Slashdot Mirror
FreeBSD Project Discloses Security Breach Via Stolen SSH Key
An anonymous reader writes "Following recent compromises of the Linux kernel.org and Sourceforge, the FreeBSD Project is now reporting that several machines have been broken into. After a brief outage, ftp.FreeBSD.org and other services appear to be back. The project announcement states that some deprecated services (e.g., cvsup) may be removed rather than restored. Users are advised to check for packages downloaded between certain dates and replace them, although not because known trojans have been found, but rather because the project has not yet been able to confirm that they could not exist. Apparently initial access was via a stolen SSH key, but fortunately the project's clusters were partitioned so that the effects were limited. The announcement contains more detailed information — and we are left wondering, would proprietary companies that get broken into so forthcoming? Should they be?"
If you run on freebsd, examine your tar and tar.gz
Access via ssh key, someone may have changed the tree
If you only use base release, power down and anti-freeze
For package add post 9/16, SVN and confirm you're clean
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
I think you are on the wrong site. You probably need slashtroll.org.
and we are left wondering, would proprietary companies that get broken into so forthcoming?
I suspect most would not be so forthcoming.
Should they be?"
Yes.
Really do seem to know what they're doing, and are very proactive with their security.
I'm glad they openly announced this, how to deal with the breach for end-users, and also how they're dealing with it. (This coming from a proud FreeBSD server and desktop user)
(yes I use the Oxford comma.)
"...and we are left wondering, would proprietary companies that get broken into so forthcoming? Should they be?"
Short answer:
No, they do not want to scare the stockholders.
and... Yes, they should be because openness allows people to recover or protect themselves faster.
Silence is a state of mime.
...that any company which holds personally identifiable information (so that's all of them - it goes from CRM databases to employee records and payroll) has a Statutory obligation to register Company details with the Information Commissioner's Office and to report any breaches to the Information Commissioner.
For the definition of "breach", read: lost or stolen mobile phone, laptop, notepad, application or registration document, tablet, audio recording, video capture, or any other method, known or unknown, of recording personally identifiable information.
Operation Guillotine is in effect.
Whenever the topic of password security comes up, there's always a few people who will go on and on about how SSH keys are so much more secure than passwords.
Yet these people rarely acknowledge that SSH keys are basically no different than the old password-on-a-sticky-note-behind-the-monitor technique. In fact, SSH keys may even be worse, as they are already in a digital form ripe for stealing. Some of them even portray SSH keys as the solution to almost every authentication and security woe that exists.
I sincerely hope that these SSH key advocates take this incident as a humbling experience. I hope they realize that the claims they're making just aren't valid. Perhaps the smart ones will apologize for their past transgressions, and will vow not to spread their nonsense in the future.
The FreeBSD developers are among the best there have ever been. They know software and computer security inside and out. But if something like this can happen to one of them, it can happen far more easily to any lesser computer user.
So, please, SSH key advocates, take this as a lesson. Let some good come out of it, and mend your ways. Please.
Time to go to hardware keys such as eToken for SSH authentication.
http://www.howtogeek.com/121650/how-to-secure-ssh-with-google-authenticators-two-factor-authentication/
No matter how secure your system is (and SSH is very secure), if the individual using it is careless, the system will end up getting compromized.
Why would you use a stolen SSH key to announce a security breach?
Although this is a troll, there still is an unanswered question: how did the ssh key get stolen? While its nice to see that FreeBSD wasn't breached due to a vulnerability in *its* systems, someone obviously had a vulnerability in their system. To all the sysadmins out there, I think that's what keeps you up at night: How do you ensure that your users safeguard their secrets? Other than a "corporate policy" document imploring them to use "good judgement"?
Especially with BYOD coming into vogue, I think the security community needs to come up with a solution that is cross platform and easy to implement, verify and enforce.
Well.. maybe. Or Maybe not. But Definitely not sort of.
And so, when Microsoft gets raped by a bunch of hackers you think they are going to let the public know?
No, they are going to keep it under wraps.
No, they are *not* going to keep it under wraps, at least not if the break-in puts its users or customers at risk.
The reason is simple: Microsoft is required by law to disclose any such breach. The penalties for "keeping it under wraps" are severe and could include paying restitution/punitive damages to each individual customers/user.
But don't let such minor detail stand in the way of spewing your MHD all over slashdot.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
would proprietary companies that get broken into so forthcoming? Should they be?
Yes, they are already required to
BTW, have we ever seen a satisfying explanation for what happened at kernel.org and linuxfoundation.org? We were initially told that it was something similar (stolen password/compromised user system), but AFAICT they have never explained how that could lead to the servers being root'ed. A rootkit *was* installed. That requires careless use of root privileges or an exploit of a privilege escalation vulnerability. Which was it?
