Security Market Segment LS
Thursday, 05 July 2018 08:18

Stolen admin password used in Gentoo GitHub mirror attack

By

The attackers who gained access to the GitHub mirror of the Gentoo Linux project did so through use of an administrator password, with evidence suggesting that the password scheme used made it easy to guess passwords for unrelated Web pages.

In a detailed report issued just a week after the 28 June announcement of the incident, the project said it was affected to the extent that the mirror was unavailable for use for about five days.

It said examination of logs showed that from 8 April to 27 June, various GitHub accounts were being probed, with the attackers presumably looking for vulnerable accounts.

The report said unknown individuals obtained control of an administrator account for the Gentoo GitHub mirror and prevented Gentoo developers from gaining access to the mirror and its repositories.

"The main Gentoo repositories are kept on Gentoo-hosted infrastructure and Gentoo mirrors to GitHub in order to 'be where the contributors are', the report said.

"We do not believe the private keys of the account impacted were at risk, and so the Gentoo-hosted infrastructure was not impacted by this incident."

Gentoo is a Linux distribution meant for advanced users. The source is compiled locally depending on user preferences and is often optimised for specific hardware. Some larger packages are offered as precompiled binaries, and the same applies to those which have no source code available.

The source code repository GitHub was recently acquired by Microsoft for US$7.5 billion (A$9.79 billion) in Microsoft stock.

The Gentoo project said after gaining access, the attackers "then proceeded to make various changes to content".

The Gentoo developer and infrastructure teams contacted GitHub support and the Gentoo mirror was frozen by GitHub staff.

It said the project had regained control of the Gentoo GitHub mirror and reverted the bad commits and defaced content.

On the plus side of the way things were handled, the project lauded its quick reaction to the situation and the speedy response from GitHub.

The cons were initial unclear communications, failure to block access to the repositories via git and the lack of a back-up copy of the way the mirror was organised.

"Numerous Gentoo developers have personal contacts at GitHub, and in the security industry and these contacts proved valuable throughout the incident response," the report said.

"The attack was loud; removing all developers caused everyone to get emailed. Given the credential taken, its likely a quieter attack would have provided a longer opportunity window.

"The method by which the attackers pushed commits (force pushing their commits) made downstream consumption more conspicuous; this would have blocked git from silently pulling in new content to existing checkouts on 'git pull'."


Subscribe to Newsletter here

NEW OFFER - ITWIRE LAUNCHES PROMOTIONAL NEWS & CONTENT

Recently iTWire remodelled and relaunched how we approach "Sponsored Content" and this is now referred to as "Promotional News and Content”.

This repositioning of our promotional stories has come about due to customer focus groups and their feedback from PR firms, bloggers and advertising firms.

Your Promotional story will be prominently displayed on the Home Page.

We will also provide you with a second post that will be displayed on every page on the right hand side for at least 6 weeks and also it will appear for 4 weeks in the newsletter every day that goes to 75,000 readers twice daily.

POST YOUR NEWS ON ITWIRE NOW!

PROMOTE YOUR WEBINAR ON ITWIRE

It's all about Webinars.

These days our customers Advertising & Marketing campaigns are mainly focussed on Webinars.

If you wish to promote a Webinar we recommend at least a 2 week campaign prior to your event.

The iTWire campaign will include extensive adverts on our News Site itwire.com and prominent Newsletter promotion https://www.itwire.com/itwire-update.html and Promotional News & Editorial.

For covid-19 assistance we have extended terms, a Webinar Business Booster Pack and other supportive programs.

We look forward to discussing your campaign goals with you. Please click the button below.

MORE INFO HERE!

BACK TO HOME PAGE
Sam Varghese

website statistics

Sam Varghese has been writing for iTWire since 2006, a year after the site came into existence. For nearly a decade thereafter, he wrote mostly about free and open source software, based on his own use of this genre of software. Since May 2016, he has been writing across many areas of technology. He has been a journalist for nearly 40 years in India (Indian Express and Deccan Herald), the UAE (Khaleej Times) and Australia (Daily Commercial News (now defunct) and The Age). His personal blog is titled Irregular Expression.

BACK TO HOME PAGE

ZOOM WEBINARS & ONLINE EVENTS

Channel News

VENDOR NEWS & VIEWS

REVIEWS

Comments

Guest Opinion