Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
GNOME GUI Security

Gnome.org Compromised? 512

Posted by michael from the somebody-needs-to-get-stomped dept.
Garden GNOME writes "The GNOME sysadmin team has just announced that the main GNOME web server has probably been intruded into, leading to the shutdown of the GNOME website, (including bugzilla.gnome.org, art.gnome.org and developer.gnome.org). The GNOME mailing lists, and CVS servers seem to be up, though the FTP server was immediately taken down as a precautionary measure (released sources are believed to be intact). This is bad, because GNOME 2.6 was supposed to be released tomorrow. Let's hope it is a false alarm."
This discussion has been archived. No new comments can be posted.

Gnome.org Compromised? More

Gnome.org Compromised?

Comments Filter:

  • Blame windows (Score:5, Funny)

    by superpulpsicle ( 533373 ) on Tuesday March 23, 2004 @06:54PM (#8650158)
    I guess the next version of longhorn will now look like GNOME.

    • Re:Blame windows (Score:5, Funny)

      by 11223 ( 201561 ) on Tuesday March 23, 2004 @07:02PM (#8650267)
      Imagine how damaging this could be if the intruders got the source code! Now Microsoft can view our source!

    • Windows joke (Score:5, Insightful)

      by bonch ( 38532 ) on Tuesday March 23, 2004 @07:12PM (#8650398)
      I fully expect a bunch of lame Microsoft jokes.

      But let's be real, here. Last year in the span of six months, Debian, Gentoo, and GNU (twice!) were compromised. Now GNOME.

      Can you honestly rail on Microsoft? When was the last time their servers were compromised? I only vaguely recall something in 2000 about alleged stolen source code, and a real good that has turned out all these years later. As for this year's stolen source code, Slashdot never reported this but it was taken from a Linux computer at MainSoft.

      Just funny how things are viewed around here, with a certain bias some people don't even realize they have.

      • Re:Windows joke (Score:5, Insightful)

        by krlynch ( 158571 ) on Tuesday March 23, 2004 @07:23PM (#8650504) Homepage

        I understand your point, but to be fair you should have noted that Microsoft is under no obligation, as far as I am aware, to tell anyone when they have been compromised. Microsoft's servers could have been cracked once a day, once a week, or once a month, and you would never know.

        • Re:Windows joke (Score:5, Insightful)

          by merdark ( 550117 ) on Tuesday March 23, 2004 @07:36PM (#8650621)
          Well, for one, their servers always seem to be up. www.microsoft.com going down would normally make news. Also, it's more than likely that someone cracking the MS site would do SOMETHING to let it be known that they did it. Few hackers are purely malicious, most want some sort of fame.

          (Yes, I used hackers instead of crackers, get over it, the work hacker is used by popular culture that way)

          • Re:Windows joke (Score:5, Insightful)

            by Thagg ( 9904 ) <thadbeier@gmail.com> on Tuesday March 23, 2004 @07:51PM (#8650739) Journal
            Merdark says Also, it's more than likely that someone cracking the MS site would do SOMETHING to let it be known that they did it. Few hackers are purely malicious, most want some sort of fame.

            Note that the compromisers of the debian, GNU, and now Gnome sites did not let it be known. They are either not driven by publicity or have longer term goals. Believing that systems are secure because crackers don't announce themselves is foolish at best, mendacious at worst.

            thad

          • Re:Windows joke (Score:5, Insightful)

            by leandrod ( 17766 ) <l@dutras . o rg> on Tuesday March 23, 2004 @07:58PM (#8650795) Homepage Journal
            >
            their servers always seem to be up

            Do you realize how many servers MS has? Free software projects are lucky if they have two.

            >
            it's more than likely that someone cracking the MS site would do SOMETHING to let it be known that they did it

            And get black helicopters hovering over your backyard?

            >
            I used hackers instead of crackers

            You insensitive.

          • Re:Windows joke (Score:5, Insightful)

            by Tony ( 765 ) on Tuesday March 23, 2004 @09:15PM (#8651471) Journal
            (Yes, I used hackers instead of crackers, get over it, the work hacker is used by popular culture that way)

            By that logic, scientists should start using "theory" instead of "hypothesis," simply because popular culture uses it that way. Or "velocity" when they mean "speed." Or "light years" when they mean "months" (as in time). Or maybe they should start using "pounds" as a unit of mass.

