholes, there wouldn't be any private keys on kernel.org, except for some automated tasks (which have to be immediately revoked).

      Also, you NEVER "hop-jump" SSH, even when using an agent: you do port forwarding through that host instead. If you do "ssh hop-jumping", a compromised system can record anything you type inside that ssh session, such as root passwords. This is exactly why the openssh server and clients were trojaned in kernel.org (and probably linux*.com).

    5. Re:SSH keys? by Anonymous Coward · · Score: 0

      It is an unfortunately common case that people copy/create private ssh keys on servers to login (or scp) from those to another remote host. These keys are of course compromised.

      What is wrong with using private keys from a server? It is not uncommon that servers need to talk to each other or even are only reachable from each other; in which case private SSH key on the first server makes perfect sense, right?

      (obviously, policy should be to never copy your private keys, but run keygen on each client (including the server-turned-ssh-client) and mark them on all other servers with an intelligble mark so they can be removed from authorized_keys as needed.

      I don't see why having private keys on a server would be less secure than having these on your laptop/phone, which is much easier to steal or borrow...

    6. Re:SSH keys? by dbrian1 · · Score: 2

      I don't see why having private keys on a server would be less secure than having these on your laptop/phone, which is much easier to steal or borrow...

      My laptop is only vulnerable to theft by people I am in physical contact with and is generally my responsibly to secure while connected to the Internet. Placing SSH keys on a server means I'm giving these keys and any access they grant to the admins of said server and am placing my trust in them to keep them secure. This is fine for automated trust relationships between hosts but not generally a good idea for personal keys.

    7. Re:SSH keys? by maswan · · Score: 1

      Well, you'd still need keys on your laptop to get to the server. So now you have two places where your keys can be stolen and used to login everywhere you trust your keys.

      For the case where you actually do need direct communication between two servers you probably want to do agent forwarding instead of having more keys in your authorized_keys. Remember that every single entry there is a point of failure, and any one of them getting compromised means that your account is likely to get owned.

      Now there are special cases where having more keys is useful, but most of the time they just open up more vectors for someone to steal them and break into other computers.

      Of course, even then, they are better than passwords, at least if they have proper passphrases. Not too uncommon to see lots of passphrase-less keys in home directories on multi-user servers though.

    8. Re:SSH keys? by Anonymous Coward · · Score: 0

      Well since the server was compromised that means someone would have the private key(s) of the server. They could then set up their own ssh server using those keys combined with your public key would allow them to impersonate the real server.

      They could then gather your activity or whatever if you logged into it. Not as bad as compromising your private key but still something to think about.

    9. Re:SSH keys? by smash · · Score: 1

      Because you're a dumbass.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    10. Re:SSH keys? by buchner.johannes · · Score: 1

      It is an unfortunately common case that people copy/create private ssh keys on servers to login (or scp) from those to another remote host. These keys are of course compromised.

      There is no requirement to do that. You can just create a tunnel through the first server to the second (ssh -L). Then you connect to the tunnel port on localhost, and you never had to give away your private key. You're even safe if the server in the middle gets compromised.

      --
      NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
    11. Re:SSH keys? by ArsenneLupin · · Score: 1

      Why would you do that?

      Maybe in case you'd need to scp large files from linux.org to kernel.org and vice-versa, without having to first download them to your home machine, and then upload them to the target (slow, if you've got asymetric DSL)

      Of course, dumb users not aware of security implications is also a possible explanation (less likely though, as dumb users would probably not be aware of ssh authorized_keys in the first place...).

      In both cases, it is smart of the Linux Foundation to warn their users of this potential issue...

    12. Re:SSH keys? by ArsenneLupin · · Score: 1
      That being said, it's important to use a different private key on each machine where you might ssh from...

      However, in case of a compromise, you'd still need to remove trust in the private key of the impacted machine (so if kernel.org got hacked, you need to remove your old kernel.org's public key from your ~/.ssh/authorized_keys on linux.org)

      Also, if the hacker got kernel.org's /etc/ssh/ssh_host_rsa_key, then he could theoretically later on mount an MITM attack against kernel.org... so the kernel.org admins better change that one as well (while publishing the new key's fingerprint on an SSL server).

