Newsgroup: it.fan.marco-ditri
Titolo: Perche' nessuno ne parla ?

 e una marea utenti ignari masturbavano gli apt.
eh gia', i server debian compromessi fanno notizia.
Quelli Ms o con altre distribuzioni linux tipo RedHat invece oramai non 
fanno piu' notizia, ne vengono compromessi centinaia al giorno....
C'e' da riflettere......

 non mi sembra molto full disclosure ... questo surreale silenzio mentre 
Ne hanno parlato tutti, perfino Punto Informatico.
Se intendevi 'perche` nessuno ne parla qui', e` che non c'e` molto da dire.
Gli archivi non sono stati manomessi, dopo la verifica le macchine 
interessate sono state rimesse online.
-- 
Vincenzo

 zitti zitti quatti quatti insomma ?
Mah, ripeto che non credo ci sia molto da dire. Niente trojan ne` worm 
che si autospediscono a raffica, ne` macchine che si riavviano in 10 
minuti netti di connessione Internet se non hai la patch ecc. ecc.
Solo un semplice e breve disservizio sugli archivi.
-- 
Vincenzo

Mah, ripeto che non credo ci sia molto da dire. Niente trojan ne` worm 
C'è qualcosa da dire, ma sarà fatto a tempo debito quando tutti i
dettagli saranno chiari. Chi ha colto l'occasione per commentare sulla
sicurezza di Linux ovviamente può andare affanculo fin da subito.
-- 
ciao, | (Ri)scoprire fidonet: | Chissa` cosa si prova a liberare
Marco | 
http://bbs.bofh.it/
   | la fiducia nelle proprie tentazioni. (F.D.A.)

 il massimo
  il source? i fighetti? carlocaccia, micamistaraidinuovorosicando?
 [prima di rispondermi, mettiti d'accordo con dmytri] 
-- 
SALESMEN. ANNOYED. LEAVE BOAT. U-51.

 minuti netti di connessione Internet se non hai la patch ecc. ecc.
la cosa che mi fa davvero incazzare, e' che c'e' qualcuno che se la ride per 
il fatto che sia accaduto qualcusa di spiacevole a gente che sta tentando di 
cambiare il mondo in meglio.
E non e' banale retorica.....

tentando di cambiare il >mondo in meglio. 
assolutamente no, che debian sia una delle cose migliori in assoluto sulla
faccia della terra non ci piove. Qui ce la ridiamo perchè è accaduto
qualcosa a gente arrogante, misogina, boriosa cagacazzo e brutta come il
culo. Teniamo separate le cose dalle persone. 

  [prima di rispondermi, mettiti d'accordo con dmytri] 
non sono io a scrivere ma un mio fake. Questa è l'ennessimo dispetto 
che mi viene fatto, ovvero usare il mio nik con la d minuscola e non 
camuffare l'indirizzo mail per non incorrere in morphnig.
sinceramente non è che me ne freghi molto.
-- 
Ciao, Dmitry
Posted from X-Privat Free NNTP server - 
www.x-privat.org

 Teniamo separate le cose dalle persone. 
le cose sono fatte dalle persone.....

 dettagli saranno chiari. Chi ha colto l'occasione per commentare sulla
Io mi sto chiedendo se hanno rubato qualcosa... e nel caso, perche'.
Fabrizio (oppure sto prendendo un granchio?)

Il giorno Thu, 27 Nov 2003, BowlingBPSL così ha scritto:
|Marco d'Itri wrote:
|> 
vi...@cometweb.it
 wrote:
|>
|>> Mah, ripeto che non credo ci sia molto da dire. Niente trojan ne`
|>> worm
|> C'è qualcosa da dire, ma sarà fatto a tempo debito quando tutti i
|> dettagli saranno chiari. Chi ha colto l'occasione per commentare sulla
|
|Io mi sto chiedendo se hanno rubato qualcosa... e nel caso, perche'.
  Mi ricordo della violazione del server ftp della GNU.  Chi la operò non fece
gran che, lessi che soprattutto si dimostrò interessato al furto delle password
che andavano e venivano per quel server.
  Sandro
-- 
Bellum se ipsum alet
       La guerra nutre se stessa
Livio, Ab urbe condita, XXXIV,9

