Linux.com Hacked

By Gerowen
in Back Page News

 Share

Recommended Posts

Grand Master

Gerowen

Posted
Posted

Following on the heels of a breach of kernel.org, the internet holding place for the Linux kernel, Linux.com and its related sites have been breached. Details of the attack are unknown at this time, but as of this writing I get a message from Linux.com telling me it's down for maintenance. Here is an e-mail I just received from the head-sheds at Linux.com, and below that is a screenshot of Linux.com as of right now.

  Quote
Attention Linux.com and LinuxFoundation.org users,

We are writing you because you have an account on Linux.com,

LinuxFoundation.org, or one of the subdomains associated with these domains.

On September 8, 2011, we discovered a security breach that may have

compromised your username, password, email address and other information you

have given to us. We believe this breach was connected to the intrusion on

kernel.org.

As with any intrusion and as a matter of caution, you should consider the

passwords and SSH keys that you have used on these sites compromised. If you

have reused these passwords on other sites, please change them immediately.

We are currently auditing all systems and will update public statements when

we have more information.

We have taken all Linux Foundation servers offline to do complete

re-installs. Linux Foundation services will be put back up as they become

available. We are working around the clock to expedite this process and are

working with authorities in the United States and in Europe to assist with

the investigation.

The Linux Foundation takes the security of its infrastructure and that of

its members extremely seriously and are pursuing all avenues to investigate

this attack and prevent future ones. We apologize for this inconvenience and

will communicate updates as we have them.

Please contact us at info@linuxfoundation.org with questions about this

matter.

The Linux Foundation

post-125978-0-73981200-1315780883.png

Link to comment
https://www.neowin.net/forum/topic/1024650-linuxcom-hacked/
Share on other sites
Grand Master

+Majesticmerc MVC

Posted
  • MVC
Posted

It's worth noting that despite the problems the sites are having, none of the kernel code has been compromised, so Linux is still perfectly safe to use.

====

On a sidenote, that is some epic huge spam right there.

Grand Master

remixedcat

Posted
Posted

ouch mozillazine could have a possibility to be affected:

take a look!

Domain mozillazine.org

Netblock owner Oregon State System of Higher Education

IP address 140.211.166.65

Domain linux.com

Netblock owner Oregon State System of Higher Education

IP address 140.211.169.32

same datacenter!!!!!!! NOT GOOD.

Grand Master

Roger H. Veteran

Posted
  • Veteran
Posted

Wait, kernel.org was hacked last week too if i'm not mistake. We haven't gotten a new cyanogenmod in so long because the github repo couldn't sync with the source or something like that. Seems someone's out to get Linux (maybe it's Apple and Microsoft :shifty:)

Grand Master

nukenorman

Posted
Posted

So was Linux.com website using Linux server if it was hacked?

I guess this would disprove the theory that Linux is almost unhackable.

PS: Why would hackers want to hack a linux and open source website? I thought hackers liked Linux because its free and people contribute to it and its non profit unlinke MS and Apple.

Grand Master

Gerowen

Posted
  • Author
Posted
  On 12/09/2011 at 00:08, nukenorman said:

So was Linux.com website using Linux server if it was hacked?

I guess this would disprove the theory that Linux is almost unhackable.

PS: Why would hackers want to hack a linux and open source website? I thought hackers liked Linux because its free and people contribute to it and its non profit unlinke MS and Apple.

Depending on the group, some hackers hack just to hack. Hackerleaks.tk, which was up just a month or so ago, was a website where people could go brag about their latest hack. They had posts where people had broken into the most random stuff, with no larger objective apparent.

Anything is hackable, with enough time and knowledge about your target. People who say Linux is "unhackable" are naive. I like it because it just works and is easier for me to manage and have positive control over, but it is by no means perfect or "unhackable".

Grand Master

Roger H. Veteran

Posted
  • Veteran
Posted
  On 12/09/2011 at 00:08, nukenorman said:

PS: Why would hackers want to hack a linux and open source website? I thought hackers liked Linux because its free and people contribute to it and its non profit unlinke MS and Apple.

It's Sunday and script kiddies are bored - that's basically all the reason needed.

Grand Master

ichi

Posted
Posted
  On 12/09/2011 at 00:08, nukenorman said:

So was Linux.com website using Linux server if it was hacked?

I guess this would disprove the theory that Linux is almost unhackable.

PS: Why would hackers want to hack a linux and open source website? I thought hackers liked Linux because its free and people contribute to it and its non profit unlinke MS and Apple.

IIRC kernel.org was hacked because of a weak password and the guys who did it weren't actually targeting kernel.org, it probably just popped up in an automated scan.

Almost anything can be hacked, but if people use weak passwords and/or poor administration practices you don't even need to look for actual vulnerabilities on the platform. I know several medium/big companies where half of their HPUX servers have root passwords like "temporary" or "admin" *shrug*

Grand Master

Gerowen

Posted
  • Author
Posted

So there's been an update posted to the page you get when you visit www.linux.com .

  Quote
Linux Foundation infrastructure including LinuxFoundation.org, Linux.com, and their subdomains are down for maintenance due to a security breach that was discovered on September 8, 2011. The Linux Foundation made this decision in the interest of extreme caution and security best practices. We believe this breach was connected to the intrusion on kernel.org.

We are in the process of restoring services in a secure manner as quickly as possible. As with any intrusion and as a matter of caution, you should consider the passwords and SSH keys that you have used on these sites compromised. If you have reused these passwords on other sites, please change them immediately. We are currently auditing all systems and will update this statement when we have more information.

We apologize for the inconvenience. We are taking this matter seriously and appreciate your patience. The Linux Foundation infrastructure houses a variety of services and programs including Linux.com, Open Printing, Linux Mark, Linux Foundation events and others, but does not include the Linux kernel or its code repositories.