    13. Re:SSH keys? by doublebackslash · · Score: 1

      Why shouldn't I re-use my ssh keys? I'm pretty clear on all your other points so I assume that you've got a good reason for this. What is it?

      I feel that I may have mis-understood the proper use of SSH keys and would really like to know the attack vector here.

      --
      md5sum /boot/vmlinuz
      d41d8cd98f00b204e9800998ecf8427e /boot/vmlinuz
    14. Re:SSH keys? by Anonymous Coward · · Score: 0

      It would help to show most people how to do this:

      MACHINES:
      laptop, serverA, serverB - serverB is only accesible from serverA (for fun)

      laptop# ssh -L 7878:serverB:22 mydumbself@serverA

      then from another shell:
      # connecting to serverB
      lapop# ssh -p 7878 mydumbself@localhost

      This quickly becomes annoying because of localhost's key constantly changing. Automate it like this in ~/.ssh/config
      host serverA
          hostname serverA
          localforward 7878 serverB:22
      host serverB
          hostname localhost
          hostkeyalias serverB
          port 7878

      Now:
      laptop# ssh serverA

      and then:
      laptop# ssh serverB

    15. Re:SSH keys? by rastos1 · · Score: 1

      Maybe in case you'd need to scp large files from linux.org to kernel.org and vice-versa, without having to first download them to your home machine, and then upload them to the target (slow, if you've got asymetric DSL)

      That's why there is -A option for ssh.

    16. Re:SSH keys? by Anonymous Coward · · Score: 0

      The server's host keys may be compromised.

    17. Re:SSH keys? by Anonymous Coward · · Score: 0

      There is also no *requirement* to passphrase protect, your SSH keys, nor any requirement *not* to be lazy and store your keys on your server instead of on a more secure local environment So people will do so out of sheer laziness, and ignorance, and the belief that they can "trust the machine they're working on"

      The last time I raised that as a fundamental problem with SSH and suggested that ssh-keygen at least not allow passphrase free keys by default, Theo de Raadt called me names on the mailing list for questioning the underlying decisions of OpenBSD and OpenSSH maintainers. They are stuck in a dangerous mindset, one where they run OpenBSD, the "most secure operating system in the world", therefore the human stupidities of passphrase free keys and hitting "yes" when presented with an unknown hostkey are ignored, and the simple vulnerability of a backup tape or an admin who steals user's keys is simply ignored. They should *stop* playing games with making special, unique, and non-portable hooks to segment off tiny chunks of the operation environment to more secure structures, as they did with OpenSSH 5.9 and with previous "privsep" changes, and *pay attention to basics* such as private key management. Having the best lock in the world is useless when you put a hook on the lock marked "hang the key here!!!!" they way they do with passphrase free key handling.

    18. Re:SSH keys? by ttong · · Score: 1

      I once had a co-worker who was as stupid to do that, so I immediately blacklisted his key on every machine on the corporate network and told him to generate a new one and keep the private part to himself. I sincerely hope any sane IT dept. will do the same in that event.

      It's almost as stupid as emailing the root password in the clear for the new dedicated server you've ordered. Mail me the host key fingerprint, I'll mail you my public key. How hard can it be?

    19. Re:SSH keys? by smash · · Score: 1

      Also - don't forget, if someone has your public key (and has compromised the server's key), they can impersonate the remote end and go for a man in the middle attack.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    20. Re:SSH keys? by doublebackslash · · Score: 1

      The statement that I was in disagreement with was "You don't reuse openssh keys, either. It is one private key pair per host."

      Bullshit unless there is something that I'm missing. Keep one private key / public key pair and use the public key on all things you want to access. Keep the private key private (read: in a private place, encrypted. As is traditional.)

      Is there some problem with re-using your public key on several servers? I think not.

      --
      md5sum /boot/vmlinuz
      d41d8cd98f00b204e9800998ecf8427e /boot/vmlinuz
    21. Re:SSH keys? by WindShadow · · Score: 1

      That being said, it's important to use a different private key on each machine where you might ssh from...

      Hell yes, and for key management sanity it is good to use a clear comment on keys so you know what they are for.