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
No, we are not left wondering (unless one thinks that FreeBSD has a patent on especially leaky SSH developer keys) so instead we pretend that we are left wondering to justify hanging around and scribbling on the bathroom wall.
If Apple can't keep their mitts on an iPhone prototype and Google can't keep their mitts on a Nexus prototype, do you really think these butter-finger organizations have any better control over their developer's SSH keys?
I haven't seen any official response, only some unofficial assertions that about compromised user credentials.
I agree, everybody should get paid for their IPs. It's only fair damnit.
Fighting Common Cold with Malaria or what ??
A shitcorp named "RSA Security" demonstrated why hardware PW generators should be avoided like the plague. Unsound concept, unsound practices, security by obscurity. Chicom stole their balls and then pissed into Lockmart's face. Yeah, Lockmart of F35 infamousness.
5 million bucks if you use that Crapware. 50 bucks if you take the effort to use a proper pw and write it on a piece of paper you store in your purse. And all the variants of that down to one-time-password lists.
Why the fuck should anyone trust in an opaque piece of crapware made by a greedy slimbag corporation ??
[t]here still is an unanswered question: how did the ssh key get stolen? While its nice to see that FreeBSD wasn't breached due to a vulnerability in *its* systems, someone obviously had a vulnerability in their system.
The explanation is simple enough, and provided on the compromise notice:
The compromise is believed to have occurred due to the leak of an SSH key from a developer who legitimately had access to the machines in question, and was not due to any vulnerability or code exploit within FreeBSD.
It only takes one instance of walking away from your workstation leaving it running to have a co-worker slip into your chair and email your .ssh directory to some obscure off shore email address, then remove the outgoing email from the "sent" list. A stolen phone, a purloined laptop, the possibilities are endless, although in the latter two instances you would expect revocations to be issued (assuming you had a backup copy somewhere)..
Once someone has your private key they ARE you, and it it was done without being immediately discovered, the key could linger in the wild for months or years.
Sig Battery depleted. Reverting to safe mode.
..because the crap-generator will be broken and Chicom will pilfer your intranet for 5 million worth of R&D data.
O RLY?
You probably should have read this...
"requiring notice to individuals when the security of their personal information has been compromised"
Those laws have nothing to do with a security breach of this sort if their own personal information isn't stored on the machine as well and in this context, the only people who would be notified **might** be the people writing the code. .
You're exactly the kind of person that the GP is talking about. People like you say that passwords are a horrible thing, should never be used, and that the only solution is ssh keys. Then when the security issues surrounding ssh keys are pointed out, you tote passwords as the answer! Lordy, lordy, lordy! Make up your mind!
Ad hominem attacks are in bad form but you, truly, are an idiot. Fairly young too, I'd bet.
LMAO!!! Microsoft following the law because here are potentially serious fines. Where have you been for the past 30 years?
Freud might say that Intelligent Design is religion's ID.
This is BSD, not Linux, tard.
and you makes 6.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
Main difference between the BSD license and the GPL license: one is from California and the other is from Massachusetts
This is a very good point. One dumbass user who doesn't keep a passphrase on his private key, doesn't encrypt his hard drive, etc. and bam, you get hosed.
If you're on a current OpenSSH (as available in Red Hat 6.3 at least, or its rebuilds like Scientific Linux or CentOS), you can require both key and password auth. From the release notes at https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Enterprise_Linux/6/html-single/6.3_Release_Notes/index.html#id3199604: /etc/ssh/sshd_config file to specify authentications that are required for a successful log in."
"SSH can now be set up to require multiple ways of authentication (whereas previously SSH allowed multiple ways of authentication of which only one was required for a successful login); for example, logging in to an SSH-enabled machine requires both a passphrase and a public key to be entered. The RequiredAuthentications1 and RequiredAuthentications2 options can be configured in the
To implement on an SSH server where only SSH protocol 2 is allowed, drop this in your /etc/ssh/sshd_config:
RequiredAuthentications2 publickey,password
You need to specify PasswordAuthentication yes as well, or you'll be told: "Invalid required authentication list"
Once you set it up, restart your sshd daemon, and you will be good to go.
Nothing's foolproof however, and I mean that in the literal sense of the word "foolproof". Some fool can store his password in plain text on the same system as his key, write his password on his computer in Magic Marker or whatever, and you're screwed again. Allowing SSH access to morons is a major security hole.
In Reason We Trust
"Once someone has your private key they ARE you"
Only if you're such an idiot that you don't passphrase protect your private key.
In Reason We Trust
It's all security theater anyway :-P
-Linus