Please contact us at info@linuxfoundation.org with questions about this matter.

The Linux Foundation

*** UPDATE***

We want to thank you for your questions and your support. We hope this FAQ can help address some of your inquiries.

Q: When will Linux Foundation services, such as events, training and Linux.com be back online?

Our team is working around the clock to restore these important services. We are working with authorities and exercising both extreme caution and diligence. Services will begin coming back online in the coming days and will keep you informed every step of the way.

Q: Were passwords stored in plaintext?

The Linux Foundation does not store passwords in plaintext. However an attacker with access to stored password would have direct access to conduct a brute force attack. An in-depth analysis of direct-access brute forcing, as it relates to password strength, can be read at http://www.schneier.com/blog/archives/2007/01/choosing_secure.html. We encourage you to use extreme caution, as is the case in any security breach, and discontinue the use of that password if you re-use it across other sites.

Q: Does my Linux.com email address work?

Yes, Linux.com email addresses are working and safe to use.

Q: What do you know about the source of the attack?

We are aggressively investigating the source of the attack. Unfortunately, we can't elaborate on this for the time being.

Q: Is there anything I can do to help?

We want to thank everyone who has expressed their support while we address this breach. We ask you to be patient as we do everything possible to restore services as quickly as possible.

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Microsoft employee behind AnduinOS releases more updates, here's how to upgrade

      By dustojnikhummer · Posted

      Maybe, just maybe... and it isn't you... there are some people who like the Windows 11 UI (for whatever reason) and want a better backend.
    • Gundams to arrive in Call of Duty: Mobile with new mech mode and unique third-person combat

      By zikalify · Posted

      Gundams to arrive in Call of Duty: Mobile with new mech mode and unique third-person combat by Paul Hill Activision has announced that Call of Duty: Mobile will see the launch of Season 6 “Gundams Arrive” on July 2 at 5PM Pacific Time. This major collaboration between the world’s most popular FPS franchise and the Gundam franchise will introduce a new, limited-time mode called Gundam Team Deathmatch where 8 players will face off 4v4 and pilot Gundam-themed operators such as Ethan - Freedom Gundam, Reaper - Sazabi Gundam, Proton - v Gundamo, Deathscythe Gundam (EW). When playing in this game mode, players will notice a switch from the usual first-person view to the third-person perspective. The new game mode will also feature specific abilities and weapons that are unique to Gundam suits rather than player loadouts. The new Gundam Team Deathmatch mode will be played on a new map called interstellar space station, which has been designed for this mode. When playing, you’ll discover that the mech suits offer specialized mobility such as dodge, sprint, and vertical jets. In the post-match, players will be able to watch Gundam operator animations with unlockable rewards for viewing. You can unlock more animations by participating in Gundam Team Deathmatch, normal Multiplayer, and Battle Royale modes. There will also be Gundam-themed in-game events, such as Survival of the Fittest, which will give players free rewards like the new legendary weapon J358 — Fin Funnel v Gundam, Urban Tracker — Defense Force, Cyro Bomb — Haro (reskin), Emote — Haro Team, new camos, and more. Players will also be able to obtain a variety of items through Season 6 Battle Pass free and premium tiers, including sci-fi-themed Operators and Weapon Blueprints. Players on the free tier will get access to the bolt-action 3-Line Rifle based on a World War II design and is capable of inflicting high damage with high accuracy. Free tier players will also have the chance to earn other rewards such as Skins, Weapons Blueprints, Vault Coins, and more. Players looking to spend money can get the Premium Pass. These players will have a chance to get all of the content from Season 6 including tactical warriors like Silver — Chrome Dome Reskin, Misty — Science Pilot, Atlas — Dust Ranger, and The Marshal — Rock Hound; and Weapon Blueprints like the BP50 — Pathripper, Oden — Maevwat Technical, PDW-57 — Rocket Re-Entry, BY15 — Dark Moon, and the 3-Line Rifle — Geo Thermal Line, based on the new Season 6 weapon. There’s also Battle Pass Subscription which gives you additional monthly rewards along with a 10% boost to Player and Weapon XP, discount coupons, and limited discounts on 10x crate pulls. Activision also stated that Mythic Drops are returning to the Mythic store and that Battle Pass Vault is getting Season 9 — Zombies Are Back (2022) and Season 6 — Templar's Oath (2023).
    • Senua's Saga: Hellblade II to get 60FPS mode, dev commentary, and more alongside PS5 launch

      By +Random Stranger · Posted

      I managed to buy the original Hellblade: Senua’s Sacrifice through the ps app on my phone even though it was not showing up in the ps store when browsing from my ps5 it was buggy but more or less O.K.ish to play… I wonder if this original added version is funny fixed up for ps5 play
    • Microsoft failed to fix Windows Vista startup sound in Windows 11, but it is not giving up

      By LiLmEgZ · Posted

      Download old Windows Startup Sounds @ https://www.winhistory.de/more/winstart/winstart_en.htm
    • Microsoft failed to fix Windows Vista startup sound in Windows 11, but it is not giving up

      By binaryzero · Posted

      Pffft no

  • Recent Achievements

    • Week One Done
      pcdoctorsnet earned a badge
      Week One Done
    • Rising Star
      Phillip0web went up a rank
      Rising Star
    • One Month Later
      Epaminombas earned a badge
      One Month Later
    • One Year In
      Bert Fershner earned a badge
      One Year In
    • Reacting Well
      ChrisOdinUK earned a badge
      Reacting Well

  • Popular Contributors

    1. 1
      +primortal
      549
    2. 2
      ATLien_0
      205
    3. 3
      +FloatingFatMan
      171
    4. 4
      Michael Scrip
      151
    5. 5
      Som
      131
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!