Author's Opinion

The views in this column are those of the author and do not necessarily reflect the views of iTWire.

Have your say and comment below.

Thursday, 01 September 2011 10:27

Linux kernel project servers compromised

By

A number of servers at the Linux kernel project have been breached, according to an advisory at the kernel.org website.


Entry was gained via a machine that goes by the name of Hera.

The breach was discovered on August 28 and, while the kernel team believes the source code repositories were not affected, investigations are underway to check and also to bolster security across the project infrastructure.

Update, September 1, 1.35pm AEST: The British technology news site, The Register, reports that the intrusion went undetected for 17 days. This is based on an email it obtained which was sent to developers by John Hawley, the chief sysadmin of kernel.org.

The breach is believed to have occurred via a compromised user credential; how the attacker or attackers used that to gain superuser status is not yet known.

The attacker(s) had modified ssh files (openssh, openssh-server and openssh-clients) and these were running. In addition, a trojan startup file had been added to the startup scripts on Hera.

The kernel team has logged user interactions as well as some exploit code.

The trojan was initially discovered due to error messages apparently coming from a package, xnest, that was not installed; if similar behaviour was observed elsewhere developers were advised to investigate. However the presence of such messages did not make it clear that the machine was compromised, susceptible or not.



The kernel team has now taken servers offline to back-up and reinstall; a full reinstall would be done on all servers at kernel.org. Authorities in the US and Europe had been notified.

Code in the git distributed revision control system and tarballs is being analysed to check for any modifications.

"However, it's also useful to note that the potential damage of cracking kernel.org is far less than typical software repositories," the advisory pointed out.

"That's because kernel development takes place using the git distributed revision control system, designed by Linus Torvalds. For each of the nearly 40,000 files in the Linux kernel, a cryptographically secure SHA-1 hash is calculated to uniquely define the exact contents of that file.

"Git is designed so that the name of each version of the kernel depends upon the complete development history leading up to that version. Once it is published, it is not possible to change the old versions without it being noticed."

The advisory added: "Those files and the corresponding hashes exist not just on the kernel.org machine and its mirrors, but on the hard drives of each several thousand kernel developers, distribution maintainers, and other users of kernel.org.

"Any tampering with any file in the kernel.org repository would immediately be noticed by each developer as they updated their personal repository, which most do daily."

 


Subscribe to ITWIRE UPDATE Newsletter here

GRAND OPENING OF THE ITWIRE SHOP

The much awaited iTWire Shop is now open to our readers.

Visit the iTWire Shop, a leading destination for stylish accessories, gear & gadgets, lifestyle products and everyday portable office essentials, drones, zoom lenses for smartphones, software and online training.

PLUS Big Brands include: Apple, Lenovo, LG, Samsung, Sennheiser and many more.

Products available for any country.

We hope you enjoy and find value in the much anticipated iTWire Shop.

ENTER THE SHOP NOW!

INTRODUCING ITWIRE TV

iTWire TV offers a unique value to the Tech Sector by providing a range of video interviews, news, views and reviews, and also provides the opportunity for vendors to promote your company and your marketing messages.

We work with you to develop the message and conduct the interview or product review in a safe and collaborative way. Unlike other Tech YouTube channels, we create a story around your message and post that on the homepage of ITWire, linking to your message.

In addition, your interview post message can be displayed in up to 7 different post displays on our the iTWire.com site to drive traffic and readers to your video content and downloads. This can be a significant Lead Generation opportunity for your business.

We also provide 3 videos in one recording/sitting if you require so that you have a series of videos to promote to your customers. Your sales team can add your emails to sales collateral and to the footer of their sales and marketing emails.

See the latest in Tech News, Views, Interviews, Reviews, Product Promos and Events. Plus funny videos from our readers and customers.

SEE WHAT'S ON ITWIRE TV NOW!

BACK TO HOME PAGE
Sam Varghese

Web Analytics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

Share News tips for the iTWire Journalists? Your tip will be anonymous

WEBINARS ONLINE & ON-DEMAND

GUEST ARTICLES

VENDOR NEWS

Guest Opinion

Guest Interviews

Guest Reviews

Guest Research

Guest Research & Case Studies

Channel News

Comments