SourceForge Down After Attack [Updated] 143
Animats writes "SourceForge, a hosting site for many open source projects, is down today. Management claims they were attacked: 'We detected a direct targeted attack that resulted in an exploit of several SourceForge.net servers, and have proactively shut down a handful of developer centric services to safeguard data and protect the majority of our services.' Currently, CVS and SVN access to source code, even for reading, is unavailable, and there is no announced restoration time." (SourceForge and Slashdot are both part of Geeknet, Inc.) Update: 01/27 22:17 GMT by T : Mark Ramm of SourceForge contributes an update and some clarification: the site is up, and SVN is available, though CVS isn't. There's also a follow-up post on the site's blog.
Attack by prononymous? (Score:2)
Now who would go and attack SourceForge? Microsoft? Oracle?
I just don't see why anyone would target an OSS repository.
Re:Attack by prononymous? (Score:5, Interesting)
Well, if you wanted to sneak malicious code into an open-source project, cracking its repository might be a good way to do so.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
It's simple for the devs, now alerted to a potential compromise, to just branch the repo and do a quick diff between the last known good revision and the one on the server. I doubt a big public attack is going to compromise many projects and those it does manage to compromise are probably mismanaged anyway.
Re: (Score:2)
Um...each developer will have a working copy on their local machine. This is most likely to be the last known good version. A quick diff will show up the changes that they've recently made and they can verify that the differences are valid. It's really not that complicated.
If someone wants to go through the trouble of hacking the version control to the point it can propagate to the developers machine, stop them from reverting changes that may have been pulled down just before the repositories were locked do
Re: (Score:1)
What if the code injection were targeted at inserting history to "prove" that the project stole code from a commercial program in order to shut down/cast doubt on the open source project?
Re: (Score:2)
I have a sourceforge project. All I did was pull down the repo to another location and run a diff on my working repo and the one I pulled down. There were no unexpected differences. I'm struggling to see why this is so hard to understand. It's simple to figure out if your project has changed in an unexpected way. It also easy to overwrite the repository on the sourceforge server with a clean one if you are suspicious.
Seriously, an attack this public will not catch out many projects. And I fail to see how so
Re: (Score:2)
Checksum based integrity is a feature of modern DVCS systems such as mercurial and git.
Re: (Score:2)
Re: (Score:3)
Re: (Score:3)
Re:Attack by prononymous? (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
Re:Attack by prononymous? (Score:5, Funny)
Re:Attack by prononymous? (Score:5, Informative)
Someone who really doesn't like the new Slashdot design?
That narrows it down to...oh, probably every fucking person who visits the site.
Re: (Score:2, Funny)
Re: (Score:2)
Maybe the governments of Tunisia, Egypt, or Yemen, for example, object to these:
http://sourceforge.net/search/?q=proxy [sourceforge.net]
Re: (Score:2)
Re: (Score:3)
The attack is probably blowback from the anger over the Slashdot design changes. Misguided, of course, but understandable? You tell me.
Re:Attack by prononymous? (Score:4, Insightful)
So if Microsoft and Oracle got attacked we would all be laughing at them and making fun of their poor security. But if SourceForge got attack it is nothing but sympathy. Umm I want to know as an OpenSource Software user... How they were able to break in where was the hole. Should we be worried about our software as well.
Re: (Score:2)
Re:Attack by prononymous? (Score:4, Funny)
They know the value of all the software on SourceForge and they wanted to steal it, pirate it, hack it, reverse engineer it and put it on tor... oh, wait.
Re: (Score:2)
Right, I think anonymous is too busy with Egypt and other real world issues -- anonymous press release [youtube.com]
This has clear ulterior motives. But a OSS repo, that's really low :/ :/
Seems like an attack on our internet freedoms
Re: (Score:2)
I just don't see why anyone would target an OSS repository.
As people love to parrot here, it's for the lulz, I imagine a lot of script kiddies would close down a hospital emergency ward if they could get away with it.
Re:Attack by prononymous? (Score:4, Informative)
You are romanticizing the Yakuza. They went after poor shopkeepers as much as the wealthy.