      However, in case of a compromise, you'd still need to remove trust in the private key of the impacted machine (so if kernel.org got hacked, you need to remove your old kernel.org's public key from your ~/.ssh/authorized_keys on linux.org)

      You also have to rebuild authorized_keys to check that no new or modified keys have been added. That would allow the hackers right back in at some future time. I keep a copy and cksum of authorized keys for every machine where I use keys, just so I can check. Yes, I'm paranoid.

      Also, if the hacker got kernel.org's /etc/ssh/ssh_host_rsa_key, then he could theoretically later on mount an MITM attack against kernel.org... so the kernel.org admins better change that one as well (while publishing the new key's fingerprint on an SSL server).

      I don't know if that's the case, but they could certainly set up a fake server if they have your public key and the server host keys. So generating a new host key pair is really required, forcing every user to change the key.

      What a mess!

    22. Re:SSH keys? by ttong · · Score: 1

      Yes, you are correct. Nothing wrong with the same public key on 100+ servers.

      Though I can also relate to having a separate key pair for internal servers and another for customer servers. That way, when you use an agent and unlock a key you don't unlock every server you ever have to manage anywhere. Especially when you have a multitude (say, 5 at max) of key pairs for that purpose.

    23. Re:SSH keys? by Anonymous Coward · · Score: 0

      Well that's very mature, phagget. How old are you?

    24. Re:SSH keys? by Anonymous Coward · · Score: 0

      From man ssh:

      Agent forwarding should be enabled with caution. Users with the
      ability to bypass file permissions on the remote host (for the
      agent's UNIX-domain socket) can access the local agent through
      the forwarded connection. An attacker cannot obtain key material
      from the agent, however they can perform operations on the keys
      that enable them to authenticate using the identities loaded into
      the agent.

  2. Inb4 OS Slapfight by idbeholda · · Score: 0, Troll

    Gentlemen, start your engines.

    1. Re:Inb4 OS Slapfight by Anonymous Coward · · Score: 0

      OP is not a troll. This and other 'hacks' are obvious attempts to destroy the infrastructure behind Linux. Since 'hackers' can't attack the installations out in the field themselves, their security is too good, they are searching for ways to poison the code that is being pushed as updates. Breaking into the centralized distribution is the first step in this process.

      Normally I would suspect M$ as bankrolling this, but these days I tend to think Apple. With all their cash I'm sure they can hire the best.

    2. Re:Inb4 OS Slapfight by HiThere · · Score: 1

      I don't see any reason to exonerate either of those, but you need to widen your focus. You should include numerous governments (or their agents, perhaps acting without authorization). You should also include groups of criminals, like the Russian Mafia. Then there's folks just out for lulz. etc.

      Some of these may be more likely than others, but don't narrow your focus too much. Not without reasonable evidence.

      --

      I think we've pushed this "anyone can grow up to be president" thing too far.
    3. Re:Inb4 OS Slapfight by smash · · Score: 1

      OP is not a troll. This and other 'hacks' are obvious attempts to destroy the infrastructure behind Linux.

      I wouldn't go that far. Sounds more like a few attacks on high profile public systems that just happen to host linux projects.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    4. Re:Inb4 OS Slapfight by Slashdot+Assistant · · Score: 0

      I'm glad we have this opportunity to compare Lunix against what else is out there. I don't doubt that more professional commercial systems can be hacked. What I think though is that seeing Linus erasing and reinstalling his servers is an example of how flawed Lunix is. There's just no way a Windows server with Norton could be compromised in this manner. Even if somehow a trojan virus did get through then I'd run Norton and a registry cleaner and everything would be back to normal. I haven't reinstalled Windows now for months, and apart from running a bit slow it's fine. My ISP claimed that there's unusual traffic coming from my servers - which I explained is probably virii bouncing off of Norton and my Fire Wall.

      Lunix users, you should think long and hard about your chosen operating system. If he's this disorganized then what are you going to do when you get sued for using a system proven to built on copyright and patent infringement? Sure you could try MAC (Lunix put in a shiny case). Neither Apple nor Linus will come to your rescue when you're sued for running patent and copyright infringing software. This will be unpopular with the mods but there is only one secure and legal option - Microsoft Windows with Norton.

    5. Re:Inb4 OS Slapfight by Anonymous Coward · · Score: 0

      There's just no way a Windows server with Norton could be compromised in this manner.