            Or in the computer industry, maybe we should start using the word "CPU" when we mean "computer case." Or "RAM" when we mean "hard drive." Or "cup holder" when we mean CD/DVD drive. Or.... getting the idea?

            Just because the public uses a word incorrectly does not mean folks in the industry need to follow suit.

            • Re:Windows joke (Score:3, Interesting)

              by ClosedSource ( 238333 )
              But "hacker" is a word that doesn't even have a single meaning among geeks.

              The original MIT meaning was someone who was driven to passionately persue their area of interest as an intense hobby rather than being paid for it (in grades or money). That hobby wouldn't necessary concern computers.

              On Slashdot a hacker often means someone who reverse-engineers a computing device and then uses that knowledge to do something that the system wasn't orginally intended to do as in "They hacked the XBox and made it ru

      • Re:Windows joke (Score:5, Insightful)

        by brokenwndw ( 471112 ) on Tuesday March 23, 2004 @07:24PM (#8650512)
        Let me offer some pseudo-arithmetic here:

        (number of server compromises you hear about) = (number of servers in existence) * (relative vulnerability of servers) * (willingness of those running servers to reveal compromises)

        I realize there are some people who have biases they don't appreciate. But data, taken at face value, is famous for having those same biases. No?

      • Re:Windows joke (Score:4, Interesting)

        by eakerin ( 633954 ) on Tuesday March 23, 2004 @07:29PM (#8650553) Homepage
        Can you honestly rail on Microsoft? When was the last time their servers were compromised?
        More like, "When was the last time Microsoft publicly announced a compromised system?". For all you know, the last break in could have been yesterday, or 2 days ago. That's not the kind of thing they put out a press release about.

        Major companies don't annouce bad news, it's just not good for business. So any comparison is not valid.

        • Re:Windows joke (Score:3, Insightful)

          by red tiger ( 743043 )
          And not only the companies. The Soviet Russians were exactly like that, and they haven't changed much.

          For example, Chernobyl:

          • The first day they didn't tell anyone.
          • The second day they said: "Yes, something little has really happened..."
          • .......

      • Re:Windows joke (Score:3, Insightful)

        by Fourier ( 60719 )
        When was the last time their servers were compromised?

        When's the last time MS hosted their source code on a publically-viewable CVS tree, or offered anonymous FTP access? This is not a fair comparison.
      • Can you honestly rail on Microsoft?

        Yes, I can. When Microsoft ships product with a virus pre-installed, yes, I can very much so.

        I don't care if they are broken into. Same thing with Gnome. However, if in the end, Gnome turns around and releases code that is bugged, or otherwise harmful, I will be just as upset as I was with Microsoft.

      • Re:Windows joke (Score:4, Interesting)

        by Alan Cox ( 27532 ) on Tuesday March 23, 2004 @07:31PM (#8650567) Homepage
        Microsoft do all their development internally so the security situation is different. Internal control in MS does not appear to be reliable given the number of large easter eggs that appear in applications. If someone can sneak a mini-flight sim into an app then they can sneak other stuff in.

        • Re:Windows joke (Score:4, Interesting)

          by Dahamma ( 304068 ) on Tuesday March 23, 2004 @07:54PM (#8650760)
          Not that I'm defending M$ security, but I wonder how many of their easter eggs are *really* slipped in by programmers without anyone else's knowledge...

          I know someone who worked for several weeks on an "easter egg" at Intuit that was scheduled form the start and went through the full QA cycle - though she actually got in a fair bit of trouble for trying to sneak an easter egg in the easter egg... :)

      • Re:Windows joke (Score:5, Interesting)

        by DenOfEarth ( 162699 ) on Tuesday March 23, 2004 @07:31PM (#8650570) Homepage

        But let's be real, here. Last year in the span of six months, Debian, Gentoo, and GNU (twice!) were compromised. Now GNOME.

