Free software repository brought down in hack attack
Got root?
Customer Success Testimonial: Recovery is Everything
The main source-code repository for the Free Software Foundation has been taken down following an attack that compromised some of the website's account passwords and may have gained unfettered administrative access.
The SQL-injection attacks on GNU Savannah exploited holes in Savane, the open-source software hosting application that was spun off from SourceForge, Matt Lee, a campaigns manager for the Free Software Foundation, told The Register. The attackers were then able to obtain the entire database of usernames and hashed passwords, some of which were decrypted using brute-force techniques.
Project managers took GNU Savannah offline on Saturday, more than 48 hours after the attack occurred. They expect to bring the site back online on Wednesday, although they're not guaranteeing it will be fully functional. Out of an abundance of caution, restored data will come from a backup made on November 24, prior to the compromise. Lee said there's no reason to believe any of the source code hosted on the site was affected by the breach.
“Version control systems that are in place for these projects actually would show a red flag in terms of any changes that they made, and we've not seen that, so we believe there's no issue there,” he explained. What's more, there's no indication that the FTP server used to actually transfer source code was compromised, he said.
The attackers used their access to add a hidden static HTML file to a CVS repository and a webpage that defaced the gnu.org home page. After finding a directory that was erroneously set to execute PHP scripts, the hackers also committed a PHP reverse shell script.
“They then proceeded to try a ton of root kits on the gnu.org webserver,” according to a time line provided by Lee. “We don't think they succeeded in getting root, but they may have.”
Project managers spent much of the weekend restoring the GNU website to its original state. Even after those steps were begun, the members discovered “that the cracking activity had resumed on www.gnu.org through PHP reverse shells running as user www-cvs,” the timeline said. “Realizing that the problem was much worse than we assumed at first, we immediately isolated the Savannah cluster and the GNU website from the network and start[ed] a deeper analysis.”
Managers said that all unsalted MD5 passwords stored on Savannah should be considered compromised and will have to be reset before the accounts can be re-enabled. The encrypted password scheme will also be upgraded to Crypt-MD5 (/etc/shadow's), and user password strength will be checked.
Lee said that Savane was already in the midst of an overhaul before the attack. It being open-source software that anyone can audit, one might have expected the SQL injection vulnerability to have been discovered and fixed long ago. To be fair, GNU.org is by no means the only popular open-source project to have been ransacked by hackers. Over the past 13 months, the heavily fortified website for the Apache Software Foundation has been breached twice. ®
COMMENTS
To be fair, fairer, fairest...
"It being open-source software that anyone can audit, one might have expected the SQL injection vulnerability to have been discovered and fixed long ago. To be fair, GNU.org is by no means the only popular open-source project to have been ransacked by hackers."
To be fair, it being open-source software that anyone can audit, one might have expected the SQL vuln to have been exploited long ago (if it was that trivial).
To be "fairer", the raise in attacks against open-source repos is quite interesting. I can see two possible explanations:
1. open-source software has "gained" so much "traction" with the "market" (as the strategy boutiques put it) that it's become a wothy target for miscreants.
2. traditional target products (read Microsoft, Adobe, etc) are finally putting their act together and are increasingly harder to crack, comparatively making traditional strongholds look weaker than before.
To be the "fairest", both factors probably contribute, and I would hazard to say that it's a good sign for open-source software, as in most cases the code repositories were compromised, not the customer systems. When you think about it as a "customer" sysadmin, it feels much safer than MS /et al/ systems where the miscreants target YOU directly. Well, unless you're running Savane with MD5 hashes, but who in their right mind uses MD5 nowadays? ;-)
Semi-troll post, hence the icon.
pretend we don't know what you're referencing
What password mechanism do you think security experts are now advocating?
Password hashes
The cryptanalytic attacks I've seen against MD5 and SHA-1 have been collision attacks, and so wouldn't weaken those hashes for secret-verification purposes. They weaken the hashes as verifiers for known pre-images, as in digital-signature applications.
Performance advances in brute-forcing hashes - rainbow tables, GPU clusters, etc - reduce the workload of finding a matching pre-image. But that applies to any hash algorithm that doesn't have a known attack better than brute-force for reversal. According to reports, Roth's attack (the Amazon EC2 GPU cloud one you refer to) just created SHA-1 rainbow tables for short passwords. The problem there isn't with SHA-1; it's with short passwords.
The fix isn't to change algorithms. It's to require strong passwords and use salts. Or better yet, drop the antiquated password mechanism entirely, as many security experts have long advocated.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Customer Success Testimonial: Recovery is Everything
