Submitted via IRC for BoyceMagooglyMonkey
The developers of Gentoo Linux have revealed how it was possible for its GitHub organization account to be hacked: someone deduced an admin's password – and perhaps that admin ought not to have had access to the repos anyway.
The distro's wiki has added a page describing the SNAFU. It describes the root cause of the cockup as follows:
The attacker gained access to a password of an organization administrator. Evidence collected suggests a password scheme where disclosure on one site made it easy to guess passwords for unrelated webpages.
Original link: Gentoo GitHub repo hack made possible by these 3 rookie mistakes
Another link: Gentoo Linux Github Organization repo hack was down to a series of security mistakes
Gentoo report: Project:Infrastructure/Incident Reports/2018-06-28 Github
(Score: 3, Interesting) by Anonymous Coward on Saturday July 07 2018, @01:01PM (2 children)
Just some kiddy messing about.
Ask github to implement a security feature where they produce a random password and the user has to use it. And the only way to change the password, is to another random password they provide. Then mark accounts that use that turn on the feature AND allow organizations to disallow users based on the usage of it. So, if an account sets a custom, not github-generated password, they immediately get kicked/locked out of the organization.
Basically, a light version of two factor auth / strong passwords enforcement that can be optional per organization. It won't invalidate existing accounts. Just temporarily freeze their push rights until they get their shit together.
(Score: 0) by Anonymous Coward on Saturday July 07 2018, @09:42PM
Then Microsoft github would know your password, you stupid fuck.
(Score: 2) by TheRaven on Sunday July 08 2018, @10:46AM
FreeBSD was lucky because the kiddies logged in, tried to run some GNU-flavoured commands, and then gave up when they didn't work. From the audit logs, it doesn't look as if they ever realised that they had commit access to the project's svn repo (or even what FreeBSD is). The Gentoo compromise seems a bit more deliberate.
sudo mod me up
(Score: 0) by Anonymous Coward on Saturday July 07 2018, @08:07PM
We previously had a story about the Linux Mint site getting pwned.
We followed that up with another story about how Clem and his guys reacted after their ISOs got corrupted/malware'd.
tonyPick [soylentnews.org] had a good comment on that.
In that case, their big problem boiled down to
-using closed-source software for their site.
-not updating that stuff. (They said that that was on their ToDo list, it just wasn't a priority.)
-the top guy not delegating responsibilities|not calling in help (which they ended up doing).
-- OriginalOwner_ [soylentnews.org]
(Score: 0) by Anonymous Coward on Sunday July 08 2018, @02:52PM
I like how they are open about what happened. It shows that they (hopefully) learned from the experience, and it gives others insight to avoid falling to similar. The turnaround time to rectify was great too, unlike other corporate organistions we read about which stay compromised for months or years on end.
I use Gentoo linux on some of my machines, I will continue to use it, and I will continue to trust them far more than any closed-source software company even after this mishap.
(Score: 2) by darkfeline on Monday July 09 2018, @10:28AM
See, this is why you use a password manager.
One of the arguments against is that you can come up with a pattern for every site. That way you can use a different password for each site, you don't need a password manager, and your password is just as unguessable as a random password.
Wrong! Patterns reduce your password entropy, and you are not as clever as you think; many other people have come up with the same pattern, and that pattern has already been added to password crackers.
Rookie mistake number 0: not using a password manager.
Slightly longer elaboration:
The two greatest threats to your password are: 1. website compromise and 2. phishing. You must use different passwords for each site because websites will get compromised, and you do not want to go change the password for every single account. The only viable way to remember a random password for each site is a password manager.
Your password manager should also have integration with your web browser. Phishing is wildly successful, even among people who are technically knowledgeable. You will not thoroughly check the URL and certificate on every page you log in to, because you are human. A password manager takes care of that for you, and will alert you if the URL/cert is wrong.
Bonus: you should use 2FA when it is an option. The best option is a physical key (e.g. Yubikey), next is an app on your phone. SMS sucks, but it's better than nothing. "2FA" services like Authy completely defeat the point of 2FA, so avoid them.
Join the SDF Public Access UNIX System today!
(Score: 2) by DannyB on Monday July 09 2018, @02:06PM
Google Chrome OS based on Gentoo [installgentoo.com]
Considering how much trouble Google has gone to in order to harden Chrome OS, it only makes sense that trying to compromise the upstream code would be make cents.
If you eat an entire cake without cutting it, you technically only had one piece.