        Compromise is bad for the most part, but I was particularly impressed with the professional conduct of the above parties after their systems had been compromised. It seems like they were very upfront with what had happened, and probably fixed whatever allowed the break-in fairly quickly. If I remember correctly, the debian and gentoo compromises were internal access kinds of breakins, not an excuse, but definitely a lot better then the horrendous amounts of viruses being spread around through outlook.

        As for microsoft, it might be possible that they have been compromised before, but due to the financial stakes involved, they were afraid of letting that fact out into the open.

        Don't worry though, I get your point about the bias of slashdot. It's kind of frustrating sometimes, but I'm kind of frustrated with the thought of my gnome2.6 being delayed. :)

      • Re:Windows joke (Score:5, Insightful)

        by ferratus ( 244145 ) * on Tuesday March 23, 2004 @07:41PM (#8650654) Homepage
        I am in a position where I currently get to use all three major platforms everyday (Linux, OSX, Windows) ans while I will admit to have a bias against Microsoft, I think there's a few key differences between OSS and Microsoft-like cies.

        First, I don't pay to get linux on my servers. Nobody said open source software were flawless, the key is that many here (including me) believe that you can get a more secure server if the source is open.

        Second, the Gnome project is not "linux inc." whereas Microsoft *is* Microsoft inc. That is to say, Microsoft controls all the aspect of their security, Gnome doesn't. Did the sysadmin patch everything ? Did they perhaps forget to update apache or some other software ? In microsoft's case, they provice all the security update, so when they are hacked, they are directly responsible.

        Thirdly, remember that this is a third party site. If we would get report of all the windows servers that are getting hacked everyday, we'd here much more news like this. We are hearing about this because GNU, Gnome, Debian, etc. are public projects... othewise, this would be just another hacked site.

        Considering the amount of software present on a current-day OS, expecting any of them to be flawless and completly secure in a real-world scenario is a bit ridiculous. They point is, I believe you get more for your money with an Open Source OS (of which linux is one alternative) than with a Microsoft OS.

      • Re:Windows joke (Score:3, Interesting)

        by Pros_n_Cons ( 535669 )
        It's starting to look like M$ is taking security more serious than we are. Everytime something happens w/ linux "oh its only debian.org", "oh thats only local", "only 3 kernel advisories this month, that should be all for a while". We _can not_ keep brushing things off and pretending they are not significant. Pretend for just a second if this was MSFT that had been compromised, thier stock would plummet, investors would duck for cover and Tech writers would be spitting out bad press for months. We cannot ke

        • Re:Windows joke (Score:4, Interesting)

          by leandrod ( 17766 ) <l@dutras . o rg> on Tuesday March 23, 2004 @08:07PM (#8650893) Homepage Journal
          >
          We _can not_ keep brushing things off and pretending they are not significant

          Fully agree, but...

          Other than going for OpenBSD and lacking some functionality, what else do you propose?

          I do happen to think we should use vastly simpler systems: functional programming, perhaps Lisp, certainly all data relationally organised down to kernel level, multisserver microkernel, RISC implementation... but how realistic is this when POSIX simply has so much critical mass? This is not a technically-driven world, not even in free software or academia.

          • Re:Windows joke (Score:3, Interesting)

            by Coryoth ( 254751 )
            Other than going for OpenBSD and lacking some functionality, what else do you propose?

            How about making SELinux with a good default security policy the standard setup for all distributions using the 2.6 kernel?

            The quality and power of SELinux in terms of security is literally light years ahead of any other commonly available Operating system (except, perhaps an obscure BSD fork which I believe was implementing a similar security structure).

            Honestly, SELinux really is that good, and has been fully folde

        • Re:Windows joke (Score:5, Insightful)

          by nathanh ( 1214 ) on Tuesday March 23, 2004 @10:12PM (#8651864) Homepage
          Everytime something happens w/ linux "oh its only debian.org", "oh thats only local", "only 3 kernel advisories this month, that should be all for a while". We _can not_ keep brushing things off and pretending they are not significant.

          We are not brushing things off and pretending they are insignificant.

          Some people brush it off. Some people do not. This is not a collective. We do not all share the same opinion.