      A Windows server with Norton runs so slowly that you will probably upgrade to the next version of Windows before the malware completely installs, hence a clean system.

    6. Re:Inb4 OS Slapfight by priceslasher · · Score: 1

      You might also wonder if it is the new guy being incompetent or if someone has defected from within.

  3. More Info, and Announcement Content by LinuxScribe · · Score: 4, Informative

    A few more details of the breach, including the content of the message from the Linux Foundation, can be found on ITWorld.

    LinuxScribe

    1. Re:More Info, and Announcement Content by WindShadow · · Score: 1

      The information I really want to see is a statement clarifying this as either technical as in a failure of the security software somewhere, or administrative, as in someone left something open through error or poor security design choices.

      It's important to know if this is a bug which is on all Linux systems, or someone made a human error.

  4. Lucky by Anonymous Coward · · Score: 2, Interesting

    The attack that compromised some high-value servers belonging to kernel.org — but not the Linux kernel source code — may have been the work of hackers who simply got lucky and didn't realize the value of the servers that they had gotten their hands on.

    Sure.

  5. Connection? by CheShACat · · Score: 1

    First Kernel.org and now this? Has someone got it in for FLOSS at the moment?

    --
    CheShA: Manchester Breakcore / Drill and Bass Yes I'm a s
    1. Re:Connection? by Nerdfest · · Score: 1

      No, someone would like unrestricted, undetected access to make 'modifications' to the most popular server OS.

    2. Re:Connection? by doublebackslash · · Score: 1

      Those are just pubic facing servers, not the dev team's workflow boxes. However, even if they were their source code management tool, git, exposes every change made by anyone for all time. It is simply that nature of git. Check it out if you want details. Even if they didn't use git the maintainers and anyone with clean copies (per-breach) can simply run a diff on the source code vs any new "untrusted" copy they may see.

      Since they've made the breach public and the aforementioned steps to detect any modifications are trivial for anyone to perform (Linux is not mirrored on github, a public git repository and absolutely wonderful site) there is a very low risk to anyone and zero risk now.

      I'm not going to stand on a soap-box here but I'll just say this:any decent company or organization that is the victim of an attack such as this should have procedures and systems in place that render it as harmless as this one. Think of the impact of this hack compared to others in the recent past and near future. It might provide a wonderful 'dos and don'ts' guide

      --
      md5sum /boot/vmlinuz
      d41d8cd98f00b204e9800998ecf8427e /boot/vmlinuz
  6. These losers need to upgrade to Windows! by Anonymous Coward · · Score: 0

    FOSS FTL!

  7. Total Irony by adosch · · Score: 1, Offtopic

    I am not sure what is gained by breaking into, compromising and exploiting a foundation like The Linux Foundation when the perps were more than likely using a Linux driven OS and tools to do what they did. Seems like some need a re-education in not harming the hand that builds your house...

    1. Re:Total Irony by Anonymous Coward · · Score: 0

      Seems like someone needs a re-education about criminals, thieves, and bad guys in general. Giving someone a free OS does not turn that person into a free software advocate. It just means they have an OS now.

    2. Re:Total Irony by phoric · · Score: 1

      Follow the money. Who stands to gain from creating fear, uncertainty, and doubt surrounding Linux and it's related organizations?

    3. Re:Total Irony by Anonymous Coward · · Score: 1

      Follow the money. Who stands to gain from creating fear, uncertainty, and doubt surrounding Linux and it's related organizations?

      Exactly! The folks at BeOS!!!!

    4. Re:Total Irony by PNutts · · Score: 1

      Follow the money. Who stands to gain from creating fear, uncertainty, and doubt surrounding Linux and it's related organizations?

      Exactly! The folks at BeOS!!!!

      BeOtcheS. BeOtcheS love FUD.

  8. Re:Pro-hacker when I want by Stormthirst · · Score: 1

    Mod -1 Troll

    Seriously?

  9. Re:linux security is a joke by Stormthirst · · Score: 1

    Mod -1 Troll

    Learn to use the '. Oh no - you're right. You are Ill.

  10. Re:Pro-hacker when I want by Elbereth · · Score: 2

    Do you ever post anything other than instructions on how to mod other posts?

