Kernel.org Attackers Didn't Know What They Had 183
Trailrunner7 writes "The attack that compromised some high-value servers belonging to kernel.org — but not the Linux kernel source code — may have been the work of hackers who simply got lucky and didn't realize the value of the servers that they had gotten their hands on. The attackers made a couple of mistakes that enabled the administrators at kernel.org to discover the breach and stop it before any major damage occurred. First, they used a known Linux rootkit called Phalanx that the admins were able to detect. And second, the attackers set up SSH backdoors on the compromised servers, which the admins also discovered. Had the hackers been specifically targeting the kernel.org servers, the attack probably would've looked quite different."
A few blog posts in the wake of the attack have agreed with the initial announcement; while it was embarrassing, the integrity of the kernel source is not in question.
The truth (Score:1, Insightful)
Spin (Score:5, Insightful)
Given that they attackers hacked the server a minimum of 17 days before it was detected, I'm not sure I'm going to buy into a story that makes the attackers sound clueless and the server admins smart and on the ball.
Re:and after reading the articles.... (Score:5, Insightful)
Feeling better (Score:5, Insightful)
I was concerned about the fact that a high profile like kernel.org site was rooted, but knowing it didn't take a sophisticated and highly knowledgeable penetration team but just a group of bumbling script kiddies makes it all better.
Two ways to look at this... (Score:5, Insightful)
The first way: Haha, these skiddies didn't have what it takes to effectively hide their cracking.
The second way: Skiddies were able to crack kernel.org using automated cracking tools just Windows, no evil genius required.
Re:Spin (Score:5, Insightful)
Yeah, just admit failure and do better next time. No need to blog about how a trivial issue it was.
Re:The motive doesn't matter. It's time for action (Score:4, Insightful)
Question, how would OpenBSD prevent them from getting into the server with compromised username and password? Or from running arbitrary code once they do so?
Re:The motive doesn't matter. It's time for action (Score:4, Insightful)
Yes, well everyone knows those kernel.org sysops are a bunch of pushover newbies. Im sure you can do way better with the scope and size of the systems they deal with.