Author Topic: Linux kernel.org hacked (Read 24,902 times)

f0dder · « **on:** September 01, 2011, 07:33 PM »

"Oops."

[attachimg=#]
Kernel.org Server Rooted and 448 users credentials compromised

Now, as mentioned in the article there's no reason to worry about the Git source repository, due to the nature of Git itself... but the kernel tarballs could be affected, and we won't know the details until after an audit is done. (Yes, there's signatures for those tarballs, but who checks the signatures? And is there any guarantee that the tarball signing key hasn't been compromised?).

What does this mean? If you've downloaded tarballs from kernel.org the previous month or so, be sure to audit your systems and follow the news very carefully. Hopefully all sane distributions get their kernel sources from Git and not kernel tarballs, so people upgrading kernels from their distro vendor should be safe - but stay tuned.

Interesting news, anyway. Seems to be a combination of trojanizing an Intel kernel committer (social engineering or haxxor of his system?), and then a bit of local->root privilege escalation.

zridling · « **Reply #1 on:** September 02, 2011, 10:37 AM »

Interesting and embarrassing, eh? I wouldn't worry:

How to inject a malicious commit to a Git repository (or not)
http://git-blame.blogspot.com/2011/08/how-to-inject-malicious-commit-to-git.html

Hack or No Hack, the Linux Kernel Is Well-Protected
http://www.pcworld.com/businesscenter/article/239400/hack_or_no_hack_the_linux_kernel_is_wellprotected.html

Tuxman · « **Reply #2 on:** September 02, 2011, 10:45 AM »

That said, the attacker's rootkit was able to gain root priviledges via an (obviously) yet unknown priviledge escalation exploit, so the Linux kernel most likely has a critical bug which is actively exploited, so it does not matter if the Git repository was modified or not.

I'm so happy that I use the secure Windows instead of the exploitable Linux stuff.

40hz · « **Reply #3 on:** September 02, 2011, 11:39 AM »

^Do I detect a little flame-baiting from our T-man?

Renegade · « **Reply #4 on:** September 02, 2011, 12:56 PM »

Quote from: Tuxman on September 02, 2011, 10:45 AM

I'm so happy that I use the secure Windows instead of the exploitable Linux stuff.

Hahahah~! YEAH~! You go~!

Spill that blood baby~!

Give 'er~!

(Hey -- I like Windows servers!)

I don't think we're in any danger of a flame war here. (One of the nice things about DC -- our "flame wars" are more like "waving lighters in the air".)

40hz · « **Reply #5 on:** September 02, 2011, 12:59 PM »

@Ren - spot on! One of the reasons I like coming here.

P.S. I like Windows servers too!

f0dder · « **Reply #6 on:** September 02, 2011, 02:25 PM »

Quote from: zridling on September 02, 2011, 10:37 AM

Interesting and embarrassing, eh? I wouldn't worry:

How to inject a malicious commit to a Git repository (or not)
http://git-blame.blogspot.com/2011/08/how-to-inject-malicious-commit-to-git.html

Please re-read my post. Like, the first paragraph that mentions Git and tarballs.

Tuxman · « **Reply #7 on:** September 02, 2011, 03:40 PM »

Awwww, I was so positive that I could initiate a serious flame-war here in this Windows users board!!11

40hz · « **Reply #8 on:** September 02, 2011, 04:02 PM »

^Sorry to disappoint. But zridling and 40hz are serious and unapologetic Linux users.

Tuxman · « **Reply #9 on:** September 02, 2011, 04:10 PM »

Disrupters!

Renegade · « **Reply #10 on:** September 02, 2011, 04:26 PM »

Quote from: 40hz on September 02, 2011, 04:02 PM

^Sorry to disappoint. But zridling and 40hz are serious and unapologetic Linux users.