  11. This wouldn't have happened with OpenBSD! by Anonymous Coward · · Score: 1

    Having said that, reasonable people may conclude that the occasional security breach is an acceptable price to pay to avoid dealing with Theo. :-)

    1. Re:This wouldn't have happened with OpenBSD! by Anonymous Coward · · Score: 0

      ... but dealing with Linus in order to avoid Theo? *rolls eyes*

  12. This is the right way to do it by Pop69 · · Score: 2

    Not like when a CA gets its webserver compromised, has a quick self audit and then declares everything is OK, really, honest....

    Assume everything is compromised unless you can prove otherwise and get the staff in on overtime to reinstall from scratch.

    1. Re:This is the right way to do it by Anonymous Coward · · Score: 0

      I totally agree. They should get credit for being responsible.

    2. Re:This is the right way to do it by Anonymous Coward · · Score: 0

      Exactly what I came here to say.

      Nothing is perfect. There is no shame is something going wrong from time to time. The shame is in denying it and not learning from it.
      With the former, the server was untrustworthy for a time. With the latter, it will stay untrustworthy forever.

      About the overtime: No. I want them to have slept well, eaten well, and generally be mentally and emotionally at their best level, when working on doing it better this time!
      As a boss, I'd sell it positively: As a unique opportunity to learn and improve. And I'd offer rewards for improvements.
      Kicking your employees' asses and punishing them only works for dumb and spineless people. I don't know about you, but I don't hire such people in the first place. ^^

  13. hahahahah by Anonymous Coward · · Score: 0, Interesting

    ahahahaha. And dozens more where that came from.

    http://www.exploit-db.com/platform/?p=linux

    I wonder what would happen if slashdot ran a front page story for every single linux security bug like they do for windows.

    1. Re:hahahahah by Anonymous Coward · · Score: 0

      Unfortunately, Linux security is pretty pathetic these days, especially when you compare it to some of the more secure closed source operating systems (not OS X or Windows). Remote vulnerabilities are far too common, and the number of privlege escalation exploits is downright shameful.

    2. Re:hahahahah by aztracker1 · · Score: 1

      They don't post every Windows security bug. There tends to be a posts on automated exploits/worms/virii in the wild and major encroachments such as this. MS has a tendency, for better or worse, to patch security exploits in their regular release cycles, unless compromised by an automated exploit. MS has made some very poor security choices over the years in favor of their development cycles, and release schedules. Don't get me wrong, I happen to like a lot of things that have come out of MS, but that doesn't absolve them of anything.

      Today, just about the most unforgivable sin is not using parameterized queries with database access. It still happens though, and there's lots of cruft code out here written by those who didn't know any better. I would suspect there's more than a handful of areas in systems that weren't truly given a thorough code security audit. It happens, the best you can do is fix what you find, and handle known exploits in the most transparent, and expedient way possible.

      --
      Michael J. Ryan - tracker1.info
  14. Something's not right.... by Anonymous Coward · · Score: 0

    For years I've been told by /. trolls that Linux can't be hacked, only Windoze.

    1. Re:Something's not right.... by Anonymous Coward · · Score: 0

      For years you've misunderstood security. The most secure vault in all the world won't protect much if you leave the vault door wide open. If you're stupid enough to leave the door wide open and your valuables are compromised it says nothing about the relative security of the vault.

    2. Re:Something's not right.... by Anonymous Coward · · Score: 0

      For years you've misunderstood the trolls. Windows is bashed in every story regardless of the topic (Insecure by design). A Windows compromise is Windows flaw. A Linux compromise is a "dumb user" to quote someone above. Linux is touted to the unwashed as bulletproof. Well, guess what? You're right for the wrong reason. All you can do be is fully patched, take precautions, and make good decisions. The exploits are everywhere.

  15. Re:Pro-hacker when I want by Anonymous Coward · · Score: 0

    mod post insightful +1

  16. Fedora just pushed a kernel update.. by Anonymous Coward · · Score: 0

    Should I be concerned?

    I hate how the software log viewer doesn't show any information other than the package names. A history with the release notes for each update would be MUCH more useful.

