Kernel.org Compromised 312
First time accepted submitter JoeF writes "There is a note posted on the main kernel.org page indicating that kernel.org was compromised earlier this month: 'Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We discovered this August 28th. While we currently believe that the source code repositories were unaffected, we are in the process of verifying this and taking steps to enhance security across the kernel.org infrastructure.' The note goes on to say that it is unlikely to have affected the source code repositories, due to the nature of git."
Re:How did they hack it? (Score:4, Informative)
The post on kernel.org states that it was possibly due to a compromised user account. They stated that they discovered it through some errors related to Xnest /dev/mem and that they captured some of the exploit code. I believe they're still looking at everything to figure how how the intruders got in and what they touched.
Kudos to the kernel.org team for their prompt action and immediate disclosure.
Re:Whoops! (Score:4, Informative)
Not really. Try reading the summary all the way through.
You don't git it (Score:3, Informative)
Not need to panic. Yet. Most users don't download their kernels from kernel.org. This is a fact. Most users download via the package repositories of their favorite Linux distro, say Ubuntu or Arch. And the kernel maintainers of most distros worth their salt don't use http or ftp to download a fresh copy of the kernel every time Linux decides to update it. They use git.
You are spreading FUD. Sure, it's a serious issue. But not the way you think it is. If the exploit was done through a hole in the kernel, then, and only then, is this a "seriously" "freaking big" issue. If it was done through the usual social engineering channels, then, well, I guess we need a brain patch not a kernel patch. There's simply no fix for that.
Re:Wishful thinking (Score:5, Informative)
If the attackers were worth their salt, after gaining access they would drop in their own custom replacements for patch, make and gcc.
Since patch, make, and gcc are all GNU tools and not part of the Linux kernel, the only harm would be to the single copy on the kernel.org machine. If that machine isn't part of the build process (i.e., if it was merely a file repository), then nothing would be compromised.
It would also be pretty easy to see because builds from other machines wouldn't match.
Re:How did they hack it? (Score:5, Informative)
H.P.A. has commit privs and his work laptop was trojanned. That's how. Am I the only one who reads and understands the original e-mails from the admin?
Re:How did they hack it? (Score:2, Informative)
You have time to lookup the slackware documentation, but not read TFA?
"Trojan initially discovered due to the Xnest /dev/mem error message w/o Xnest installed."
Re:How did they hack it? (Score:4, Informative)
Am I the only one who reads and understands the original e-mails from the admin?
Are you? "Intruders gained root access on the server Hera. We believe they may have gained this access via a compromised user credential; how they managed to exploit that to root access is currently unknown and is being investigated. "