Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Main GNU source repository server compromised

savannah.gnu.org

Post reply on HN
Print view View original

31–40 of 47 posts

Re: Main GNU source repository server compromised

#31

Post by rryyan »

dkarl wrote: post #13
Sandman wrote: post #2

I see a lot of angry comments on their webpage, people asking why somebody would do this. Well, the real answer is probably - simply because he/she could. And to all of those wondering how anybody could do this to a project that hosts free software, well, the attackers don't really care. They saw the exploit and used it. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as sim…

Maybe someone had an idea for putting a vulnerability into a GNU utility. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as simple as SQL injection. Seconded. But then again, the GNU source code is mostly C, isn't it? They're used to doing things that most developers would consider intractable and therefore impossible to do safely: such as comprehensively sanitizing inputs…

Going further: how about a vulnerability in every program compiled with gcc? I'll just leave this here:

http://cm.bell-labs.com/who/ken/trust.html

Re: Main GNU source repository server compromised

#32

Post by there »

btilly wrote: post #27
tptacek wrote: post #26

Earlier quoted context omitted.

No. You are not done with SQL injection just because you use "bind variables". Plenty of things can't be parameterized that are nonetheless subject to user influence. Click the top of any reverse-sortable column in a web user interface to see one obvious example. Parameterized queries are a good thing, and you should use them, but I feel like I've had to be a broken record about this over the last week: they are not…

Click the top of any reverse-sortable column in a web user interface to see one obvious example. People don't do those in JavaScript? That's what I did a decade ago. Well, then I moved it back to the server after we got tired of the performance problems that JavaScript had back then. But today it wouldn't be an issue. And when we moved it back, we were careful not to have an SQL injection attack. If memory serves we…

People don't do those in JavaScript?

when you have to add pagination to sorting, you have to send the sort column to the database server.

Re: Main GNU source repository server compromised

#33

Post by prodigal_erik »

Sandman wrote: post #2

I see a lot of angry comments on their webpage, people asking why somebody would do this. Well, the real answer is probably - simply because he/she could. And to all of those wondering how anybody could do this to a project that hosts free software, well, the attackers don't really care. They saw the exploit and used it. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as sim…

The code might be much worse than anything they would have written themselves. http://en.wikipedia.org/wiki/GNU_Savannah explains they started with a fork of the SourceForge code, and they seem to still be on it (the Python/Django rewrite isn't complete). It's not obvious what SourceForge was written in, but http://sourceforge.net/apps/trac/sourceforge/wiki/Open%20Sou... shows an awful lot of PHP dependencies, and the site dates back to 1999, a time when the worst of PHP's myriad design flaws (such as register_globals and magic_quotes) were widely embraced.

Re: Main GNU source repository server compromised

#34

Post by sandGorgon »

Question - if they had been using a DVCS which checksums every commit, would they have been safer ? Presumably, you could build a tool that stores a list of checksums and if you had to do a restore, that tool could validate the backup.

Or is it that, with a little effort, DVCS' can be hacked/corrupted fundamentally ?

Re: Main GNU source repository server compromised

#35

Post by JoachimSchipper »

sandGorgon wrote: post #34

Question - if they had been using a DVCS which checksums every commit, would they have been safer ? Presumably, you could build a tool that stores a list of checksums and if you had to do a restore, that tool could validate the backup. Or is it that, with a little effort, DVCS' can be hacked/corrupted fundamentally ?

I don't think DVCS would have helped in any way. It's not the repository server itself that was compromised, AFAIK, but "only" the web interface. This allows password recovery and thus allows people to e.g. make malicious commits from a trusted account, but that would be no less true if there were a DVCS under it all.

Re: Main GNU source repository server compromised

#36

Post by sandGorgon »

JoachimSchipper wrote: post #35
sandGorgon wrote: post #34

Question - if they had been using a DVCS which checksums every commit, would they have been safer ? Presumably, you could build a tool that stores a list of checksums and if you had to do a restore, that tool could validate the backup. Or is it that, with a little effort, DVCS' can be hacked/corrupted fundamentally ?

I don't think DVCS would have helped in any way. It's not the repository server itself that was compromised, AFAIK, but "only" the web interface. This allows password recovery and thus allows people to e.g. make malicious commits from a trusted account, but that would be no less true if there were a DVCS under it all.

agreed - but my question still stands: Take SVN for instance - if I managed to hack into a SVN server, can I change the source code (under SVN management) in a way that would be undetectable ?

Repeat the same question for git, mercurial and CVS.

Re: Main GNU source repository server compromised

#37

Post by riffraff »

dkarl wrote: post #13
Sandman wrote: post #2

I see a lot of angry comments on their webpage, people asking why somebody would do this. Well, the real answer is probably - simply because he/she could. And to all of those wondering how anybody could do this to a project that hosts free software, well, the attackers don't really care. They saw the exploit and used it. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as sim…

Maybe someone had an idea for putting a vulnerability into a GNU utility. Personally, I expected that a project such as Savannah wouldn't be vulnerable to an attack as simple as SQL injection. Seconded. But then again, the GNU source code is mostly C, isn't it? They're used to doing things that most developers would consider intractable and therefore impossible to do safely: such as comprehensively sanitizing inputs…

I'm pretty sure savannah is php, forked from the original *forge code, so not really a fault of the people who wrote ls and gcc.

Re: Main GNU source repository server compromised

#38

Post by konad »

omouse wrote: post #19
konad wrote: post #15

Earlier quoted context omitted.

lol, pwned twice in 7 years, "incredibly talented hackers" lololololo

All the programmers are working on other web-based stuff. We need more volunteers, how about YOU konad?

I work on another operating system, good luck with your endeavours.

Re: Main GNU source repository server compromised

#39

Post by konad »

konad wrote: post #16
SriniK wrote: post #12

What a moran whoever did this.

“But he has nothing on at all,” said a little child at last. “Good heavens! listen to the voice of an innocent child,” said the father, and one whispered to the other what the child had said. “But he has nothing on at all,” cried at last the whole people. That made a deep impression upon the emperor, for it seemed to him that they were right; but he thought to himself, “Now I must bear up to the end.” And the chamber…

point missed

Re: Main GNU source repository server compromised

#40

Post by brucebanned »

pjscott wrote: post #21
tjarratt wrote: post #17

Earlier quoted context omitted.

I believe it's more that they are a visible target, being in the media and spreading their message as much as they do. Were they a small company that hosted internal webapps (for example) they probably wouldn't have been targeted as much. Imagine, for a moment, if these two attacks in seven years were successful, how many unsuccessful attacks there were as well. Most, if not all, software after a certain point of com…

In any sufficiently large group of people, you're going to have assholes. To dismiss the people who've put so much good work into the GNU project would be offensive if it weren't so foolish; it says more about the poster than about the GNU folks. Also, consider the source: http://news.ycombinator.com/user?id=konad Two previously banned accounts. It looks like HN is better than this, as a whole.

With around 900 karma between them.
Post reply on HN