    1. Re:Fedora just pushed a kernel update.. by inode_buddha · · Score: 1

      Try "rpm -qil "

      --
      C|N>K
  17. Breach on Linux=GASP! Breach on Win=meh by Anonymous Coward · · Score: 0

    Really people? No one criticizes the Linux Foundation for leaking who knows what to hackers, but if it happened on a Windows site or machine, suddenly, that's just laughable. As if they 'deserved' it for running a Windows server.

    Hypocrisy at its finest.

  18. Re:linux security is a joke by hcs_$reboot · · Score: 1

    Breaches: Linux 1, Windows 2317
    Still some margin...

    --
    Slashdot, fix the reply notifications... You won't get away with it...
  19. Linux fail security? by Ryanrule · · Score: 1

    Thats unpossible.

  20. SSH Keys Compromised? by swillden · · Score: 1

    How could an attacker getting hold of the public key "compromise" anything? It doesn't contain any personal information, and -- barring an earth-shattering breakthrough in cryptanalysis of RSA (or DSA, if you chose a DSA key pair) -- it can't be used to gain access to anything, not even the system it was stolen from.

    That's the whole point of using asymmetric cryptography for authentication!

    --
    Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    1. Re:SSH Keys Compromised? by smash · · Score: 1

      You're assuming only public keys were compromised. If they had private keys enabling login to other hosts stored on said systems (yes, retarded, but...) then those keys are compromised.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
    2. Re:SSH Keys Compromised? by swillden · · Score: 1

      You're assuming only public keys were compromised. If they had private keys enabling login to other hosts stored on said systems (yes, retarded, but...) then those keys are compromised.

      A little more than retarded... in order for someone to do that they'd have to have never heard of ssh-agent.

      --
      Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
    3. Re:SSH Keys Compromised? by Antique+Geekmeister · · Score: 1

      ssh-agent leaves an active and unlocked ssh-key available on the relevant server. Many of my colleagues refuse to run their ssh-agent as part of their own persoanl host's working environment, and prefer to host them on their most used server, despite my warnings. Others find ssh-agent burdensome and simply use passphrase-free keys, and there is not yet any graceful way to prevent that except to audit for them on the client hosts, which is awkward and intrusive.

    4. Re:ssh keys compromised? by Alex+Belits · · Score: 1

      THEIR host keys and everything that can be decrypted using those keys.

      --
      Contrary to the popular belief, there indeed is no God.
    5. Re:ssh keys compromised? by Anonymous Coward · · Score: 0

      I read it as ssh keys you stored on the site. If you put your private keys out there, they might be more out there than you wanted.

  21. Hardware??? by Anonymous Coward · · Score: 0

    I hope they are using all new hardware too! Hardware rootkits, though unlikely, are too great a risk for something so critical.

  22. Re:linux security is a joke by Anonymous Coward · · Score: 0

    Linux 1? Have you heard about bug reports, patches, updates and that stuff on Linux?

  23. You don't get it. by Anonymous Coward · · Score: 1

    You don't get it. The difference is Microsoft is a giant multi-billion dollar corporate machine with an insane marketting and advertising arm that helps them get into places that Linux simply can't because of lack of finances. If a well-funded corporation slips up its schadenfreude because 'even with all that' they still couldn't get it right. While Linux enjoys SOME corporate backing, its still largely a labour of love by independant developers. Most people side with the little guy. ;-)

     

    1. Re:You don't get it. by cavreader · · Score: 1

      Linux enjoys more than SOME corporate backing. Look at the shear number of web servers and all of the Linux derived operating systems currently being used in the mobile device market and you will see quite a few big corporations supporting the platform even if they don't distribute their applications or make their changes available to the OS community. Your little guy labor of love argument disappeared about 10 years ago.

    2. Re:You don't get it. by Anonymous Coward · · Score: 0

      Yeah people use linux, but how many pay for its development (other than a few main projects like the kernel)? I was talking about the development part. The development of the vast majority of tools that come with a typical desktop linux distro is done by developers for free.

    3. Re:You don't get it. by Anonymous Coward · · Score: 0

      Nope. Basically everything that's not complete garbage is developed and maintained by Redhat, SUSE, IBM, Google etc.