Re:Attack by prononymous? (Score:5, Funny)
You just don't get it. Everything in glorious Nippon is perfect! One day, I will travel there and they will embrace me for my love of their cartoons.
Baka gaijin.
Re: (Score:2)
shopkeepers that were owned by the big corporations. That way the big guys come out of hiding for the missing money, and a Jackie Chan movie begins.
Hope they have checksums... (Score:2)
One hopes they have checksums when they come back up to make sure people have slipped shit in.
Re: (Score:3)
Heck with checksums. PGP/gpg signed manifest files with SHA-512 hashes for every file stored, from source code tarballs to documentation, and the PGP/gpg keys signed by multiple trustworthy keys in a WOT. This way, dropping in a fake key on a keyserver, then some signed binaries would be found out almost immediately.
For RPMs, if they are not gpg signed by someone, there is a security lapse. Same with Windows .MSI files which don't have Authenticode signatures (although the Windows certificate for a priva
Re: (Score:1)
Qui bono? (Score:2)
Re:Qui bono? (Score:4, Interesting)
Re:Qui bono? (Score:5, Insightful)
That was my thought. Everyone talks about how OSS is so secure. If you had a bone to pick with that notion, why not go over one of the highest profile examples of OSS? I'm sure that they're running Apache, right? Probably MySQL too? Surely they aren't hosting their sight on IIS and powering it with Asp.Net, are they?
It would be great if situations like this brought the entire computer using community closer together. The reality is that no matter how epicly great your software might be, there are people out there looking to bring it down. It doesn't matter if you run Microsoft, Apple or OSS. There are bugs in your applications and there are incentives for finding and exploiting those bugs.
Re: (Score:3)
I think for some projects, Linus' Law does apply -at least, it makes sense- but it obviously doesn't mean any OSS code is perfectly secure nor even that the average OSS project is more secure than proprietary code.
But I don't see how a single attack on SF proves anything; you'd have to make a study across a statistically valid sample of projects to determine if, eliminated all other variables, OSS code has or nor a better track record.
Re: (Score:3)
A study using proper sampling wouldn't necessarily mean anything, either.
Software project A could have more vulnerabilities than project B. If attackers are more interested in B for some reason, maybe it's more popular or the sites running it are more interesting, B could have more "discovered" vulnerabilities.
A correct study would have to pay someone to do a thorough security audit of source code for n major open source and closed source software projects, which would be extremely expensive, and getting t
Re:Qui bono? (Score:5, Insightful)
It isn't hyperbole when it is trotted out time and time again as one of the benefits of OSS. Stability and Security are two of the corner stones that OSS advocates build their arguments against "closed source" on top of. Some of the others are cost and portability of data.
To say that "nobody" has claimed that Apache is best ever is just as extreme of a statement as the original one I made about "everybody" talking about how secure OSS is.
Re: (Score:2)
>> Everyone talks about how OSS is so secure
Hyperbole much? Who is this *everyone*? I have not seen any claims of "so secure"
Either you're very new here, or else you have somehow managed to avoid all the articles that ever mentioned Microsoft, Apple, Oracle or any other provider of proprietary software, which is generally on slashdot sneered at for providing poor security on principle.
Re: (Score:1)
What point is there to hitting SourceForge?
Someone clearly didn't like open source. I wonder who they were..
Re: (Score:3)
Possibly a misdirection and general smoke and mirrors technique but I doubt it... Could be that they hit the wrong IP... network order error and it was 60.181.34.216 that is inside China that was the true target and not sourceforge.
Now with that IP one could glean some more info WHY an attack was necessary.... and so on.
Re: (Score:2)
To hide back doors in source code?
Why (Score:3, Interesting)
What the hell did sourceforge ever do to anyone?
I guess this could have been an attempt to spread some malware or something (by poisoning popular projects)?
Off topic: how many people actually download directly from sourceforge any more. I have to imagine the majority of users (even before the mass ubuntu influx) get their stuff second hand through their favorite distro’s repository these days. I know I haven’t been there with any regularity since my `ol slackware days *tugs pants up past waist*.
