Slashdot Mirror
Two FreeBSD Project Servers Hacked
hypnosec writes "The FreeBSD project has suffered a security breach. Hackers have successfully compromised servers that were part of the infrastructure used to build third-party software packages. The Security team over at the FreeBSD project is of the opinion that hackers were able to gain access to the servers using legitimate SSH keys and not by exploiting any operating system vulnerabilities. Instances of intrusion were first detected on November 11. FreeBSD project, through a message on public announcements mailing list said that the security breach hasn't affected the project's core components like kernel or system libraries but, has affected third-party software packages being distributed by the project."
This was already submitted two days ago.
New article link merely references the material already posted by freebsd on Nov 17th.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
Posted by timothy on Saturday November 17, @09:22AM
from the happy-transparency dept.
Probably someone left the keys in a bar in San Francisco. Isn't that the way it works these days?
"Only two remote holes in the default install, in a heck of a long time!"
A security breech using legitimate authentication credentials is not a remote hole.
Its as easy as simply running a dictionary attack.
You can't tell a pasphrase protected private key from an unprotected one. Both are gibberish. You would never know when you
decoded it correctly unless you try to use it.
Each dictionary attack attempt will have to be tried via an attempted log in to either the target site or a replicate there of.
But, hey, we are all ears if you have a better method. People have only been looking for one for something like 20 years. You can be a hero.
Sig Battery depleted. Reverting to safe mode.
And the worst: They stole all the source code and pirated BSD!!!!
There are two rules for success:
1. Never tell everything you know.
Linux, Windows, OS X, and Solaris all use the BSD SSL code, or very close derivations of it. If the BSD coders are lazy, then the coders responsible for the above-mentioned OSs are even worse, right?