Image via Wikipedia
A week after uncovering malware on several key kernel.org servers, the Linux Foundation has taken other key Websites, including Linux.com, offline for a complete reinstall.
Linux.com, LinuxFoundation.org and all sub-domains associated with these
sites were taken offline after administrators discovered “a security breach” on
Sept. 8, according to an email sent to all registered members of the sites on
Sept. 11. The servers will be completely reinstalled and will be back online “as
they become available,” Linux Foundation wrote.
This information was also posted on a holding page on all the affected
sites.
The username, password, email address and “other information” provided by
users registered with the sites may have been stolen, according to the
disclosure email. Any passwords or SSH keys used on those sites should be
considered compromised, and the foundation recommended that if any of the
passwords had been reused elsewhere, that users should change them
immediately.
“We believe this breach was connected to the intrusion on kernel.org,” Linux
Foundation said in the email.
Linux Organization officials discovered on Aug. 28 that attackers had
installed a Trojan and opened
a backdoor into kernel.org servers on Aug. 12. The attackers had logged user
activity and modified the OpenSSH client and server software installed on the
compromised server, but had not gained access to the Linux kernel source code or
other applications. The Trojan discovered on kernel.org was based on an
“off-the-shelf” rootkit called Phalanx.
The security breach is not just about information theft as it involves a
malware compromise, Paul Ducklin, head of technology for the Asia Pacific group
at Sophos, wrote on the Naked
Security blog. “If a server is ‘owned’ by malware, even the login process
should be considered untrustworthy,” Ducklin wrote, noting that malware could
steal passwords directly from memory at the time of the actual login by a user.
Related articles
- Linux.com and LinuxFoundation.org Down After ‘Security Breach’ (linearfix.wordpress.com)
- Linux.com and The Linux Foundation taken offline following security breach (geek.com)
