Re: budget dual-head advice?

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Security breach on kernel.org

Security breach on kernel.org
https://www.kernel.org/

Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We discovered
this August 28th. While we currently believe that the source code repositories were unaffected, we are in
the process of verifying this and taking steps to enhance security across the kernel.org infrastructure.

There is more information on their home page.

keith

--

Keith R. Watson                        Georgia Institute of Technology
IT Support professional Lead           College of Computing
keith.watson@...             801 Atlantic Drive NW
(404) 385-7401                         Atlanta, GA 30332-0280

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Re: Security breach on kernel.org

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Re: Security breach on kernel.org

I'd hate to see a Trojan get into the kernel and auto update to my PC.  
Hopefully, that's not likely.  Hopefully, it's not possible.

Ron

On 9/1/2011 8:10 AM, Watson, Keith wrote:
> Security breach on kernel.org
> https://www.kernel.org/
>
> Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We
discovered this August 28th. While we currently believe that the source code repositories were
unaffected, we are in the process of verifying this and taking steps to enhance security across the
kernel.org infrastructure.
>
>
> There is more information on their home page.
>
> keith
>
> --
>
> Keith R. Watson                        Georgia Institute of Technology
> IT Support professional Lead           College of Computing
> keith.watson@...             801 Atlantic Drive NW
> (404) 385-7401                         Atlanta, GA 30332-0280
>
>    

--

-- 

(PS - If you email me and don't get a quick response, you might want to
call on the phone.  I get about 300 emails per day from alternate energy
mailing lists and such.  I don't always see new messages very quickly.)

Ron Frazier

770-205-9422 (O)   Leave a message.
linuxdude AT c3energy.com

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Re: Security breach on kernel.org

On Thu, 2011-09-01 at 08:42 -0400, Jim Kinney wrote: 
> Major bad news. They host loads of code.

Read the articles.  Several machines were compromised but not all.
Compromised machines have been taken off line for diagnostics and
reinstallation.  A number of developers (close to 500) are having to
change their ssh keys, which sucks.

Bad but highly unlikely to have any impact on the source code thanks to
the nature of git and the highly distributed development model along
with cryptographically secure hashes and history on every single file.
They'd need a time machine to go back and poke changes into past sources
and change sets and they're need a transporter to get to all the
thousands of machines hosting git repos at developer sites for the
development their development.  They're validating the the change sets
and hashes but it's unlikely to contain anything and it's unlikely the
sources have been contaminated.  Unexpected changes should show up
rapidly to the subsystem maintainers as unexpected conflicts or
validation checks or unapproved changes sets.

http://www.linux.com/news/featured-blogs/171-jonathan-corbet/491001-the-cracking-of-kernelorg

He points out that the sources are distributed from kernel.org but are
developed on and hosted all over the world.

Regards,
Mike

> On Sep 1, 2011 8:14 AM, "Watson, Keith" <krwatson@...> wrote:
> > Security breach on kernel.org
> > https://www.kernel.org/
> >
> > Earlier this month, a number of servers in the kernel.org infrastructure
> were compromised. We discovered this August 28th. While we currently believe
> that the source code repositories were unaffected, we are in the process of
> verifying this and taking steps to enhance security across the
> kernel.orginfrastructure.
> >
> >
> > There is more information on their home page.
> >
> > keith
> >
> > --
> >
> > Keith R. Watson Georgia Institute of Technology
> > IT Support professional Lead College of Computing
> > keith.watson@... 801 Atlantic Drive NW
> > (404) 385-7401 Atlanta, GA 30332-0280
> >
> >
> >
> > _______________________________________________
> > Ale mailing list
> > Ale@...
> > http://mail.ale.org/mailman/listinfo/ale
> > See JOBS, ANNOUNCE and SCHOOLS lists at
> > http://mail.ale.org/mailman/listinfo
> 
> _______________________________________________
> Ale mailing list
> Ale@...
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo

--

-- 
Michael H. Warfield (AI4NB) | (770) 985-6132 |  mhw@...
   /\/\|=mhw=|\/\/          | (678) 463-0932 |  http://www.wittsend.com/mhw/
   NIC whois: MHW9          | An optimist believes we live in the best of all
 PGP Key: 0x674627FF        | possible worlds.  A pessimist is sure of it!

