Novell OpenSUSE Server Hacked

abelikoff writes "Both LinuxWorld Australia and SuSE Linux Forums report that OpenSUSE website got hacked last night." This story was submitted quite a number of times.

Details of the hack?

[Trigulus]

Was this a targeted attack? Did they just fall victim to a script? Unpatched vulnerability? Weak password? what? Im just asking cause none of the links provided answer this.

Re:Linux Secure By Design?

[scronline]

Speaking from personal experience, 85% of all hacks come from poor administration. ie. not patching flaws, weak passwords, poor security measure such as file permissions and lack of firewalls. The remaining 15% come from a mixture of things, and like it or not, 14.999% of that is Windows. Security through obscurity doesn't work when you have thousands of people pounding at your code just trying to find a way in.

All these Worms on the net is a perfect example. And when you get down to it, even some of the poor administration is Microsoft's fault for making it "so easy you don't need an experienced technician...." When in fact they bury stuff so deep unless you know where it is, the necessary changes don't get made leaving everything as default.

I can't even begin to count how many times I've gone to a customer's location where they had an employee that was a self proclaimed geek that did all the setup and everything was not only wrong, it opened gaping holes on their network. Including things like having a USER logging in as Administrator on the server and using it as a workstation.

Plus I won't go into all the people who hold an MCSE that never touched a computer until they went to a 2 week bootcamp on how to pass the tests.

But, point in fact, any closed source application is subject to flaws that don't get patched because it's a small enough flaw that putting a programmer on it to fix it would cost more than keeping the flaw hidden.

Re:Rights or not

[Otter]

Often, that's a good comeback, but this time...the crackers' message is in English. michaelzhao's response is in English. Where does Arabic come into the equation?

Especially since Iranians a) speak Farsi, not Arabic, and b) aren't Arabs.

That IS the breach of security.

[khasim]

Allowing "users" to setup their own box, on your network, outside your firewall, using your IP address IS a breach of security.

Re:Practical upshot? Am I safe?

[Spudley]

No. It was just the WiKi server that went down.

My question is: Why bother hacking a Wiki? Can't you just make your own changes to it anyway?

The public image of the open source community.

[CyricZ]

I think it is time for the open source community, as a whole, to better consider its public image. Incidents like this, involving one of the premiere Linux vendors, do unfortunately tarnish the image of our community quite badly. And then you have rogue open source developers publically insulting users [slashdot.org]. Such incidents make people remember open source software for all the wrong reasons.

Now, perhaps this is just a case of amateurs being allowed to join a community that mainly consisted of academics and professionals. The high standards that the open source community once enjoyed are being degraded on a daily basis by developers who cannot write secure code (ie. many PHP developers), by developers who blatantly insult and ridicule their users (ie. the KOffice example earlier in this post), or companies that provide insecure, open source-based products.

Is there much that can be done about this? I'm not sure.

Nope, it isn't in Iran

[Toba82]

It's not being hosted in Iran. It's hosted in the US by Virtuoso Net Solutions inc. I sent this email to [e-mail] yesterday about 7 PM (I sent them my real info, obviously):

        Dear Sir/Madam:
The OpenSuSE website was defaced either today or yesterday by an Iranian
hacker clan whose website is located on your servers. I checked the
whois data for the hacker clan's domain (ihsteam.com):

      Majid NT
      Bl Sajjad-milad 7 no. 12
      Mashhad 8735452575
      Iran

IP of the website (according to whois records of the ip, it is owned by
your company):

        147.202.64.138

References:

http://www.opensuse.org/ [opensuse.org]
http://www.ihsteam.com/ [ihsteam.com]

In case the sites above have been changed, I've attached an compressed
archive saves of their main pages. I hope you'll see that ihsteam.com
is in direct violation of your AUP.

        Sincerely,
        Name
        Phone
        Email

They haven't replied yet, and the website is still up. But it IS a weekend.

Re:Don't blame LINUX

[Digital Dharma]

Actually, I disagree. I've been running Windows networks for over a decade without a single virus or spyware infection. Interestingly, we've had a nearly identical amount of successful hacks on both our web-facing Windows and Linux machines. I would say I'm pretty much on par with the Linux admin in terms of skills and knowledge, and we are both in agreeance that no matter what you do, eventually you will get hacked. Just like you will eventually be a victim of some sort of crime in the Real World, if you spend enough time in it. With a combination of flaws and ignorance / mistakes, every OS under the sun is suceptable to penetration, regardless of how skilled the Admin is. Just ask the Linux admin at my place of work, who lost a server thanks to a vendor-coded exploit [secunia.com]. It happens. Live, learn, patch and move on.

To the Linux Bashers:

[Liam Slider]

Just a note. Anything can be hacked given enough patience, enough time, enough resources, and enough basic knowledge. There is no such thing as a 100% secure system, unless you are talking about a system that has been unplugged, encased in concrete, and sunk to the bottum of the ocean. Even then, I wouldn't be too sure. In other words, best that can be done is to make it a challenging thing to do. There is no system that cannot be penetrated by a talented hacker. This one, evidentally, from what I've read, was fairly talented...not your average script kiddie.

So lay off alright?