Kernel.org Compromised 312
First time accepted submitter JoeF writes "There is a note posted on the main kernel.org page indicating that kernel.org was compromised earlier this month: 'Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We discovered this August 28th. While we currently believe that the source code repositories were unaffected, we are in the process of verifying this and taking steps to enhance security across the kernel.org infrastructure.' The note goes on to say that it is unlikely to have affected the source code repositories, due to the nature of git."
Re:Wishful thinking (Score:5, Interesting)
You know what? Linux users will go right on using plain Linux. Not SE Linux, not OpenBSD, and certainly not Windows. We're not even going to change our root passwords. Why? Because this security breach is not that big a deal.
Yes, it is embarrassing for kernel.org, but the damage is not that great. Sure, we'd all like to prevent security breaches from ever happening in the first place, but I have always thought detection and recovery is more important than prevention. Kernel.org has that covered in spades. Keep backups. Keep many backups. Keep them in many different locations. A distributed source code revision control system such as git does that automatically. Whoever did this wasn't too smart if they were seriously trying to inject a backdoor into the Linux kernel. Now they've blown their cover. They can't have seriously expected the code modifications they tried to go unnoticed for long, unless they have no idea how large projects handle source code. So either they were dumb, or all they were trying to do was embarrass Linux.
Re:How did they hack it? (Score:0, Interesting)
Mod this up.
The worst part is coming back up online before they've figured out how the intruder got in! How do they know that the perps won't just re-do the exploit? If this were, say, Sony, they'd be getting pilloried.
Re:Wishful thinking (Score:0, Interesting)
If you use Linux, then either you use kernels provided by someone you trust to handle security updates for you, such as the standard kernels from your distribution, or you take full responsibility for knowing about things like this and making sure you don't end up using a kernel built from a compromised tarball. There is no third option.
If you are downloading tarballs of raw Linux kernel source code and not proactively monitoring kernel-related security announcements, then quite frankly you are an utter imbecile who deserves whatever consequences you get.
Re:Highly unlikely the code was compromised (Score:3, Interesting)