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Re: Security breach on kernel.org

Git is an amazing tool with sha1 signatures for stored objects and using
a DVCS means that pretty much anyone anywhere in the world can compare
all the code changes between any dates they like.  Every kernel
developer would need to have been cracked for me to worry.

Having the "public" ssh-keys isn't all that worrisome to me either. Am I
missing something important?  The way that Git works is you push your
public ssh-key to the remote server and use that for remote commands to
the repository.  That key cannot connect back to your system. It only
works through git or ssh commands initiated by the user. Can it be used
to hop systems? I don't think so, not without the private key.  Sure,
someone could swap out the git and ssh programs with Trojans. We'll know
more about that soon enough.

I'm not worried at all about the kernel sources.  Even if one of the
core 5 kernel maintainers (and there are more than that) were
compromised and trojans were installed on all their systems, there are
enough untainted versions (probably thousands) available to validate the
code. I'd be surprised if that weren't already completed.

Sure, I'd change my ssh-keys if I were a core contributer.  `ssh-keygen`
isn't **that big of a deal.**  Then `ssh-copy-id` pushes the new keys to
remote systems pretty easily.  Used it yesterday on a new VM.

What am I missing?

On 09/01/2011 09:13 AM, Ron Frazier wrote:
> I'd hate to see a Trojan get into the kernel and auto update to my PC.  
> Hopefully, that's not likely.  Hopefully, it's not possible.
> 
> Ron
> 
> On 9/1/2011 8:10 AM, Watson, Keith wrote:
>> Security breach on kernel.org
>> https://www.kernel.org/
>>
>> Earlier this month, a number of servers in the kernel.org infrastructure were compromised. We
discovered this August 28th. While we currently believe that the source code repositories were
unaffected, we are in the process of verifying this and taking steps to enhance security across the
kernel.org infrastructure.
>>
>>
>> There is more information on their home page.
>>
>> keith
>>
_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Re: Security breach on kernel.org

JD <jdp@...> writes:

> Git is an amazing tool with sha1 signatures for stored objects and using
> a DVCS means that pretty much anyone anywhere in the world can compare
> all the code changes between any dates they like.  Every kernel
> developer would need to have been cracked for me to worry.

I'm not worried about the kernel code.  I'm worried about all the other
repositories that kernel.org mirrors!

-derek

--

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/    PP-ASEL-IA     N1NWH
       warlord@...                        PGP key available
_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Re: Security breach on kernel.org

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Re: Security breach on kernel.org

On Thu, Sep 1, 2011 at 11:46 AM, JD <jdp@...> wrote:
> Having the "public" ssh-keys isn't all that worrisome to me either. Am I
> missing something important?  The way that Git works is you push your
> public ssh-key to the remote server and use that for remote commands to
> the repository.  That key cannot connect back to your system. It only
> works through git or ssh commands initiated by the user. Can it be used
> to hop systems? I don't think so, not without the private key.  Sure,
> someone could swap out the git and ssh programs with Trojans. We'll know
> more about that soon enough.
<snip>
>
> Sure, I'd change my ssh-keys if I were a core contributer.  `ssh-keygen`
> isn't **that big of a deal.**  Then `ssh-copy-id` pushes the new keys to
> remote systems pretty easily.  Used it yesterday on a new VM.
>
> What am I missing?

My guess is that it's more of (as Jim alluded to) reinstalling the
pubkeys.  They don't want to copy the old ones over wholesale incase
an attacker replaced/added pubkeys to peoples authorized_keys files --
they'd just be giving him access again.

I can't think of any attack that would be made possible with a
legitimate pubkey -- after all, they're called public keys for a
reason.

(This is all just conjecture, I don't know what the thinking of the
kernel.org admins is.)

--

-- 
David Tomaschik, RHCE, LPIC-1
System Administrator/Open Source Advocate
OpenPGP: 0x5DEA789B
http://systemoverlord.com
david@...

