Feeds

Ubuntu unplugs compromised servers

Five out of eight systems riddled with bugs

Beginner's guide to SSL certificates

Ubuntu had to shut down five of its eight production servers last week after realising the poorly maintained systems were compromised to such an extent they had become a source of attacks against other systems.

The servers were sponsored by Canonical but hosted by the community. The systems were running an old unsupported version of Ubuntu, a factor that goes some way to explaining why they were so insecure.

Problems included missing security patches, the use of FTP (rather than a secure protocol) to access the machines, and no recent upgrades due to problems with the network cards and later kernels. Kernel upgrades were omitted because of poor backwards compatibility with the hardware Canonical supplied.

It's unclear whether or not files hosted on the servers were altered by hackers. A post-mortem by Canonical found that hacking into the systems would have been easy for any moderately skilled hacker.

"An attacker could have gotten a shell through almost any of these sites," writes James Troup, leader of the Canonical sysadmin team.

Ubuntu community members have been given the choice of either migrating the servers to Canonical's data centre or to stay on hosted servers. More on the incident can be found in Ubuntu's newsletter here. ®

Internet Security Threat Report 2014

More from The Register

next story
NSA SOURCE CODE LEAK: Information slurp tools to appear online
Now you can run your own intelligence agency
Azure TITSUP caused by INFINITE LOOP
Fat fingered geo-block kept Aussies in the dark
NASA launches new climate model at SC14
75 days of supercomputing later ...
Yahoo! blames! MONSTER! email! OUTAGE! on! CUT! CABLE! bungle!
Weekend woe for BT as telco struggles to restore service
Cloud unicorns are extinct so DiData cloud mess was YOUR fault
Applications need to be built to handle TITSUP incidents
BOFH: WHERE did this 'fax-enabled' printer UPGRADE come from?
Don't worry about that cable, it's part of the config
Stop the IoT revolution! We need to figure out packet sizes first
Researchers test 802.15.4 and find we know nuh-think! about large scale sensor network ops
SanDisk vows: We'll have a 16TB SSD WHOPPER by 2016
Flash WORM has a serious use for archived photos and videos
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Mitigating web security risk with SSL certificates
Web-based systems are essential tools for running business processes and delivering services to customers.