Re: (Score:3)
Re:Why (Score:5, Insightful)
If you're using OSS software on Windows, SourceForge is the place to go. This fact lends support to my hypothesis that the attack was cover for injecting malware into open-source projects. Windows is malware's biggest target, and users are beginning to gravitate towards using open source tools over piracy (mainly due to fears of malware, ironically enough). With that in mind, I guess Sourceforge was a pretty big target for crackers.
Re: (Score:1)
There is at least one very popular and highly rated piece of software on SF that distributes binaries bungled with spyware at the time of writing, this isn't related to the present event though.
Re:Why (Score:5, Insightful)
Re: (Score:3)
No it's based on OMG OMG OMG HOW THE FUCK DO THEY DARE TRY AND MAKE MONEY WITH A WAY I DON'T APPROVE OF.
It's talking about them bundling toolbars with their software. Every piece of software I've seen like that on source forge has always had an easy way to choose not to install them.
Re: (Score:1)
Why would you say that without naming the software? Without that, you'll just be (rightfully) ignored.
Re: (Score:1)
http://en.wikipedia.org/wiki/PDFCreator#Inclusion_of_malware
Re: (Score:1)
Re: (Score:2)
Of course.. but developers of software projects don't make a good target for malware injection.
Re: (Score:1)
Re: (Score:1)
I know I havenâ(TM)t been there with any regularity since my `ol slackware days *tugs pants up past waist*.
Double old-man points for using a backtick instead of a single quote
Minus 10,000 nerd points for putting it on the wrong side of "ol"
Re: (Score:2)
I build a lot of the libraries I use from source and use a lot of the dev versions, so I end up at sourceforge a decent amount of time. Actually, considering that two of the biggest python libraries are hosted on sourceforge (scipy/numpy) and I really need to update my local versions, this even kind of affects me.
Re: (Score:3)
Re: (Score:3)
What the hell did sourceforge ever do to anyone?
Sourceforge is root canal. The valley of the shadow.
The living dead.
FOSS is more than Linux -
and the bare repository of files is of no use to anyone unless you know what you are looking for.
Windows doesn't have a repository. What is does have is resources like Download.com. One-stop shopping for editorial reviews, tutorials, screenshots, demos and so on.
Re: (Score:3)
Windows users will d/l their binaries directly.
Re: (Score:1)
They have a really crappy web interface for the mailing list archives that they host.
Re:Why (Score:5, Informative)
I have to imagine the majority of users get their stuff second hand through their favorite distro's repository these days.
Yes, because everyone who uses SourceForge is on Linux. There is such a thing as open source Windows and Mac software you know.
Re: (Score:2)
it's the SCO inserting patented code for later legal action.
Re: (Score:2)
Who ever went there with any regularity? I only go there when I must download something from them. And I have to say that I wish people would stop hosting projects there, because I have more problems with sourceforge failing to deliver me pages than any other major site.
Aw, crap. (Score:4, Interesting)
Whoever you are, out there, you're not a clever geek, you're just an asshole.
Re: (Score:2)
Re: (Score:2)
This has to be a moneyed interest.
Why can't it be a government interest carpet-bombing the location of a single piece of software it finds offensive or illegal?
Re: (Score:1)
Re: (Score:2)
Obviously we have a hacker at SourceForge, climbin' in your cvs, snatchin' your projects up, tryin' to infect them so y'all need to sign your commits, switch to git/hg, sign your commits, switch to git/hg, sign your commits, switch to git/hg... hide your binaries too, cuz they're infecting everything out here...
Re: (Score:2)
This has to be a moneyed interest.
Trust me on this.
Sourceforge has probably soured more users on open source than any other website on the planet.
Re: (Score:2)
No kidding. Maybe it's being "attacked' by a good Samaritan sick of dealing with SourceForge's particular brand of unusable crap.
Hey, maybe SourceForge will actually wake up, pay attention to the site, and *improve* it as a result of this!
Nah.
Re: (Score:2)
as opposed to other hacking instances?
I miss the good old days when hacking was considered a good thing. You know, when it meant doing more with less than the bare minimum or just screwing around with your own hardware to use it in unintended ways without pissing anybody off.