    4. Re:You don't get it. by kiwimate · · Score: 1

      I think you're the one who doesn't get it. Linux is ubiquitous, and has been for several years, in the enterprise server world. Granted, the post you responded to was a bit of a troll, but you've missed an important point.

      You can bark all you like about the marketing strength of Microsoft, but the CSO doesn't much care about marketing if the FBI comes visiting because you just self reported a hack and your company is an enormous financial institution, has millions of health records on file, or is part of the critical infrastructure.

      Whatever the reality of who is behind Linux, the end user isn't going to be swayed by an argument that boils down to "people shouldn't hack us because, wow, golly gee, Linux is the show we can put on in our own back yard, mister". And all the arguments about costs aren't that strong; the licensing costs are obviously in favor of Linux, but the support costs are usually about the same between deploying Microsoft and deploying Red Hat.

      I know it's conventional on Slashdot to run down the stereotypical technically illiterate bean counter with an MBA, but my experience has been that most companies have fairly hard nosed and at least somewhat technically astute people in positions of responsibility. They may not understand the ins and outs of SQL injection, but they are going to be less than receptive to the argument that "people won't hack us on Linux; it'd be rude".

  24. corporate espionage? by Anonymous Coward · · Score: 0

    Just some speculation, but I haven't seen anyone talking about the elephant in the room: Just who would stand to profit from manufacturing FUD surrounding Linux as a result of security breaches? A large software company comes to mind, one that happens to have a very outspoken hatred of free software.

    1. Re:corporate espionage? by smash · · Score: 1

      ...And, here's your hat.

      Microsoft doesn't need to resort to this sort of thing to demonstrably kick linux's arse in the market place (i've been waiting for year of the linux / unix desktop since 1995).

      More likely, its some random spammer / organised crime group looking for either a well connected site to launch DDOS from, or to insert malware into the linux kernel for spambot purposes.

      Or a script kiddie doing it for bragging rights.

      --
      I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  25. Re:linux security is a joke by smash · · Score: 1

    No OS is secure. Take precautions. Having random members of the public from around the world with abilities to get shell access on your systems makes it hard.

    --
    I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
  26. The Joker In The Deck by westlake · · Score: 1

    I haven't seen anyone talking about the elephant in the room: Just who would stand to profit from manufacturing FUD surrounding Linux as a result of security breaches?

    Alfred Pennyworth: A long time ago, I was in Burma...working for the local government. ... One day I saw a child playing with a ruby the size of a tangerine. The bandit had been throwing them away.

    Bruce Wayne: Then why steal them?

    Alfred Pennyworth: Because he thought it was good sport. Because some men aren't looking for anything logical, like money. They can't be bought, bullied, reasoned or negotiated with. Some men just want to watch the world burn.

  27. Obvious Troll... by Anonymous Coward · · Score: 0

    ...is a bit fucking obvious.

    1. Re:Obvious Troll... by Slashdot+Assistant · · Score: 1

      Surely not! What gave me away?

  28. Security? by Anonymous Coward · · Score: 0

    Some of these open source people should really put some work in to the security side of this linux thing.

  29. Re:linux security is a joke by Anonymous Coward · · Score: 0

    Same here! It's not worth the risk of using software that has opened its source so that every hacker out there can find it vulnerabilities. How do we know that Linux can be trusted? It's developed by a foreigner who could be a socialist like Wiki Leaks. We don't trust Catholics and their foreign masters so why do we trust Linux?

  30. ssh keys compromised? by madbavarian · · Score: 1

    "you should consider the passwords and SSH keys that you have used on these sites compromised."

    How the heck can ssh keys compromised by this breakin? Doesn't the site just have access to the developer's public key? With a sufficiently large ssh key (say 1k or 2k) how is anyone going to derive the ssh private key from the public key? The fact that if is effectively impossible is supposed to be the whole point of public key encryption.

  31. Re:linux security is a joke by PNutts · · Score: 1

    Breaches: Linux 1, Windows 2317

    That's the problem. Complacency? Ignorance? Denial? Or just another bash on Windows?

  32. Re:linux security is a joke by hcs_$reboot · · Score: 1

    That's the problem. Complacency? Ignorance? Denial? Or just another bash on Windows?

    Bash on Linux, actually.