http://lists.debian.org/debian-devel-announce/2003/debian-devel-announce-200311/msg00012.html
more details on the recent compromise of 
debian.org
 machines
Hi,
*NB* bear in mind that:
  a) the information on the break-in in comes from compromised machines
     and thus has to be taken with appropriate skepticism.
  b) the investigation is still ongoing - as I was writing this draft
     further information came to light which may invalidate a lot of
     it.  [Or not - as it turns out].
                              Detection
                              ---------
On November 20 it was noticed that master was kernel oops-ing
lots. While investigating this it was discovered that murphy was
showing the exact same oops, which was an overly suspicious
coincidence.  Also klecker, murphy and gluck have aide installed to
monitor filesystem changes and at around the same time it started
warning that /sbin/init had been replaced and that the mtime and ctime
timestamps for /usr/lib/locale/en_US had changed.
Investigation revealed the cause for both these things to be the
suckit root kit (see the "Suckit" appendix for more info).
                            What happened?
                            --------------
On Wednesday 19th November (2003), at approximately 5pm GMT, a sniffed
password was used to access an (unprivileged) account on
klecker.debian.org
.  Somehow they got root on klecker and installed
suckit.  The same account was then used to log into master and gain
root (and install suckit) there too.  They then tried to get to murphy
with the same account.  This failed because murphy is a restricted box
that only a small subset of developers can log into.  They then used
their root access on master to access to an administrative account
used for backup purposes and used that to gain access to Murphy.  They
got root on murphy and installed Suckit there too.  The next day they
used a password sniffed on master to login into gluck, got root there
and installed suckit.
See the "Time-line" appendix for more details on times.
                               Response
                               --------
Gluck was powered down and an image has been made of it's disks for
forensic analysis.
Since we didn't have direct physical access to klecker it's Internet
connection was shut down and disk images were made via serial console
to a local machine on a firewalled net connection.
master and murphy were kept running for a short while in order to make
an announcement of the compromise, after which they were also taken
off-line and imaged.
                               Cleanup
                               -------
After a thorough cleanup and reinstall of modified files the non-US and
security archives were verified by looking at mirror logs for changes and
comparing MD5 checksums of the files on Klecker and those on three
different trusted mirrors.
Gluck, Master and Murphy were wiped and reinstalled from CD.  data and
services are in the process of being restored.
All machines and data were checked for devices outside of /dev, suid
executables, writable files, etc. and all suspicious files were
removed.  Services (and their scripts/programs) are being compared to
known-good sources and sanity checked before being re-enabled.
Since we now knew we had compromised accounts and sniffers on our
hands we had to assume that that an unknown number of accounts were
now compromised, so all accounts were locked, passwords invalidated
and ssh authorised keys removed.
                        How could this happen?
                        ----------------------
All the compromised machines were running recent kernels[1] and were
up-to-date with almost all security updates[2].
However there was two problems.
(1) The kernels running on the machines in question didn't all get a
    ptrace fixed kernel as fast one might have liked.  Master, Klecker
    and Murphy got new kernels in May but Gluck for various reasons
    didn't get upgraded till August (although I believe it had
    /proc/sys/kernel/modprobe fixed to at least block the most common
    exploit before that).
(2) Master had a copy it's old harddrive still lying around by
    accident.  Unfortunately it had a lot of old, unpatched suid
    binaries on it.
Although these could have been the attack vector, I don't believe they
were.  (2) seems unlikely simply because master wasn't, AFAWK, the
first host compromised.  Although it's possible an attacker with local
access to gluck got root through (1), it seems unlikely they'd sit on
that for <n> months and then use it on several machines only to
comeback and rootkit several 
debian.org
 machines and at least one
(that we know of) other unrelated system at the same time (and which
didn't have an extended ptrace vulnerability exposure.)
Based on that and the forensics on the unrelated system mentioned
above, I believe that there was an as of yet unknown local root
exploit used to go from having local unprivileged access to having
root.
                        Where do we go from here?
                        -------------------------
Unfortunately due to the fact there is (I believe) an unknown local
root exploit in the wild, we can't yet unlock the Debian accounts.
Obviously we can't continue without LDAP accounts for very long
either.  At the moment I'd ask for a little more patience both a)
while the painful and painstaking task of restoring machines one by
one is completed and b) while we try and exhaust all reasonable
avenues of investigation to determine how the attacker went from
unprivileged to root.
Obviously we're looking at hardening our boxes and tightening up our
procedures to try and stop this from happening again.  I'll send more
details on that later.
	   	       Finally
		       	      	       -------
Developers worried about their own machines might like to have a look
at:
 
