 |
| |
|
|
Asher
|
 |
Calgary, Alberta
Nov 1999
time: 22:30
|
|
http://www.theregister.co.uk/content/55/32355.html
quote:
GNU servers 'owned' by crackers since March
By John Leyden
Posted: 15/08/2003 at 08:46 GMT
Crackers owned the primary file servers of the GNU Project from mid-March until two weeks ago, the Free Software Foundation admitted this week.
The attack raises concerns about whether malicious code could have been inserted in the software available for download, including some Linux applications.
However, evidence suggests no source code distributions were modified as a result of the attack. Current files have all been validated by the FSF, which oversees the GNU Project.
Nonetheless sites using software obtained from the compromised system are urged to verify the integrity of their distribution. FSF is providing software hashes to this end which can be found here.
The attack took place in March using a zero-day exploit, but was only discovered in late July. FSF replaced the compromised machine in early August.
In a statement, the FSF explained: "A root compromise and a Trojan horse were discovered on gnuftp.gnu.org, the FTP server of the GNU project. The machine appears to have been cracked in March 2003, but we only discovered the crack in the last week of July 2003. The modus operandi of the cracker shows that (s)he was interested primarily in using gnuftp to collect passwords and as a launching point to attack other machines."
"It appears that the machine was cracked using a ptrace exploit by a local user immediately after the exploit was posted," it added.
Evidence found on the compromised machine indicates that gnuftp was cracked during the week between the release of the ptrace bug, a root-shell exploit, and the time a working fix for the Linux-kernel was available a week later.
The FSF have tightened up security defences since the attack. Local shell access to the FTP server for GNU maintainers has been withdrawn pending completion of its certification activities.
Security clearing house CERT has also issued an advisory on the attack.
It far from the first time crackers have broken into the web servers of software developers. In May 2001, infamous cracker Fluffy Bunny bragged that he had compromised the systems of the Apache project.
In October 2000, Microsoft's systems were comprehensively compromised by a cracker using the QAZ Trojan. Weeks later Microsoft's core web sites were again 0wn3d in an attack that went beyond the usual Web page defacement. |
With the *nix trolls out in force about the MSBlast thing, I thought I'd give them a harsh reality check. 
|
|
| |
|
| |
|
| |
|
|
|
Whaleboy
|
 |
Please make all cheques payable to Whaleboy
Jan 2003
time: 05:30
|
|
The content was explaining the GNU is not a particularly clever organisation. If anything I was concurring, dont knock it. Were you expecting flames from me?
quote:
A huge post but no content -- from a Linux advocate?
|
I got no love for GNU.. I like Linux because it is superior, I prefer open source BSD style - although GPL is probably better for something like linux to compete with MS. Just counting the days till Mandy 9.2 so I can get rid of XP 
I find it amusing when one major **** up from a small part of a "modular" community can be said to be equivalent to a centralised organisation that has made many many more blunders, of far greater severity.
I think that the fact that so many people berate Microsoft shows in itself that there is something to berate. Notwithstanding this, I will always choose OSS for secure applications any day, for all the obvious advantages, and I'm not being held hostage by microsoft and their updates. Fundamentally, I think microsoft write bad code. Its as simple as that. Lets also not forget that security and stability are two sides of the "good code" coin. By all accounts that arent funded by MS, linux and BSD win on that front.
Asher: Not all people that advocate linux are zealots. If MS offered the better system and the better model, I would support them. Note that I am not so obsessed with it that I wont run WinXP because it is temporarily the best tool for the job. Lots of MSers like to portray OSS users as 40 year old virgins with questionable personal hygiene, obsessive and madly in love with what they use, each a clone of Stallman. Perhaps that would have held 5 years ago, but not any more. I used and will use it because it is the better tool, the fact that I think OSS is a better way of developing software does not affect that, whereas the tools themselves determine that conclusion.
|
|
| |
|
| |
|
|
|
Whaleboy
|
|
Please make all cheques payable to Whaleboy
Jan 2003
time: 05:30
|
|
quote:
And please tell me you didn't call GNU a small part of a "modular" community
|
In terms of what it produces in the context of OSS software, then yes it is. Admittedly, its a bigger contributor than any other, but most of the user-level software I used was not GNU.
quote:
And if Linux is superior, do you mind telling the class why you switched back to Windows XP "temporarily".
|
Because Slackware was p!ssing me off, and it seems idiotic to buy Mandrake 9.1 when 9.2 is due out so soon. The problem with systems like Slackware is that because they leave so much power of their system in the hands of the user, your tempted to play with it, to the extent that you get very little actual work done... which sucks because I have a novel to finish before september.
Nonetheless, on Windows, I'm using openoffice.org and mozilla (for some reason OOo runs faster on windows than it did on Linux, however, windows is closer to the centre of the disk as it is on the first partition (and yet linux as a system still ran faster  ).
Don't get me wrong, windows has a superior interface, a superior ease of use, and a superior selection of desktop/SOHO software. This makes it king of the desktop, and while things are improving for Linux, particularly on other aspects of the desktop, until parity is achieved with windows in these respects, MS will still rule desktops.
Dont worry, I wont be back for long, this is more like staying for a cup of tea and a biscuit.
Asher: IIRC, you are running mandrake 9.0, I strongly suggest you reinstall 9.2 when it comes out. 9.0 was probably the worst distro ever, its hardly fair to call that representative  .
|
|
| |
|
| |
All times are GMT. The time now is 05:30.
Apolyton Time is 00:30. |
top of page
|
| archivepost |
|
Forum Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
|
HTML code is ON
vB code is ON
Smilies are ON
[IMG] code is ON
|
|
|
|
|
|
16-08-2003 12:13
Is that the best you can do? 
. 
Certainly as OSS, linux et al gain greater share of the market, higher profile etc, stuff like this is going to be a target and GNU has to wake up to this like every other OSS organisation. I think they probably will after this, but then, I do want to see the HURD become like openBSD. Another 15 years? 
|