Main Area and Open Discussion > General Software Discussion

Linux kernel.org hacked

(1/5) > >>

f0dder:
"Oops."


Kernel.org Server Rooted and 448 users credentials compromised

Now, as mentioned in the article there's no reason to worry about the Git source repository, due to the nature of Git itself... but the kernel tarballs could be affected, and we won't know the details until after an audit is done. (Yes, there's signatures for those tarballs, but who checks the signatures? And is there any guarantee that the tarball signing key hasn't been compromised?).

What does this mean? If you've downloaded tarballs from kernel.org the previous month or so, be sure to audit your systems and follow the news very carefully. Hopefully all sane distributions get their kernel sources from Git and not kernel tarballs, so people upgrading kernels from their distro vendor should be safe - but stay tuned.

Interesting news, anyway. Seems to be a combination of trojanizing an Intel kernel committer (social engineering or haxxor of his system?), and then a bit of local->root privilege escalation.

zridling:
Interesting and embarrassing, eh? I wouldn't worry:

How to inject a malicious commit to a Git repository (or not)
http://git-blame.blogspot.com/2011/08/how-to-inject-malicious-commit-to-git.html

Hack or No Hack, the Linux Kernel Is Well-Protected
http://www.pcworld.com/businesscenter/article/239400/hack_or_no_hack_the_linux_kernel_is_wellprotected.html

Tuxman:
That said, the attacker's rootkit was able to gain root priviledges via an (obviously) yet unknown priviledge escalation exploit, so the Linux kernel most likely has a critical bug which is actively exploited, so it does not matter if the Git repository was modified or not.

I'm so happy that I use the secure Windows instead of the exploitable Linux stuff.  :P

40hz:
^Do I detect a little flame-baiting from our T-man?  ;D :Thmbsup:

Renegade:
I'm so happy that I use the secure Windows instead of the exploitable Linux stuff.  :P
-Tuxman (September 02, 2011, 05:45 AM)
--- End quote ---

Hahahah~! YEAH~! You go~! :) Spill that blood baby~! :P Give 'er~!

(Hey -- I like Windows servers!)

I don't think we're in any danger of a flame war here. (One of the nice things about DC -- our "flame wars" are more like "waving lighters in the air".) :P ;D

Navigation

[0] Message Index

[#] Next page