          I was never of the opinion that the debian.org incident was something to casually dismiss. Luckily, the Debian sysadmins agreed. They treated it very seriously and took several Debian servers offline to fix it. The gnome.org sysadmins are being equally professional.

          Just because you can read /. user-id 702942 saying something stupid like "M$ is dumheds and Lunix Rulze" does not mean that WE are all of the same opinion.

          So shut the fuck up.

      • Re:Windows joke (Score:4, Insightful)

        by Ender Ryan ( 79406 ) <TOKYO minus city> on Tuesday March 23, 2004 @07:59PM (#8650814) Journal
        But let's be real, here. Last year in the span of six months, Debian, Gentoo, and GNU (twice!) were compromised. Now GNOME.

        I take your point, however... Wasn't at least one of those not a software exploit, ie. someone "inside" messed up and a password got into the wrong hands? And wasn't the Gentoo exploit just one of the mirrors, said mirror not even running Gentoo?

        Can you honestly rail on Microsoft?

        Sure! Their business practices are detestable, their software is geared towards vendor lock-in instead of providing customers with what they need, and thier complicity in the SCO fiasco is deplorable and deserving of harsh punishment, possibly jail time. They have engaged in fraud, conspiracy, perjury, and corruption, if not more. Not to mention being a convicted predatory monopoly, and now they are a predatory monopoly that uses political influence to gain near impunity.

        When was the last time their servers were compromised?

        Really, how the fuck is anyone supposed to know that?

        Hotmail just had a huge downtime, we don't know why it was taken offline. Perhaps it got "hacked." There's no reason to take anything they say at face value, they are known liars.

        Just funny how things are viewed around here, with a certain bias some people don't even realize they have.

        It seems to run both ways these days. Any pro-MS response seems to get modded up without consideration of merit - personally, I think it may be because a lot of the newcomers here are intimidated by the prospect of something different than what they're used to, ie. MS, Windows, Apple, proprietary development, etc.

        • Re:Windows joke (Score:5, Funny)

          by aardvarkjoe ( 156801 ) on Tuesday March 23, 2004 @08:38PM (#8651170)
          Any pro-MS response seems to get modded up without consideration of merit

          You have got to be kidding me. I'm in full agreement that unworthy posts are modded up all the time, but if you think that there is an overall pro-Microsoft bias, you must either be blind or you bought your impressive UID and posting history off of somebody else.

          • Re:Windows joke (Score:3, Interesting)

            by incom ( 570967 )
            Actually, when a story is new, the modding is in fact decidedly pro-MS. And it later tips the other way as the story gets older. Wierd phenomenon. conspiracy> maybe someone is paying for people to do this /conspiracy

          • Re:Windows joke (Score:3, Interesting)

            by hkmwbz ( 531650 )
            I, too, have noticed a trend lately (well, it's been going on for a while), and that is that obvious flamebaits from pro-MS posters are modded up. Ignorant comments praising MS and bashing Linux will frequently get modded up, whether there is merit to it or not.

            It looks like there's a kind of backlash from pro-MS people who are sick and tired of hearing about how bad and evil Microsoft is. So they post comments about "why should Apple be allowed to bundle a browser, but MS not" (answer: Apple is not a con

  • Ahh! (Score:5, Funny)

    by Anonymous Coward on Tuesday March 23, 2004 @06:55PM (#8650160)
    Damn you KDE zealots!! Let us have our release!

  • More info (Score:2, Interesting)

    by after ( 669640 )
    Does anyone know anything else about how this was done? What exactely was comprimised? The word "comprimised" has a braud meaning, more information would be interesting.

    Sucks, I was just going to go to art.gnome.org

  • Shouldn't that read... (Score:5, Funny)

    by Anonymous Coward on Tuesday March 23, 2004 @06:55PM (#8650168)
    Shouldn't that read Gnome.org Kompromised? No, no, that's KDE. It should read Gnome.org Gnompromised.

  • Hrmm (Score:2, Funny)

    by 222 ( 551054 )
    This has got to be the work of those KDE bastards!

  • I predict: (Score:4, Insightful)

    by Neil Blender ( 555885 ) <neilblender@gmail.com> on Tuesday March 23, 2004 @06:56PM (#8650183)
    The Slashbots will point blame at the admins. However, if it were Microsoft...

