LXer: Hackers obtained access to FreeBSD servers

LXer · 11-17-2012, 07:32 PM

Published at LXer:

Unauthorised access has been detected on two of the FreeBSD project's servers. Whether manipulated software was distributed remains unclear

Read More...

H_TeXMeX_H · 11-18-2012, 02:35 AM

Make sure to read the full article:

Quote:

To understand the impact of this compromise, you must first understand that the FreeBSD operating system is divided into two parts: the "base" maintained by the FreeBSD community, and a large collection of third-party "packages" distributed by the Project. The kernel, system libraries, compiler, core command-line tools (e.g., SSH client), and daemons (e.g., sshd(8)) are all in the "base". Most information in this advisory refers only to third-party packages distributed by the Project.

No part of the base FreeBSD system has been put at risk. At no point has the intruder modified any part of the FreeBSD base system software in any way. However, the attacker had access sufficient to potentially allow the compromise of third-party packages. No evidence of this has been found during in-depth analysis, however the FreeBSD Project is taking an extremely conservative view on this and is working on the assumption that third-party packages generated and distributed within a specific window could theoretically have been modified.

http://www.freebsd.org/news/2012-compromise.html

I like the fullness of the report. I hope Linux does a similar report next time, because their last report was lacking.