View difference between Paste ID: i4LFsQPW and
SHOW:
|
|
- or go back to the newest paste.
1 | - | |
1 | + | Monsters in the pastebin - better read at http://kernel.org |
2 | ||
3 | ---------- Forwarded message ---------- | |
4 | From: J.H. <warthog9@kernel.org> | |
5 | Date: 2011/8/29 | |
6 | Subject: [kernel.org users] [KORG] Master back-end break-in | |
7 | To: users@kernel.org | |
8 | ||
9 | ||
10 | -----BEGIN PGP SIGNED MESSAGE----- | |
11 | Hash: SHA1 | |
12 | ||
13 | Afternoon Everyone, | |
14 | ||
15 | As you can guess from the subject line, I've not had what many would | |
16 | consider a "good" day. Earlier today discovered a trojan existing on | |
17 | HPA's personal colo machine, as well as hera. Upon some investigation | |
18 | there are a couple of kernel.org boxes, specifically hera and odin1, | |
19 | with potential pre-cursors on demeter2, zeus1 and zeus2, that have been | |
20 | hit by this. | |
21 | ||
22 | As it stands right now, HPA is working on cleaning his box, and | |
23 | I'm working on hera (odin1 and zeus1 are out of rotation still for other | |
24 | reasons), mainly so that if one of us finds something of interest, we | |
25 | can deal with it and compare notes on the other box. | |
26 | ||
27 | Points of interest: | |
28 | ||
29 | - - Break-in seems to have initially occurred no later than August 12th | |
30 | ||
31 | - - Files belonging to ssh (openssh, openssh-server and openssh-clients) | |
32 | were modified and running live. These have been uninstalled and | |
33 | removed, all processes were killed and known good copies were | |
34 | reinstalled. That said all users may wish to consider taking this | |
35 | opportunity to change their passwords and update ssh keys (particularly | |
36 | if you had an ssh private key on hera). This seems to have occurred on | |
37 | or around August 19th. | |
38 | ||
39 | - - A trojan startup file was added to rc3.d | |
40 | ||
41 | - - User interactions were logged, as well as some exploit code. We have | |
42 | retained this for now. | |
43 | ||
44 | - - Trojan initially discovered due to the Xnest /dev/mem error message | |
45 | w/o Xnest installed; have been seen on other systems. It is unclear if | |
46 | systems that exhibit this message are susceptible, compromised or not. | |
47 | If you see this, and you don't have Xnest installed, please investigate. | |
48 | ||
49 | - - It *appears* that 3.1-rc2 might have blocked the exploit injector, we | |
50 | don't know if this is intentional or a side affect of another bugfix or | |
51 | change. | |
52 | ||
53 | - - System is being verified from backups, signatures, etc. As of right | |
54 | now things look correct, however we may take the system down soon to do | |
55 | a full reinstall and for more invasive checking. | |
56 | ||
57 | - - As a precaution a number of packages have been removed from the | |
58 | system, if something was removed that you were using please let us know | |
59 | so we can put it back. | |
60 | ||
61 | - - At this time we do not know the vector that was used to get into the | |
62 | systems, but the attackers had gained root access level privileges. | |
63 | ||
64 | That's what we know right now, some of the recent instabilities may have | |
65 | been caused by these intrusions, and we are looking into everything. | |
66 | ||
67 | If you are on the box, keep an eye out, and if you see something please | |
68 | let us know immediately. | |
69 | ||
70 | Beyond that, verify your git trees and make sure things are correct. | |
71 | ||
72 | - - John 'Warthog9' Hawley | |
73 | Chief Kernel.org Administrator | |
74 | -----BEGIN PGP SIGNATURE----- | |
75 | Version: GnuPG v1.4.11 (GNU/Linux) | |
76 | Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/ | |
77 | ||
78 | iEYEARECAAYFAk5a5U0ACgkQ/E3kyWU9dif+1ACfYPlgq/keFrFO77AmQVduKGwx | |
79 | TAcAnRAu6nHt74+5aC+fPeb8aT0hcy2K | |
80 | =Semd | |
81 | -----END PGP SIGNATURE----- |