    --
    Slashdot, fix the reply notifications... You won't get away with it...
  33. Re:What a CROCK OF CRAP (you're off)... by br4nd0nh3at · · Score: 0

    I'm new to Linux, and have become quite worried with Linux security.

    Looking at your post, I went to the links you provided.
    http://secunia.com/advisories/product/6436/?task=statistics_2011

    Scrolling down reveals this:
    "PLEASE NOTE: The statistics provided should NOT be used to compare the overall security of products against one another. It is IMPORTANT to understand what the below comments mean when using the statistics, especially when using the statistics to compare the vulnerability aspects of different products."

    If you continue reading it goes goes into further detail.

    Then I look at these pages
    http://secunia.com/advisories/product/27467/
    http://secunia.com/advisories/product/2719/?task=advisories

    This supports your comment.

    Can you explain this?

  34. Mitigation plan? by Anonymous Coward · · Score: 0

    The question is did they have one?

    Now Linux system administrators are being asked to put their money where their mouth is, as to say.
    Personally, I wouldn't trust GIT or the developers. For example:

    1. How many times have developers overwritten their work because of a severe mistake?

    2. Can GIT seriously backtrack to a date prior to the supposed date the hack took place?

    3. Are the developers and system administrators going to invest the time to check all the changes for all the kernels for at least 90 days?

    Maybe you all trust Linux kernel source now. But I sure as hell don't.

    I'm going back to an unpatched Slackware and old ass Ubuntu.

  35. Answer 2 questions first by Anonymous Coward · · Score: 0

    1.) Can you explain why Linux has more unpatched security vulnerabilities in its KERNEL ALONE (minus all the rest of what goes into a Linux distro mind you) than does nearly ALL of what Microsoft gives folks to do business & development with (by 4x as many unpatched security vulnerabilities, which would be MORE if all of a Linux distro was shown, not just the kernel's problems there alone)?

    2.) Why does the LAMP stack show that it's being abused in said security vulnerabilities from a valid report, than does Windows Server 2008, IIS7, SQLServer 2008, & Visual Studio 2010??

    * "Argue with the numbers..."

    APK

    P.S.=> Why is that (on both accounts above)??? Even despite all those "Open SORES eyes" allegedly poring over LAMP's code no less (Most of whom couldn't code to SAVE THEIR OWN LIVES)???? apk

  36. Re:What a CROCK OF CRAP (you're off)... by Anonymous Coward · · Score: 0

    http://linux.slashdot.org/story/11/08/31/2321232/Kernelorg-Compromised

    You should be worried. Look at that.

  37. OMG OMG by Anonymous Coward · · Score: 0

    OMG OMG so Linux is not secure? Oooppps!

  38. Thus hacks Zarathustra by Anonymous Coward · · Score: 0

    In London horse bureaus betting already started that the Linux.com perpetrator is the iranian IchSunX2 aka. the "1000 talent" hacker of Comodo fame, it now stands at 1:2.5. It is of regret to note that bets quickly fell to 1:7 regarding his longevity beyond the end of 2011, after he openly threatened Israel in the latest Pastebin rant on Friday.

    (You can bet money on everything in London, not just horse races, but the number of Raspberrys which Emmerich will win next time or the number of days the newly appointed japanese PM spends in office before stepping down, etc.)

  39. a sure sign by Anonymous Coward · · Score: 0

    linux is mainstream

  40. ANDROID shows the "security-WEAK" of Linux by Anonymous Coward · · Score: 0

    Android (a Linux variant) shows Linux's "True Colors": It's less secure than Windows is. The "security-by-obscurity" (lack of users vs. those using Windows) advantage that Linux has enjoyed faded as an excuse to say "Linux is more secure than Windows is" with the advent of Android's malware explosion as well. No, the lines of pure bullshit you see from the "FUD" spreaders in the "Pro-Penguin camp" have been shown to all what they are: Bullshit artists. Wait until (IF ever) Linux gets more market-share - watch it become "Shredded Wheat" even more than Android's showing it to be, because then? Then, it will become attractive to malware-makers & such (but then again, I've been hearing "this is the year of Linux" for what? Nearly 20 yrs. now?? Funny, that year never comes eh??? Might as well say "The 12th of never when the clock strikes 13").