Linux Foundation Confirms Malware Attack

Foundation advises users to change passwords following exploit of kernel.org, used to distribute the Linux kernel.

The Linux Foundation last week emailed all of its users, warning them that an attacker had compromised LinuxFoundation.org and Linux.com, as well as their subdomains. The attacker may also have stolen usernames, email addresses, and passwords.
The attack was discovered on Thursday, and the foundation is still conducting a full audit of the affected sites. We are in the process of restoring services in a secure manner as quickly as possible, it said in a notice posted on the front page of the
Linux Foundation
website.
For now, the foundation doesnt know the full extent of the intrusion, and recommended that users change their passwords when the site comes back online. As with any intrusion and as a matter of caution, you should consider the passwords and SSH keys that you have used on these sites compromised, it said. It also warned Linux Foundation users who might have
reused their passwords
on other websites to change those passwords immediately.
Given the password warning, did the Linux Foundation fail to secure the passwords, for example by storing them as plain text, rather than salting and hashing them? Not necessarily, said Paul Ducklin, head of technology for Sophos in the Asia Pacific region, in a
blog post
This breach appears to involve a malware compromise, not merely the unauthorized retrieval of data from the servers. If a server is owned by malware, even the login process should be considered untrustworthy. Passwords could therefore have been stolen directly from memory during login, even though they were never written to disk.
The Linux Foundation thinks that the attack on its website is related to last months
kernel.org
intrusion, which likewise remains offline while its administrators audit the site, working with authorities in the United States and Europe.
In a statement that was previously posted to the site, the Linux Kernel Organization said it discovered that on August 28, a number of its servers had been compromised, with an attacker gaining root access. While we currently believe that the source code repositories were unaffected, we are in the process of verifying this and taking steps to enhance security across the kernel.org infrastructure, according to the statement.
Both kernel.org servers, as well as the computer of at least one person who helps maintain the kernel, were infected with malware, according to
The Register
, in a breach that lasted at least 17 days before being detected. While that might sound alarming, Linux experts said that Kernel.org doesnt house the code base, but rather only distributes it.
In addition, no changes could be made to the distributed code without alarms sounding. The code for the kernel (and for many other projects) is managed with the git source code management system. And git does not allow the code to be modified by third parties without people knowing about it, said Jonathan Corbet, executive editor of LWN.net, in a
blog post
.
Notably, a 160-bit cryptographic hash is generated for every set of Linux code changes. The key to the hash function is that, if the contents of the file change, the hash will change too, said Corbet. Creating any new file matching the hash of an existing file is not really possible; if you want that new file to look like the old one with the exception of a bit of hostile code, the challenge is even bigger.
Still, he said, as a member of the Linux kernel development community, I can say that this episode is disturbing and embarrassing.
The vendors, contractors, and other outside parties with which you do business can create a serious security risk. Heres how to keep this threat in check. Also in the new, all-digital issue of Dark Reading: Why focusing solely on your own companys security ignores the bigger picture.
Download it now
. (Free registration required.)

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Linux Foundation Confirms Malware Attack