Re: [PLUG] Gentoo hacked on Github

[Rich Freeman <r-plug@thefreemanclan.net>]

On Fri, Jun 29, 2018 at 10:34 AM jeff <jeffv@op.net> wrote:
>
> https://nakedsecurity.sophos.com/2018/06/29/linux-distro-hacked-on-github-all-code-considered-compromised/
>

The headline is a bit sensationalized.  Obviously the entire
compromised org was taken down, but the reality is that almost nobody
would be using it for anything but contributing pull requests.  Also,
the modifications don't appear to be likely to actually work - they
were clearly not tested (not that bad things couldn't have been done -
just that it probably wasn't super-planned-out and what was done was
buggy).  Three repos were ultimately tampered with.  However, the
article does get right that the situation was handled conservatively
to minimize the risk of any impact to users/etc, and was announced
about as quickly as possible once the people busy containing the
damage had set things in motion to actually shut things down.

The somewhat-more-detailed running update is at:
https://infra-status.gentoo.org/notice/20180629-github

As I understand it the account used to compromise the org was secured
by github, and has been returned to the rightful owner, and the org
will be configured to require 2FA.  Another dev's password was
evidently also compromised but he was using 2FA so there was only a
failed 2FA attempt on the account.  The bigger concern was how the
passwords were obtained in the first place - whether they were just
super-weak (not many failed attempts were logged), or if they were
sniffed somewhere.  I doubt it was sniffed off of Gentoo's own servers
because if they were they'd already have access to do much worse
attacks than the one against github that mainly impacted people
submitting PRs and such.

-- 
Rich
___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug