7 ms·

Gentoo GitHub Organization hacked

210 points by ryanlol 8y ago

Crontab 8y ago
What kind of a dick would do this to Gentoo, who makes everything available to everyone? I don't understand the world sometimes.
- adiack 8y ago
  I suspect white teen, under 17. See incident report: 20:34:xx Malicious commit to gentoo/gentoo, 73b72409->fdd8da2e adds readme.me file with text niggers. source: https://wiki.gentoo.org/wiki/Github/2018-06-28 https://wiki.gentoo.org/wiki/Github/2018-06-28
- gcbw2 8y ago
  gentoo is the poster child (real or tongue in cheek, doesn't matter) of the tech forum on 4chan.
  - linkmotif 8y ago
    What do you mean? Also I haven’t noticed a tech board on 4chan...
    - bdz 8y ago
      http://knowyourmeme.com/memes/install-gentoo http://knowyourmeme.com/memes/install-gentoo
    - aroman 8y ago
      4chan has many boards, including /g/, the technology board. Sarcastically (and sometimes non-sarcastically) recommending new users to install Gentoo is a longstanding tradition on the board, alongside other gentoo-related memes. For instance: https://wiki.installgentoo.com/index.php/Main_Page https://wiki.installgentoo.com/index.php/Main_Page I sincerely hope 4chan users aren't responsible for this, though.
      - zyx321 8y ago
        >I sincerely hope 4chan users aren't responsible for this, though. If there is a severe security issue either in GitHub infrastructure or in the Gentoo Foundation's procedures which would allow this kind of breach, having them revealed by a stupid prank is one of the best outcomes you can hope for.
      - prolikewhoa 8y ago
        /g/ is fairly calm and civil at least when put into perspective of the rest of 4chan.
    - klodolph 8y ago
      Some of them have been deleted. Some of them were text-only and didn’t show up on the main index.
    - swebs 8y ago
      He's referring to /g/
- 21 8y ago
  Someone who wants to steal crypto for example. Being able to inject a crypto stealer in a major distribution surely motivates a lot of people to try.
  - kchr 8y ago
    Someone with such long term goals would most likely not do it as noisy and destructive as this attack seems to be (delete all files, rename the Github org, etc.).
xiii1408 8y ago
What was the modified version of the GitHub page?? Looks like it was taken down before I could get there. Crossing my fingers they added jokes about Stallman and muh freedums.
- kayfox 8y ago
  The title read: Linux For N____es The N word being _that_ N word. The logo was also changed to something that implied watermelon eating.
  - delinka 8y ago
    then ... wouldn't it be "...ers"? Otherwise, I have no idea what _that_ N word is. EDIT: Using the archive link below, it's the one ending "...roes"
  - ryanlol 8y ago
    LFN is actually a long running open source project by the US LGBT charity GNAA with the aim of making computing truly accessible and fun for everyone. https://encyclopediadramatica.rs/Linux_for_Niggers https://encyclopediadramatica.rs/Linux_for_Niggers https://www.assembla.com/code/linuxforniggers/git/nodes https://www.assembla.com/code/linuxforniggers/git/nodes
    - mschuster91 8y ago
      GNAA? Seriously? They were old news when I was active on Wikipedia and that's over 12 years ago.
    - rablo 8y ago
      I miss you guys a lot. Where on irc are you now? d2j
  - deleted 8y ago
    [deleted]
  - swebs 8y ago
    Is "negroes" supposed to be a super offensive word now?
spork12 8y ago
Was probably opal
- EFruit 8y ago
  Who is opal?
  - ryanlol 8y ago
    Famous IRC artist.
    - ronsor 8y ago
      yeah you don't want opal on your IRC network
      - mschuster91 8y ago
        > yeah you don't want opal on your IRC network One of these "DCC 0 0 0" spammers getting people with crappy firewall middleboxes disconnected?
        badrabbit 8y ago
        No,a PM/channel troll&spammer. but his persistence and discipline really merits the title of an artist.
        deleted 8y ago
        [deleted]
        deleted 8y ago
        [deleted]
        JeremyBanks 8y ago
        Don’t glorify misbehaviour.
        8y ago
mistrial9 8y ago
side note -- there is another FOSS org that was repeatedly, specifically attacked around the end of 2015, but they chose not to publicize it.. made worse because the volunteer community around the server admin was immediately far outside their comfort zone to implement fixes and recovery. The MediaWiki instance as well as raw servers were affected. No discussion in public about likely perpetrators. but what can you say ? How can you prove it? Commercial vendor rivals, nation-state actors, mean junkies, all of the above? Harsh and UN-necsessary .. everything was volunteer and above-board at the FOSS group, just too valuable ?
- mchristen 8y ago
  You can't just tell that story w/o namedropping....
  - jooV1Bei 8y ago
    Probably talking about FSF. Employees of backconnect.com including Tucker Preston and Marshall Webb DDoSed them for a while to land them as clients for their DDoS protection service. https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/ https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has... (ctrl-f FSF)
rablo 8y ago
Dammit... l0de can’t keep getting away with it. I recommend you call him during his radio hour.
- raziel2p 8y ago
  Who is l0de? Are you implying they are the ones who did this?
  - neur0h 8y ago
    l0de doesnt actually do anything except smoke meth and live off donations from his sycophant army on Efnet. It was probably one of his followers/listeners though because this had been announced weeks before on his radio show
boudin 8y ago
Seems than the person replaced ebuilds in portage with versions that are supposed to delete all files but that don't actually work. https://archives.gentoo.org/gentoo-dev/message/03df77a347ec75a9b1ceaab3a2f76ee8 https://archives.gentoo.org/gentoo-dev/message/03df77a347ec7...
contingencies 8y ago
I am a long term Gentoo user, but honestly I feel Gentoo's security stance is pretty bad, for example https://bugs.gentoo.org/show_bug.cgi?id=597804 https://bugs.gentoo.org/show_bug.cgi?id=597804 Their high friction contribution process with essentially requisite 'accredited developer' status is a major contributing factor. Edit: Hah! Posting here got the bug updated within 10 minutes :)
- tyil 8y ago
  Have you considered Funtoo yet? It's a fork of Gentoo, led by the creator of Gentoo.
Bromskloss 8y ago
What changes were made?
- kchr 8y ago
  Apparently the Github organization title and logo was changed, along with a couple of packages edited to contain scripts that were supposed to erase all files on user computers. The Github repos are just backups of the main package archives, so it would only affect users manually downloading packages from there (which is not the case if you haven't explicitly changed your system config to use those repos for some reason).
k_sze 8y ago
Wait... did they not use 2FA?!

