Submission + - Linux distributor security list compromised (zdnet.com)
andrea.sartori writes: ZDNet reports that "Hackers have compromised a private e-mail list used by Linux and BSD distributors to share information on embargoed security vulnerabilities and used a backdoor to sniff e-mail traffic, according to the moderator of the list. In a note to Vendor-Sec's members, moderator Marcus Meissner said he noticed the break-in on January 20 but warned that it might have existed for much longer.
Immediately after Meissner's warning e-mail, the attacker re-entered the compromised machine and destroyed the installation."
Meissner has since killed the list: So everyone please consider vendor-sec@....de is dead and gone at this point, successors (or not) will hopefully result out of this discussion.
The H Security notes (link to the H's article) that this isn't the first compromise of the Vendor-Sec list. In 2005, black hat hackers reportedly hijacked a kernel exploit for root access from the list.
Immediately after Meissner's warning e-mail, the attacker re-entered the compromised machine and destroyed the installation."
Meissner has since killed the list: So everyone please consider vendor-sec@....de is dead and gone at this point, successors (or not) will hopefully result out of this discussion.
The H Security notes (link to the H's article) that this isn't the first compromise of the Vendor-Sec list. In 2005, black hat hackers reportedly hijacked a kernel exploit for root access from the list.