    • And I predict: (Score:3, Interesting)

      by freeweed ( 309734 )
      A metric assload of posts talking about how all (800,000ish and counting) Slashdot readers are one person (the infamous Slashbot).

      A bunch of "hey, Linux has problems, so stop saying anything negative about Microsoft" posts getting moderated to +5.

      At least 100 people posting "Linux projects have been hacked many times in the past year, Microsoft none", while ignoring the complete and utter lack of Code Red, Slammer, Blaster, or any Warhol-type worm ever appearing for a *nix-based system, even though the ma

  • Am I the only one who started picturing little lawn ornament men being caught in embarrassing positions?

    Shades of Toy story....
    • actually check out my post below, but the Gnome Liberation Front may have been involved!
      Check [216.239.53.104] out [216.239.53.104] these [216.239.53.104] stories [216.239.53.104]!

      Pretty cool eh?
      • The biggest problem with these terrorist is that the "liberated" Gnome are throughly domesticated and unable to survive in the wild on their own. The police agencies frequently are reduced to holding the gnomes until their owners claim them in facilities unsuitable for the well-being of gnomes such as boxes kept in dark dusty evidence rooms. Many owners never claim them, dooming the gnomes to live out their live in pathetic gnome refugee camps.

        The Gnomes would be better served if the gnome liberation front

  • CRC (Score:3, Interesting)

    by oO Peeping Tom Oo ( 750505 ) on Tuesday March 23, 2004 @06:57PM (#8650193)
    I wonder if they have CRC'd the source and bins yet? Christ, who attacks OPEN SOURCE? Oh....heh.

    • Re:CRC (Score:5, Informative)

      by JamesHenstridge ( 14875 ) <james@jamesh . i d.au> on Tuesday March 23, 2004 @07:32PM (#8650586) Homepage
      The script used to upload files to the master FTP site also mailed MD5 sums to a mailing list hosted on another machine. That script doesn't appear to have been altered (to insert a backdoor, the script would need to repack the tarballs with an exploit on the fly), so the MD5 sums from that mailing list should be reliable.

  • text copy (Score:5, Informative)

    by Anonymous Coward on Tuesday March 23, 2004 @06:57PM (#8650195)
    We've discovered evidence of an intrusion on the server
    hosting www.gnome.org and other gnome.org websites.
    At the present time, we think that the released gnome
    sources and the gnome source code repository are unaffected.

    We are investigating further and will provide updates
    as we know more. We hope to have the essential services
    hosted on the affected machine up and running again as soon
    as possible.

    The GNOME sysadmin team
    23 March 2003

  • At least now (Score:5, Insightful)

    by Ethernet_Jedi ( 763592 ) on Tuesday March 23, 2004 @06:58PM (#8650212)
    At least they caught it now, instead of after the release. Now the code can be checked before it goes out, instead of everyone worrying about whether they downloaded compromised code

  • Just Wrong (Score:5, Funny)

    by SlydogSZ ( 675605 ) on Tuesday March 23, 2004 @06:59PM (#8650217)
    A Compromised Gnome. The image is just wrong.
  • Well I Hope it is a good wake up call to some of those people who are running the server. That it doesn't matter what OS they are running that they still need to take security seriously. Unfortunately this can make Linux look bad with a lot of eyes on the Gnome for desktop Linux having a security breach can make a lot of people skeptable of taking the time to switch to an other OS if they figure that one is just as insecure as the other. If it was some Script Kiddies little Linux box that got hacked we c

  • Gnome 2.6 (Score:3, Funny)

    by potpie ( 706881 ) on Tuesday March 23, 2004 @06:59PM (#8650229) Journal
    ...Gnot today.

    It's a bit disappointing that somebody was able to compromise their gnetwork, but i guess gno system can be comletely secure. I only hope people would stop putting G's in front of all the N words they use when they're talking about Gnome. It's getting on my gnerves.

  • bad for gnome (Score:3, Funny)

    by zoloto ( 586738 ) on Tuesday March 23, 2004 @06:59PM (#8650230)
    It may have been the GLF [google.com]. They've been causing problems in europe..

