Slashdot Mirror
Gentoo Linux Github Organization Repo Hack Was Down To a Series of Security Mistakes (betanews.com)
The team behind Gentoo Linux has revealed the reasons for the recent hack of its GitHub organization account. The short version: shoddy security. From a report: It seems that the hackers were able to gain access to the GitHub organization account by using the password of one of the organization administrators. By the team's own admission, poor security meant that the password was easy to guess. As the Register points out, "only luck limited the damage," but the Gentoo Linux team is keen to let it be known that it has learned a lot from the incident. In an entry on the Gentoo Linux wiki, there is a fairly detailed breakdown of what happened, how it happened, and what is being done to prevent it from happening again. The wiki entry summarizes the hack attack as follows: "An unknown entity gained control of an admin account for the Gentoo GitHub Organization and removed all access to the organization (and its repositories) from Gentoo developers. They then proceeded to make various changes to content. Gentoo Developers & Infrastructure escalated to GitHub support and the Gentoo Organization was frozen by GitHub staff. Gentoo has regained control of the Gentoo GitHub Organization and has reverted the bad commits and defaced content."
Love, sex, secret, god... Or emerge?
New password: 1234567!
Not using Two factor? Even with a weak password, 2FA helps immensely.
... again. Call me crazy, but git is right up there with Linux itself in terms of advancing the art.
"We receive as friendly that which agrees with, we resist with dislike that which opposes us" - Faraday
So how many backdoors have been implanted in their self-hosted infrastructure that they have yet to find?
A more savvy hacker would have just used the password to merge unauthorized fraudulent commits. Thus the hack would have remained undetected.
Must assume: There are more savvy hackers.
Must assume: There are other repos with weak, guessable password.
Must conclude: There are well hidden bombs ticking away in many more repositories.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
It took just 4 minutes for someone to notice something was wrong, and less than an hour to begin remediation.
In a closed-source organization, it sometimes takes months for them to figure out they've been compromised, and even longer to fix it; I once bought a Toshiba laptop that shipped with a virus, and didn't get the real fix for a few months afterward.
The society for a thought-free internet welcomes you.
You obviously do not know that the "attack" was a false flag...
CAP === 'affable'
>> shitty admin password in 2018
So...Gentoo has assured us this is the only half-assed shortcut they've taken, right? OK, seems legit.
Gentoo is perpetuating a false flag to cover for Microsoft attacking them? How much glue have you been sniffing lately?
6/28 was an inside job!
In an entry on the Gentoo Linux wiki, there is a fairly detailed breakdown of what happened, how it happened, and what is being done to prevent it from happening again.
You suck M'Smash. Leave.
What you're doing is using lots of scare words to make the case there are bogeymen in them thar cyberwebz.
Just like anyone still using "hack" and "hackers" in security context.
Here's some news: This approach is entirely useless.
And that the main gentoo repos have been compromised in a more subtle manner with this public fuckup meant to cover it up by making it look like they were too incompetent to make changes to the primary repos.
If anyone has a git repo of portage or any other gentoo related projects that was synced prior to the hack, back it up, then have it step through the history looking for changes. I would wager at least $10 usd there are a few if anyone bothered to look. git has a number of history rewriting features, and despite claims it would throw off commit history, I have seen more than a few pulls delete history without notifying me unless I looked for the specific commit hashes.
It was probably a false CFLAG
This attack was aimed at fairly mainstream repositories (albiet not the master portage tree), hence why it was quickly thwarted, but let's address the elephant in the room: Gentoo users frequently install programs using third-party ebuilds provided by portage overlays. If the attacker were to attack certain stale overlays, they might affect users with less scrutiny from the trees' maintainers. After this news, I'll be taking another look at the overlays I allow to potentially taint my system. Perhaps more stringent security measures should be required for an overlay to belong on the layman index as well.
According to Gentoo's wiki page on the subject, the attacker has not been identified, and made at least one more (failed) attempt to access the repos after they were repaired. I'm anxious to hear how much we know about the attacker and efforts to find/prosecute them.