Pebble in a shoe? (Score:1)
Re: (Score:2)
I can't think of none, *wink wink*, maybe someone who does not like stuff licensed under gpl, *nudge nudge*
No less than three governments are currently trying to contain revolutions or mass protests. Why can't one of them be launching attacks against open-source tools to help people communicate?
seems to be up for me (Score:2, Redundant)
sourceforge.net [sourceforge.net]
Re: (Score:2)
Password Database stolen? (Score:4, Interesting)
Slashdot (Score:5, Funny)
Unless... it was replaced with an impostor with some bad design decisions!
Re: (Score:3, Funny)
I knew something was suspicious with cmdrBurrito
Re: (Score:3)
Good thing Slashdot is still up and running!
Unless... it was replaced with an impostor with some bad design decisions!
So the bad news is that slashdot got hacked. The good news is that they fixed Idle.
Re: (Score:3)
Good thing Slashdot is still up and running!
Unless... it was replaced with an impostor with some bad design decisions!
So the bad news is that slashdot got hacked. The good news is that they fixed Idle.
Nope, I can still see it.
Re: (Score:2)
Re: (Score:2)
Good thing Slashdot is still up and running!
Unless... it was replaced with an impostor with some bad design decisions!
I see this site's owners are preparing themselves a get-out-of-jail-free card.
"See, it wasn't us! Do you seriously believe that a proper company could have fucked up so obviously and so badly?!"
possible explanation (Score:5, Interesting)
http://www.exploit-db.com/papers/15823/
You would think that the authors of Ettercap, one of the most popular
whitehat pentesting tools, would know the basics of security.
Apparently they don't, or they just don't give a shit about what
happens to their users.
So, why is their website so insecure? Ettercap's message board is
hosted at Sourceforge, so they share a server with thousands of other
customers. Every single customer is able to execute commands and
access the other project directories. Pretty stupid, eh? You only need
to find one hole in one hosted site and you can access ALL the project
databases. Of course that isn't ALoR's fault, it's Sourceforge's
fault. Regardless, people who care about security and data integrity
wouldn't use such a shitty provider, would they?
Re:possible explanation (Score:4, Insightful)
Re: (Score:2)
Re: (Score:1)
ok.
Sent from my iPhone
Re: (Score:2)
darn, messed up the formatting.
Looks like Slashdot is as insecure as SourceForge, you've messed up the whole website!
Re: (Score:2)
That doesn't make any sense.
Crazy or Stupid (Score:2)
Re: (Score:2)
Re: (Score:1)
Honestly though I'm fairly certain that 4chan has 'hacked' itself a number if times. Seriously, I'm not sure where they organize their little raids but there's a board (well or some boards) somewhere where IPs are posted for that hideously stupid LOIC program they use for their little DDoS attacks; since most of the people there are presumably completely ignorant script kiddies, it'd be trivial for someone who was bored or had some beef with 4chan to post the IP of 4chan there and the legions of idiots woul
Up for me (Score:2)
Take note when people post exploits (Score:5, Interesting)
This was posted on Full Disclosure 4 days ago. http://seclists.org/fulldisclosure/2011/Jan/424 [seclists.org]
Seems they left the backdoor open even after being notified.
Re: (Score:2)
Bullies! (Score:1)
Re: (Score:2)
This is the ultimate in bullying someone that doesn't deserve it. Kinda like the poor fat kid in middle school that got beat up by the entire football team because they didn't like the way I smelled.
I hope that you vowed to track them all down as adults, and ruin their lives one by one, causing one to go to prison for life for distributing child pornography, another to be executed for high treason by supplying atomic secrets to North Korea, another to be cast into the hellish undersea domain of The Elder Ones and yet another to be sold to Al Qaida as target practice for rabies grenades, until finally, the team captain came to you, begging on his knees, for you just to finish him quickly with a bullet
It backfired (Score:2)
SVN may be up, but SVN browsing is not (Score:2)
Switch already! (Score:2)
> SVN is available, though CVS isn't
Perhaps this is a good time to consider upgrading to git, eh? Nothing like a server outage to remind you of the problems associated with a central repository, which you probably haven't even backed up.
Re: (Score:1)
I like the new layout, but I want the old icons back
Re: (Score:2)
I like the new layout, but I want the old icons back
Don't fucking encourage them!