    Now the internet? Guess I'm not the only one waiting for the new release!

    FREE THE GNOME!!!

  • Bad news... (Score:5, Insightful)

    by Erwos ( 553607 ) on Tuesday March 23, 2004 @06:59PM (#8650233)
    But, just like in previous break-ins to other systems (Gentoo, Debian, Savannah), they're taking the correct actions by shutting everything down and BEING CAREFUL. I often wonder if commercial companies are always this fastidious.

    You can't beat all the crackers, but handling a bad situation correctly should be commended. Good job, GNOME team!

    I'm eagerly awaiting 2.6, too, I may add! :)

    -Erwos

    • Re:Bad news(not)... distributed code comparison (Score:5, Interesting)

      by G4from128k ( 686170 ) on Tuesday March 23, 2004 @07:30PM (#8650564)
      With OSS, an intrusion, even a full bore compromise of the code base is more likely to be caught. I would hope that there are diligent OSS people that cross-compare their copies of the source to the CVS copies and look for disrepancies. A distributed analysis of all changes (including the officially sanctioned ones) would help uncover malicious code.

      In contrast, the users of proprietary code have only the manufacturer's word on what changes occured, who made them, and what those changes do. We users have no easy way (short of reverse engineering the code deltas on the binaries) of determining what happened between version X and version X.1. The security of non-OSS code is in nontransparent hands and that makes it insecure.

  • Oh no!! (Score:5, Funny)

    by cluke ( 30394 ) on Tuesday March 23, 2004 @06:59PM (#8650234)
    Oh my God! I hope they didn't steal any source code!!
  • Project behind in the programming? Have a 'break-in' and push off release indefinitly. Worked for the Half-life 2 team.

    In all seriousness, however, it would not be good if they did have a break in, as this is a very large, popular project.

    -CPM

  • I can imagine. (Score:3, Funny)

    by LordK3nn3th ( 715352 ) on Tuesday March 23, 2004 @07:00PM (#8650250)
    MOHAWK DAN: LOL D00DS IM IN
    sLiPkNoT696969: omg d00d hax0rs them
    p1kap1ka: hahaha pwnage u go d00d what proxy r u using
    MOHAWK DAN: WHATS A PROXY LOL
    p1kap1ka: uh... it hikes ur ip
    MOHAWK DAN: LOL WHATS AN IP TELL ME NOW THAT IM A HAX0R

  • Gnome logo? (Score:3, Insightful)

    by xot ( 663131 ) <fragiledeath&gmail,com> on Tuesday March 23, 2004 @07:01PM (#8650253) Journal
    Maybe someone desperately wanted a copy of the original Open Source Gnome LOGO!
    Besides what would one get out of breaking into an open source server.Source code thats already available? try to corrupt that? Not a good plan.
  • I hear these hackers are going to release the source
  • So what if it isn't released tomorrow? I would rather have a code that works than worry about a compromise. If only Microsoft would learn from this. Then again, they have Updates (aka bug fixes)

  • sorry wrong article (Score:3, Funny)

    by didjit ( 34494 ) on Tuesday March 23, 2004 @07:02PM (#8650269) Homepage
    Imagine a beowulf cluster of compromised gnome servers.
  • Gnomdor has fallen to the dark forces of Redmond. The Dark Lord grows in power and sends forth his armies to conquer Linux_land.

  • use the brain, luke! (Score:3, Funny)

    by Mr2cents ( 323101 ) on Tuesday March 23, 2004 @07:04PM (#8650288)
    Obviously, since gnome is a GNU/linux cornerstone, it must be coming from sco. Go get'em, feds!

    (logic used: same as in "sco.com was attacked by a worm -> it must have been a linux fan")

  • Linux security (Score:5, Insightful)

    by 0x0d0a ( 568518 ) on Tuesday March 23, 2004 @07:06PM (#8650323) Journal
    You know...honestly...

    There have been serveral major, high profile compromises of numerous FOSS servers in the past twelve months. Including a compromise of the GNU source repository.