BURN THE WITCHES~!

https://www.youtube.com/watch?v=zrzMhU_4m-g

Stoic Joker · « **Reply #11 on:** September 02, 2011, 04:40 PM »

Now Ren, I thought we agreed to (only burning the Mac types) cut down on torching people ... The *nix crowd is ok.

wraith808 · « **Reply #12 on:** September 02, 2011, 05:20 PM »

But isn't the mac crowd sort of mixed in with the *nix crowd now?

Tuxman · « **Reply #13 on:** September 02, 2011, 05:35 PM »

The Mac crowdies are bastards.

40hz · « **Reply #14 on:** September 02, 2011, 06:20 PM »

Quote from: wraith808 on September 02, 2011, 05:20 PM

But isn't the mac crowd sort of mixed in with the *nix crowd now?

Nope. They want nothing to do with us nixers.

How the discussion usually goes

[attach]

Stoic Joker · « **Reply #15 on:** September 02, 2011, 10:51 PM »

Quote from: wraith808 on September 02, 2011, 05:20 PM

But isn't the mac crowd sort of mixed in with the *nix crowd now?

No, the Mac crowd bends to the will of lord jobs ... And therefore fiercely believes his every decreed word in that OSX is indeed a thing unto itself. Because it use some piece/part/portion in some arcane mini-Minge kernel project, and is therefore not just a slapped on GUI desktop masking a copy of FreeBSD.

And then there's the rest of us that think ^^they're^^ full of shit.

Lashiec · « **Reply #16 on:** September 04, 2011, 03:03 PM »

Quote from: 40hz on September 02, 2011, 06:20 PM

Nope. They want nothing to do with us nixers.

Yet it's amazing the amount of open source supporters who run a Mac, though sometimes out of spite

40hz · « **Reply #17 on:** September 04, 2011, 04:00 PM »

Quote from: Lashiec on September 04, 2011, 03:03 PM

Quote from: 40hz on September 02, 2011, 06:20 PM
Nope. They want nothing to do with us nixers.

Yet it's amazing the amount of open source supporters who run a Mac, though sometimes out of spite

I thought it was more out of pity they did that...

Poor little Mach kernal being held captive by Apple like that. What did it ever do to them?

Tuxman · « **Reply #18 on:** September 04, 2011, 04:10 PM »

Darwin is open source, it is just Aqua that is not. Anyway, I really wonder what should be so "great" about a BSD/Mach hybrid bastard of a kernel, given that OSX is, according to Secunia, more insecure than Windows 7.

40hz · « **Reply #19 on:** September 04, 2011, 04:42 PM »

^Mach was pretty rad for it's time when microkenals were all the rage.

I think the main reason Jobs liked it was because that's what they used for his ill-fated NeXT machine (Jobs never admits he backed the wrong horse) - and the license allowed them to use the code without needing to give anything back.

So I'd hesitate to call Mach3 a bastardized kernal. It's just a different approach than the one more commonly used by most of today's production operating systems.

But who knows? GNU Hurd is based on the Mach kernal - and there's some chance Hurd may finally be out in the near future after 20 years of waiting. A "Hurd variant" of Debian is slated for release with version 7.0 (aka: Wheezey). Beta downloads are already available for it. (Note: this is seriously beta so don't bother unless you're really curious about it.)

Tuxman · « **Reply #20 on:** September 04, 2011, 04:46 PM »

Good software is never "final"!

40hz · « **Reply #21 on:** September 04, 2011, 05:33 PM »

Quote from: Tuxman on September 04, 2011, 04:46 PM

Good software is never "final"!

I wasn't saying "final" - just "finally out."

Tuxman · « **Reply #22 on:** September 04, 2011, 06:30 PM »

Even an alpha 0.01 is "out".

zridling · « **Reply #23 on:** September 04, 2011, 08:08 PM »

Quote from: 40hz on September 02, 2011, 04:02 PM

^Sorry to disappoint. But zridling and 40hz are serious and unapologetic Linux users.

Indeed. And just like any other software, among distros, I have a number of niggling gripes. But the modularity and scalability of the kernel is good to us all.