Have y'all seen this??

Questions about the project and the distribution - obviously no support questions here please
Post Reply
User avatar
jokersloose
Level 4
Level 4
Posts: 301
Joined: Sun Mar 02, 2008 6:44 pm
Location: Laramie, WY

Have y'all seen this??

Post by jokersloose »

Craig_Dem
Level 2
Level 2
Posts: 85
Joined: Sat Aug 22, 2009 3:16 pm

Re: Have y'all seen this??

Post by Craig_Dem »

Keep Updated and check the md5sum of files.
AMD Phenom 9550 Quad-Core Processor | ATI Radeon X1200 | Arch Linux | Gnome
2.66 GHz Intel Core 2 Duo | NVIDIA GeForce 9400 | Mac OS X 10.6.4 |
If your question is answered edit your topic title and add [SOLVED] to the beginning of it.
User avatar
jokersloose
Level 4
Level 4
Posts: 301
Joined: Sun Mar 02, 2008 6:44 pm
Location: Laramie, WY

Re: Have y'all seen this??

Post by jokersloose »

What if someome downloads from the rep's? Are they still safe? It did say the source file was what was infected.
SxFlare
Level 2
Level 2
Posts: 62
Joined: Sun Sep 13, 2009 4:48 am

Re: Have y'all seen this??

Post by SxFlare »

it was just a mirror download, you need to have gotten the tar.gz from that specific server link that was compromised.
So the numbers are a decent number, but most probably not as high as hinted in that article.
User avatar
Midnighter
Level 6
Level 6
Posts: 1324
Joined: Tue May 22, 2007 1:52 pm
Location: Western Australia

Re: Have y'all seen this??

Post by Midnighter »

Yes, seen it. One single thing was compromised, and no one thought to do a check til they discovered it months later. Carelessness.

That said, it's an IRC server, on one mirror. Never even heard of it myself, and doubt many others have either, or use it. Not exactly a "big name" project, never even heard of it before now. Likely done to show how slack their housekeeping is.

As for tha above suggestion about comparing MD5 hashes, if they can replace the file itself, I doubt replacing the MD5 is any challenge.
If you accept - and I do - that freedom of speech is important, then you are going to have to defend the indefensible. That means you are going to be defending the right of people to read, or to write, or to say, what you don't say or like or want said.
User avatar
Midnighter
Level 6
Level 6
Posts: 1324
Joined: Tue May 22, 2007 1:52 pm
Location: Western Australia

Re: Have y'all seen this??

Post by Midnighter »

Best summed up here http://www.itworld.com/security/110942/ ... ecure-ever

Linux is as secure as ever
Which doesn't mean that idiots can't foul-it-up.
June 14, 2010, 12:33 PM —

There have been several stories proclaiming that a recent Linux infection proves Windows malware monopoly is over and that Think Linux is free from malware? Think again; it's been hacked. Much as it pains me to disagree with the good people, they're wrong.

Here's what really happened. UnrealIRCd, a rather obscure open-source IRC (Internet Relay Chat) server, wasn't so much hacked as the program it was letting people download has been replaced by one with a built-in security hole. Or, as they explained on their site,

"This is very embarrassing...

We found out that the Unreal3.2.8.1.tar.gz file [the source code for UnrealIRCd] on our mirrors has been replaced quite a while ago with a version with a backdoor (Trojan) in it. This backdoor allows a person to execute ANY command with the privileges of the user running the ircd. The backdoor can be executed regardless of any user restrictions (so even if you have passworded server or hub that doesn't allow any users in).

It appears the replacement of the .tar.gz occurred in November 2009 (at least on some mirrors). It seems nobody noticed it until now.

Obviously, this is a very serious issue, and we're taking precautions so this will never happen again, and if it somehow does that it will be noticed quickly. We will also re-implement PGP/GPG signing of releases. Even though in practice (very) few people verify files, it will still be useful for those people who do."

So what does that mean? First, there's no new, or old for that matter, security hole in Linux at all. What happened was that this one group let someone replace the program they were shipping with one that had been deliberately designed to let other people into it to run commands on your Linux computer.

There's nothing too surprising about this. Historically, IRC, which is sort of a CB radio of instant messaging services, has always had one major security problem after another. Indeed, IRC has often been used in the past to run Windows botnets. I strongly suspect whoever replaced the UnrealIRCd has been using it for running Windows botnets.

Let me spell it out for you. Even before this latest fiasco, no one who cares about security was letting IRC clients or servers run on their systems. It's always been too easy to abuse.

In this particular case, the group behind UnrealIRCd were just dumb about tracking their own program. Clearly, they never bothered to check their own code. The users, by virtue of the fact that they were running IRC in the first place, don't get any prizes for being bright either. After all, they were running IRC: Case closed.

If you really must run an IRC server, might I suggest you use Bahamut or IRCD-Hybrid. You'll still run into security problems, but, from what I'm told by my IRC using friends, they have the most helpful technical support communities.

In any case, the real problem here isn't with Linux. It's a problem that can, and has, popped up in any operating system. If you install a hacked application, I don't care if you otherwise have the most secure system on Earth, you've just opened it up for attack.

Now Linux isn't the most secure system in the world by default. That honor probably goes to OpenBSD. But, unlike Windows, which is insecure by design, Linux's designers are far more successful at making it secure. But, if you don't believe me, perhaps you'll believe Dell about Linux's security. Dell may be far better known for its Windows PCs than for its Linux line, but even they admit, "Ubuntu is safer than Microsoft Windows."

One final word though. Any system can be hacked. As the saying goes, "security is not a product, it's a process." Windows, Linux, OpenBSD, whatever, if you don't work on keeping your PC or server safe, it will eventually be successfully attacked. But this, this example, is really a case of bad security mistakes piling on top of each other and not an indictment of Linux.
If you accept - and I do - that freedom of speech is important, then you are going to have to defend the indefensible. That means you are going to be defending the right of people to read, or to write, or to say, what you don't say or like or want said.
Post Reply

Return to “Non-technical Questions”