Feeds

Cowboy cracker nails Apache

Fluffy Bunny was also SourceForge bandit

  • alert
  • submit to reddit

Top 5 reasons to deploy VMware with Tegile

The cracker who broke into the Web servers of open source development site SourceForge has broken cover to boast of his exploits, and brag he also compromised the systems of the Apache project.

Fluffy Bunny defaced a Web site (themes.org) to list the accounts he had managed to compromise and to brag that his actions had gone unnoticed by SourceForge administrators for five months (against the week SourceForge has publicly admitted). The defacement has since been removed but can still be seen (thankfully minus confidential account information) on defacement archive Alldas.de
here

According to the posting, Fluffy Bunny obtained passwords and user names for SourceForge accounts after successfully placing a Trojan horse program on a Secure Shell (SSH) server. Apparently this was possible because Fluffy Bunny had already compromised the servers run by an ISP.

Gaining control of this SSH server, which provides a Unix command line interface for remote administration of Web servers, allowed Fluffy Bunny (in his words) to "sniff my way onto apache.org and SourceForge Web server and leave all sorts of goodies in the code".

Brian Behlendorf, president of the Apache Software Foundation, has sent a posting to developers admitting that its servers have been compromised but also downplaying fears that source code had been modified. He makes a pretty convincing argument here that attempts to do serious damage were successfully thwarted.

What remains unclear are the motives of Fluffy Bunny (other than pure mischief) for mounting the attacks in the first place.

Fluffy Bunny signed off his defacement by saying: "I'd like to thank Valinux [which runs SourceForge], Apache, Akamai and of course Exodus. Without their poor security and refusal to make security breaches known to the public I wouldn't be sitting atop a mountain of roots and oodles of proprietary software."

This statement together with Fluffy Bunny's logo - Tux the Linux penguin (complete with rabbit ears) masturbating a disproportionately large pink penis - probably mean he is no friend of the open source community... ®

Related Story

Linux hackers fall victim to crackers

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Getting ahead of the compliance curve
Learn about new services that make it easy to discover and manage certificates across the enterprise and how to get ahead of the compliance curve.