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo

Re: Security breach on kernel.org

Mike,

Why DO the developers need to change their private SSH keys?  I hope
they were not stored on the compromised systems.

In my book I discuss special procedures to cover very high security
situations which kernel.org certainly qualifies as.  One part is to keep
the private ssh keys (and other crypto keys) OFFline to avoid being
compromised from the Internet.

Bob Toxen
http://www.verysecurelinux.com        [Network&Linux security consulting]
http://www.realworldlinuxsecurity.com [My book:"Real World Linux Security 2/e"]
Quality Linux & UNIX security and SysAdmin & software consulting since 1990.
Quality spam and virus filters.

On Thu, Sep 01, 2011 at 09:21:06AM -0400, Michael H. Warfield wrote:
> On Thu, 2011-09-01 at 08:42 -0400, Jim Kinney wrote: 
> > Major bad news. They host loads of code.
> 
> Read the articles.  Several machines were compromised but not all.
> Compromised machines have been taken off line for diagnostics and
> reinstallation.  A number of developers (close to 500) are having to
> change their ssh keys, which sucks.
> 
> Bad but highly unlikely to have any impact on the source code thanks to
> the nature of git and the highly distributed development model along
> with cryptographically secure hashes and history on every single file.
> They'd need a time machine to go back and poke changes into past sources
> and change sets and they're need a transporter to get to all the
> thousands of machines hosting git repos at developer sites for the
> development their development.  They're validating the the change sets
> and hashes but it's unlikely to contain anything and it's unlikely the
> sources have been contaminated.  Unexpected changes should show up
> rapidly to the subsystem maintainers as unexpected conflicts or
> validation checks or unapproved changes sets.
> 
> http://www.linux.com/news/featured-blogs/171-jonathan-corbet/491001-the-cracking-of-kernelorg
> 
> He points out that the sources are distributed from kernel.org but are
> developed on and hosted all over the world.
> 
> Regards,
> Mike
> 
> > On Sep 1, 2011 8:14 AM, "Watson, Keith" <krwatson@...> wrote:
> > > Security breach on kernel.org
> > > https://www.kernel.org/
> > >
> > > Earlier this month, a number of servers in the kernel.org infrastructure
> > were compromised. We discovered this August 28th. While we currently believe
> > that the source code repositories were unaffected, we are in the process of
> > verifying this and taking steps to enhance security across the
> > kernel.orginfrastructure.
> > >
> > >
> > > There is more information on their home page.
> > >
> > > keith
> > >
> > > --
> > >
> > > Keith R. Watson Georgia Institute of Technology
> > > IT Support professional Lead College of Computing
> > > keith.watson@... 801 Atlantic Drive NW
> > > (404) 385-7401 Atlanta, GA 30332-0280
> > >
> > >
> > >
> > > _______________________________________________
> > > Ale mailing list
> > > Ale@...
> > > http://mail.ale.org/mailman/listinfo/ale
> > > See JOBS, ANNOUNCE and SCHOOLS lists at
> > > http://mail.ale.org/mailman/listinfo
> > 
> > _______________________________________________
> > Ale mailing list
> > Ale@...
> > http://mail.ale.org/mailman/listinfo/ale
> > See JOBS, ANNOUNCE and SCHOOLS lists at
> > http://mail.ale.org/mailman/listinfo
> 
> -- 
> Michael H. Warfield (AI4NB) | (770) 985-6132 |  mhw@...
>    /\/\|=mhw=|\/\/          | (678) 463-0932 |  http://www.wittsend.com/mhw/
>    NIC whois: MHW9          | An optimist believes we live in the best of all
>  PGP Key: 0x674627FF        | possible worlds.  A pessimist is sure of it!

> _______________________________________________
> Ale mailing list
> Ale@...
> http://mail.ale.org/mailman/listinfo/ale
> See JOBS, ANNOUNCE and SCHOOLS lists at
> http://mail.ale.org/mailman/listinfo

_______________________________________________
Ale mailing list
Ale@...
http://mail.ale.org/mailman/listinfo/ale
See JOBS, ANNOUNCE and SCHOOLS lists at
http://mail.ale.org/mailman/listinfo