http://www.wiggy.net/debian/developer-securing/
================================================================================
                              Appendices
                              ~~~~~~~~~~
Thanks
- ------
 o Adam Heath and Brian Wolfe for their work on master & murphy.
 o Wichert Akkerman for his work on klecker.
 o Dann Frazier and Matt Taggart for their work on gluck.
 o Michael Stone and Robert van der Meulen for their forensics work.
 o Jaakko Niemi for his work on checking and re-enabling 
lists.debian.org
.
 o Colin Watson for his work on checking and re-enabling 
bugs.debian.org
.
 o Josip Rodin for his work on checking and re-enabling the lists web archives.
[This text is based on a draft by Wichert Akkerman.]
========================================
Time-line
- ---------
All times in GMT.
o Klecker init timestamp: Nov 19 17:08
o Master sk timestamp: Nov 19 17:47
o Murphy sk timestamp: Nov 19 18:35
o Oopses on Murphy start: Nov 19 19:25
o Oopses on Master start: Nov 20 05:38
o Gluck init timestamp: Nov 20 20:54
========================================
Suckit
- ------
Suckit is a rootkit which installs a sniffer, a process hider, a file
hider and a backdoor login in a running kernel. Apparently there was a
flaw in its kernel code which caused the kernel to oops on master and
murphy. This also explained why /sbin/init was replaced: the new init
loads suckit into the kernel and then proceeds to start the real init,
making sure that it is still active after a reboot.
========================================
Footnotes:
[1] Klecker: 2.4.22, Master & Murphy: 2.4.21-rc2, Gluck: 2.4.22rc2
[2] klecker was missing the latest postgresql updated.  ssh on all
    machines was a DSA-customized version which was missing only the
    3rd and final round (i.e. Solar Designer's patches) of ssh
    updates.
========================================
P.S. As always, I speak only for myself.


 delle password
Quindi non si tratta di furto di segreti industriali (oddio, non si
tratta di Microsoft, ma magari hanno qualcosa che gradirebbero
sviluppare in santa pace), ma soltanto di... uh, "trombata a spregio",
per usare un'espressione di qualcuno che conosco?
Fabrizio



  Ad occhio e croce direi di si.
  Ormai lo saprete tutti, ma le ultime notizie sulla compromissione Debian:
http://story.news.yahoo.com/news?tmpl=story&ncid=1817&e=1&u=/zd/20031201/tc_zd/113591&sid=96120751
Researchers Find Serious Vulnerability in Linux Kernel
Mon Dec 1,12:42 PM ET
    Add Technology - Ziff Davis to My Yahoo!
Dennis Fisher - eWEEK
Security professionals took note of a critical new vulnerability in the Linux
(news - web sites) kernel that could enable an attacker to gain root access to
a vulnerable machine and take complete control of it. An unknown cracker
recently used this weakness to compromise several of the Debian Project's
servers, which led to the discovery of the new vulnerability.
[...]
(tra parentesi)
Sabato, al LinuxDay di Roma, ho incontrato uno sviluppatore Debian
statunitense, a Roma per un contratto di sviluppo, ha raccontato delle
incredibili policy di "sicurezza" che seguono alla GNU, tipo file di
configurazione di sistema scrivibili da chiunque.  Fin'ora alla GNU è andata
fin troppo bene. Non mettere "segreti industriali" nei server GNU è _la_
policy GNU anzi, la policy dev'essere piuttosto: "non esistono segreti
industriali, non devono esistere segreti industriali, i segreti industriali
sono antisociali"
(chiusa parentesi)


Il giorno Tue, 2 Dec 2003, A.Vito Candela così ha scritto:
|Hola, Alessandro Selli! [it.fan.marco-ditri]
|
|> Non mettere "segreti industriali" nei server GNU è _la_
|> policy GNU anzi, la policy dev'essere piuttosto: "non esistono segreti
|> industriali, non devono esistere segreti industriali, i segreti industriali
|> sono antisociali"
|
|Perche' allora puntare tutto sulle potenzialita` di sicurezza di Linux
|quando non esiste nessun dato da mettere in sicurezza?
  Non parlare di Linux quando hai uno GNU davanti a te!  :-)



:Provate a guardare gli ingredienti del famoso Labello che si usa per
:le labbra screpolate: Butirrospermum Parkii (sperma di maiale).