210 points by ryanlol 8y ago

What kind of a dick would do this to Gentoo, who makes everything available to everyone? I don't understand the world sometimes.

adiack 8y ago
I suspect white teen, under 17. See incident report: 20:34:xx Malicious commit to gentoo/gentoo, 73b72409->fdd8da2e adds readme.me file with text niggers. source: https://wiki.gentoo.org/wiki/Github/2018-06-28 https://wiki.gentoo.org/wiki/Github/2018-06-28
gcbw2 8y ago
gentoo is the poster child (real or tongue in cheek, doesn't matter) of the tech forum on 4chan.
- linkmotif 8y ago
  What do you mean? Also I haven’t noticed a tech board on 4chan...
  - bdz 8y ago
    http://knowyourmeme.com/memes/install-gentoo http://knowyourmeme.com/memes/install-gentoo
  - aroman 8y ago
    4chan has many boards, including /g/, the technology board. Sarcastically (and sometimes non-sarcastically) recommending new users to install Gentoo is a longstanding tradition on the board, alongside other gentoo-related memes. For instance: https://wiki.installgentoo.com/index.php/Main_Page https://wiki.installgentoo.com/index.php/Main_Page I sincerely hope 4chan users aren't responsible for this, though.
    - zyx321 8y ago
      >I sincerely hope 4chan users aren't responsible for this, though. If there is a severe security issue either in GitHub infrastructure or in the Gentoo Foundation's procedures which would allow this kind of breach, having them revealed by a stupid prank is one of the best outcomes you can hope for.
    - prolikewhoa 8y ago
      /g/ is fairly calm and civil at least when put into perspective of the rest of 4chan.
  - klodolph 8y ago
    Some of them have been deleted. Some of them were text-only and didn’t show up on the main index.
  - swebs 8y ago
    He's referring to /g/
21 8y ago
Someone who wants to steal crypto for example. Being able to inject a crypto stealer in a major distribution surely motivates a lot of people to try.
- kchr 8y ago
  Someone with such long term goals would most likely not do it as noisy and destructive as this attack seems to be (delete all files, rename the Github org, etc.).