    Microsoft has not made a big deal out of these (at least as far as I've seen). Whereas every security flaw at Microsoft is treated by Slashdot as if someone got access to the crown jewels (well, admittedly the Windows source is running around all over the place...)

    Microsoft has really been acting a lot nicer towards FOSS folks about security lapses.

    That being said, I'm just *waiting* for a sourceforge compromise. That would be a *huge* hit, and it just plain has to happen sooner or later.

    It would be nice if a couple of distributions put out basic *up-to-date* HOWTOs of best practices on how to set up minimal, secure servers using their distribution.

    • Re:Linux security (Score:5, Insightful)

      by ameoba ( 173803 ) on Tuesday March 23, 2004 @07:16PM (#8650446)
      There's a big difference. Every time a F/OSS project's box get's hacked, it's a single machine getting broken into. When there's a windows flaw, the next day there's a worm that compromises MILLIONS of computers.

      The two events are incomparable, since there are numerous ways a single box can be compromised that are not directly related to an OS flaw.

      • Re:Linux security (Score:3, Insightful)

        by LinuxHam ( 52232 )
        Every time a F/OSS project's box get's hacked, it's a single machine getting broken into

        Not necessarily true. Remember the Debian compromise? The hackers used a weak password to run a privilege escalation exploit that had been in the kernel running in MILLIONS of computers. Turned into a major kernel patch.

    • Re:Linux security (Score:3, Informative)

      by Dalcius ( 587481 )
      It would be nice if a couple of distributions put out basic *up-to-date* HOWTOs of best practices on how to set up minimal, secure servers using their distribution.

      If you ask me, anyone running a service important enough for security to be more than a casual concern should be using a distro which is secure out of the box. Minimalist distros (Gentoo comes to mind) seem a good solution here.

      When it comes to deploying a service, it should be you who makes the box insecure by adding the service, and then yo

    • Most the security breaches are the fault of.... (Score:4, Interesting)

      by SmallFurryCreature ( 593017 ) on Tuesday March 23, 2004 @07:48PM (#8650709) Journal
      Most the security breaches are the fault of bad installs. Basically the admins left a hole and someone made use of it. At worst it is an application like the ftp server that should have been patched or wasn't.

      At least as far as I been aware it never been a a OS that was at fault.

      nitpicking? Well yes. But just ask yourselve this. Gnome runs Red Hat. If there was a hole in Red Hat then why is only gnome under attack and not every Red Hat box in the world? Are linux hackers more easily satisfied and think 1 box is enough?

      So what do you think has happened here. Someone found a fault with Red hat or did someone find a fault with the Gnome setup of their Red Hat server?

      Only fools blaim MS for users who download a "keygen" that turns out to be a virus. However we do blaim MS for making holes in their software that affects every damn installation of windows out there.

      That is the difference.

      As for your howto suggestion. They exist. They just are a lot of work and most people don't bother. Hell if you follow such howto's then Windows can be made secure (rule 1 Windows is not an internet OS, run it behind a firewall that means not a firewall ON windows but windows BEHIND a firewall). I follow them. My windows/dos box has never been compromised. Neither has my linux box.

      Then again neither of my machines is supposed to do what gnomes machines are supposed to do. It is easy to secure to the outside world when nobody is supposed to access it. Fort Knox is secure because nobody is allowed in there. The highstreet bank is a lot harder to secure.

  • The GNOME mailing lists... seem to be up

    Well, now that you linked to mail.gnome.org on Slashdot, it won't be up for long!

    I wonder how many people are downloading code from the CVS servers to check for comprimised code. Their CVS was already slow at times...

  • Sorry guys (Score:5, Funny)

    by agent dero ( 680753 ) on Tuesday March 23, 2004 @07:14PM (#8650415) Homepage
    My bad, won't happen again.

    -KDE

  • OpenSSL Vulnerabilites (Score:4, Interesting)

    by Anonymous Coward on Tuesday March 23, 2004 @07:14PM (#8650420)
    From Netcraft:

    Apache/1.3.12 (Unix) (Red Hat/Linux) mod_ssl/2.6.4 OpenSSL/0.9.5a PHP/3.0.7

    Could it have anything to do with the old version of OpenSSL, and the numerous vulns found lately?

    • Re:OpenSSL Vulnerabilites (Score:3, Interesting)

      by Rich ( 9681 )
      Two things:

      1. Most distros patch holes in existing versions but do not change the version numbers.

      2. The OpenSSL holes recently were a null pointer dereferrence and a DoS - neither would lead to a compromise.
      • 2. The OpenSSL holes recently were a null pointer dereferrence and a DoS - neither would lead to a compromise.

        Remeber the openssl worm [linuxsecurity.com]? Anything less than 0.9.6e is vulnerable. And they're using 0.9.5a????

        Their versions of php and apache are both incredibly old (1.3.27 or 1.3.28 is current for apache, and PHP just released 5 RC1 with 4.3.x being current) - I hope they set up apache to lie about its versions.
    • OpenSSL were DoS issues, so its doubtful.
      http://www.openssl.org/news/secadv_20040317.txt
    • Wow, I heard a story once where someone said something about attacks only resulting from announced and patched vulnerabilities. Of course, that claim was quickly "debunked" by the slashbots. Weird.

  • This is getting annoying (Score:4, Insightful)

    by nurb432 ( 527695 ) on Tuesday March 23, 2004 @07:24PM (#8650508) Homepage Journal
    Why cant these idiots find something else to do with their time then screw up systems. ( be it some OSS project or a commercial behemoth )

    Perhaps we just need to forget the courts, and find people that do this and take care of the problem.

    All it does is make everyone's life harder, it doesn't get 'them' anywhere...

    Disclaimer: I'm not even a Gnome fan.. it's the principle.

  • gnowned! (Score:4, Funny)

    by straponego ( 521991 ) on Tuesday March 23, 2004 @07:26PM (#8650533)
    ...sorry.

  • safe system for submitting code (Score:5, Interesting)

    by Graphyx ( 643775 ) on Tuesday March 23, 2004 @07:46PM (#8650700)
    Here is what the devolopers should do.
    Each time they submit a file that they have made changes to in the cvs archive, then also hmac it and sign it with their private key. Then later on if the system was compromized you could go back and computer the hmac of the file to make sure it matches that which the programmer submitted it to be.

    And then even if the system was compromised you wouldn't have to question which ones were changed or not since it can be checked just by confirming the hmacs.

    The best design for security have perfect forward security. And a signed hmac would prove the validity of the file unless the signing key was compromised.

  • GNOME code (Score:3, Insightful)

    by endrek ( 547737 ) on Tuesday March 23, 2004 @07:50PM (#8650730) Homepage

    I'd actaulyl think the code might have been touched. The timing of the hack is interesting because it is so close to a release. If I was going to try and plant something I'd wait until just before it goes out the door in a mssive release. Less chance of getting caught and biggest dispersal oppurtunity. Sigh

    • I'd actaulyl think the code might have been touched. The timing of the hack is interesting because it is so close to a release

      The fact that this would be a good time to TRY to touch the code does not mean that they had any success.

  • FBI Task Force (Score:5, Insightful)

    by theCoder ( 23772 ) on Tuesday March 23, 2004 @08:02PM (#8650841) Homepage Journal
    So, when is the FBI going to accounce their special task force to track down these dangerous hackers? After all, isn't that what they did when the Microsoft code was leaked? Something tells me this won't even make the FBI's radar, though...

  • Kudos to the Gnome team for their timely reaction (Score:5, Insightful)

    by RichiP ( 18379 ) on Tuesday March 23, 2004 @08:08PM (#8650910) Homepage
    We have to remember that most of the people working on Gnome and/or maintaining the servers are volunteers. That said, I have to tip my hat to these people for the very professional action they provided post the compromise. Taking down the compromised server, informing the community, and, most importantly, not releasing premature statements of blame or excuses (which is more than what I can say for a lot of professional companies).

  • GNOME 2.6 Rescheduled for March 31st (Score:3, Informative)

    by twener ( 603089 ) on Wednesday March 24, 2004 @08:54AM (#8654790)
    As seen on gnome-announce [gnome.org]

Slashdot Top Deals

E = MC ** 2 +- 3db

Close