xiii1408 8y ago

What was the modified version of the GitHub page?? Looks like it was taken down before I could get there. Crossing my fingers they added jokes about Stallman and muh freedums.

kayfox 8y ago
The title read: Linux For N____es The N word being _that_ N word. The logo was also changed to something that implied watermelon eating.
- delinka 8y ago
  then ... wouldn't it be "...ers"? Otherwise, I have no idea what _that_ N word is. EDIT: Using the archive link below, it's the one ending "...roes"
- ryanlol 8y ago
  LFN is actually a long running open source project by the US LGBT charity GNAA with the aim of making computing truly accessible and fun for everyone. https://encyclopediadramatica.rs/Linux_for_Niggers https://encyclopediadramatica.rs/Linux_for_Niggers https://www.assembla.com/code/linuxforniggers/git/nodes https://www.assembla.com/code/linuxforniggers/git/nodes
  - mschuster91 8y ago
    GNAA? Seriously? They were old news when I was active on Wikipedia and that's over 12 years ago.
  - rablo 8y ago
    I miss you guys a lot. Where on irc are you now? d2j
- deleted 8y ago
  [deleted]
- swebs 8y ago
  Is "negroes" supposed to be a super offensive word now?

spork12 8y ago

Was probably opal

EFruit 8y ago
Who is opal?
- ryanlol 8y ago
  Famous IRC artist.
  - ronsor 8y ago
    yeah you don't want opal on your IRC network
    - mschuster91 8y ago
      > yeah you don't want opal on your IRC network One of these "DCC 0 0 0" spammers getting people with crappy firewall middleboxes disconnected?
      - badrabbit 8y ago
        No,a PM/channel troll&spammer. but his persistence and discipline really merits the title of an artist.
        deleted 8y ago
        [deleted]
        deleted 8y ago
        [deleted]
        JeremyBanks 8y ago
        Don’t glorify misbehaviour.
        8y ago

mistrial9 8y ago

side note -- there is another FOSS org that was repeatedly, specifically attacked around the end of 2015, but they chose not to publicize it.. made worse because the volunteer community around the server admin was immediately far outside their comfort zone to implement fixes and recovery. The MediaWiki instance as well as raw servers were affected. No discussion in public about likely perpetrators. but what can you say ? How can you prove it? Commercial vendor rivals, nation-state actors, mean junkies, all of the above? Harsh and UN-necsessary .. everything was volunteer and above-board at the FOSS group, just too valuable ?

mchristen 8y ago
You can't just tell that story w/o namedropping....
- jooV1Bei 8y ago
  Probably talking about FSF. Employees of backconnect.com including Tucker Preston and Marshall Webb DDoSed them for a while to land them as clients for their DDoS protection service. https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/ https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has... (ctrl-f FSF)

rablo 8y ago

Dammit... l0de can’t keep getting away with it. I recommend you call him during his radio hour.

raziel2p 8y ago
Who is l0de? Are you implying they are the ones who did this?
- neur0h 8y ago
  l0de doesnt actually do anything except smoke meth and live off donations from his sycophant army on Efnet. It was probably one of his followers/listeners though because this had been announced weeks before on his radio show

boudin 8y ago

Seems than the person replaced ebuilds in portage with versions that are supposed to delete all files but that don't actually work. https://archives.gentoo.org/gentoo-dev/message/03df77a347ec75a9b1ceaab3a2f76ee8 https://archives.gentoo.org/gentoo-dev/message/03df77a347ec7...

contingencies 8y ago

I am a long term Gentoo user, but honestly I feel Gentoo's security stance is pretty bad, for example https://bugs.gentoo.org/show_bug.cgi?id=597804 https://bugs.gentoo.org/show_bug.cgi?id=597804 Their high friction contribution process with essentially requisite 'accredited developer' status is a major contributing factor. Edit: Hah! Posting here got the bug updated within 10 minutes :)

tyil 8y ago
Have you considered Funtoo yet? It's a fork of Gentoo, led by the creator of Gentoo.

Bromskloss 8y ago

What changes were made?

kchr 8y ago
Apparently the Github organization title and logo was changed, along with a couple of packages edited to contain scripts that were supposed to erase all files on user computers. The Github repos are just backups of the main package archives, so it would only affect users manually downloading packages from there (which is not the case if you haven't explicitly changed your system config to use those repos for some reason).

k_sze 8y ago

Wait... did they not use 2FA?!