9 ms·
Canonical Ltd source code repositories have been compromised
- sp332 7y agoI only see a list of files. Can you link to something more specific?
- SuperH00man 7y agosome stranger repos have been created and there is this issue https://github.com/CanonicalLtd/CAN_GOT_HAXXD/issues/1 https://github.com/CanonicalLtd/CAN_GOT_HAXXD/issues/1
- johannes1234321 7y agoRemoved or made private (I see a 404 error only)
- SuperH00man 7y agoSomebody on twitter took some screenshot https://twitter.com/dclauzel/status/1147525512794988544 https://twitter.com/dclauzel/status/1147525512794988544
- dClauzel 7y agoYes, somebody did ;)
- apt-get 7y agoAir France représente !
- a1369209993 7y agoActual link to screenshot: https://pbs.twimg.com/media/D-zUQ21XoAQeCgj.jpg https://pbs.twimg.com/media/D-zUQ21XoAQeCgj.jpg
- tariof 7y agoIt shows 10 empty repositories with names CAN_GOT_HAXXD_%d and age 2 hours.
- gionn 7y agoIt looks like they have already recovered everything.
- rasengan 7y agoWe are lucky that they decided to vandalize instead of hiding something. Remember, on Github you can actually submit your commit with another’s email, and github automatically puts the identity associated with the email allowing people to spoof. Always sign your commits!
- morpheuskafka 7y agoIf they had an SSH key only then signing would be a defense. But if the attackers got OAuth access, stolen credentials, or a personal access token to someone with access to the org, they could do everything through the web interface which is signed by a common Github key.
- DuskStar 7y agoI trust that GitHub key less than personal keys for exactly that reason.
- akerl_ 7y agoCommits made via the UI aren’t signed at all. There is no “common github key” for signing commits
- morpheuskafka 7y agohttps://github.com/aidanh010/test/commit/ebdf858ae90ab7d3ce5928894c23a54ddcff8524 https://github.com/aidanh010/test/commit/ebdf858ae90ab7d3ce5... https://imgur.com/a/fSKnL9C https://imgur.com/a/fSKnL9C
- pilif 7y agoThat’s not just on github. That’s totally a feature of git itself. You can set the email address to whatever you want.
- jolmg 7y agoNot knowing the details around this, but if they haven't done so, Github could add something to indicate whether particular commits were signed by the PGP key Github knows to belong to the user the commit claims it was authored by. A user could have a setting to enable Github warnings where there are commits supposedly authored by user but not signed. They could also always warn where there are commits authored by a user but signed by a key the user didn't inform Github of. Likewise, I wonder if git differentiates signatures where the keys are set as trusted in gnupg, and those that are not.
- giancarlostoro 7y agoAre these not just mirrors though or do they actually use git? Woulda thought they used SVN primarily since they pull from Debian? Or do they just pull tarbals... And this all leads to me wondering how they do their process... Anybody got good docs on how Ubuntu or similar distros that base off a parent distro do their work?
- rincebrain 7y agoDebian stores packaging in Git too, these days, sometimes exclusively.
- hlieberman 7y agoThat’s true, but somewhat misleading. Though most Debian maintainers use a VCS for packaging, it’s incidental to what actually ends up in the Debian package tree. That’s all still based off of tarballs submitted off of a developer’s machine.
- infinity0 7y agoMuch less misleading than the previous post. > Woulda thought they used SVN primarily since they pull from Debian
- deleted 7y ago[deleted]
- kevinoid 7y agoFirst, I would like to challenge the assumption that Debian primarily uses SVN for packaging. We can get a rough idea from the use of Vcs-$name package metadata in the testing distribution: </var/lib/apt/lists/*_debian_dists_testing_main_source_Sources.lz4 unlz4 | sed -n '/^Vcs-Browser:/n;s/^Vcs-\([A-Za-z]*\): .*/\1/p' | sort | uniq -c On my system this gives: 4 Arch 72 Bzr 5 Cvs 5 Darcs 24168 Git 21 Hg 21 Mtn 603 Svn Which shows that git is the overwhelming favorite and about 40 times more popular than SVN for packages which provide VCS metadata. The sources can be pulled directly from Debian as tarballs using [syncpackage]. Ubuntu maintainers are free to use their preferred VCS for maintaining Ubuntu-specific packaging. Using the same VCS as the Debian maintainer (or upstream developer) is often convenient, but not required. [syncpackage]: https://manpages.ubuntu.com/manpages/precise/man1/syncpackage.1.html https://manpages.ubuntu.com/manpages/precise/man1/syncpackag...
- jammygit 7y agoSo... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?
- C14L 7y agoThat's actually the important question that Canonical should answer ASAP.
- quaquaqua1 7y agoIronically I only use Ubuntu in a sandboxed environment, fresh install every time. I run apt get update and dont do any personal info stuff on it. This is out of sheer laziness because a USB stick is easier to plug in than Sata. Today I learned it is now has security features as well :) Canonical is a great thing in my life. Hope they haven't been hit too hard and that they learn how to prevent it.
- yani 7y agoI do not see how this will make you safer than running the distro from a disk drive. I believe you are at a higher risk than others because you are running apt update on every boot and thats how you would get infected if launchpad was compromised - but it is not.
- CameronNemo 7y agoProbably not. The vast majority of Ubuntu development occurs on Launchpad. A few important projects are developed on Github, though. Notably, LXC and LXD. The maintainers of these projects are quite active, and would likely have seen any harmful changes being made.
- stgraber 7y agoThe LXC and LXD repositories are under https://github.com/lxc https://github.com/lxc which is a different Github organization with a much much smaller set of members (17 currently) than CanonicalLtd. We require 2FA for all accounts under the lxc organization and only grant the access that's actually needed by those contributors. So while it's not impossible that one of our members' credentials may get compromised, especially when considering the use of access token, current access is as restricted as you would expect for those repositories. It's also worth noting that because of Git's own design, even should one of those accounts get compromised, it would be fairly simple to spot and revert any changes that may have occurred.
- PatrolX 7y agoTwo people have been removed since this occured.
- chris_wot 7y agoUh, this is worrying.
- yourfather 7y agoI was told this several hours ago on IRC - this is not an official statement: someuser@somewhere.canonical.com: I can confirm that we're aware of the issue, have done some initial remediation (e.g. shutting down CI systems that might pull potentially compromised code) while we do a more in depth investigation. someotheruser@ubuntu/member/username: And we've of course revoked the access that was abused.
- theshadowknows 7y agoWhile it’s troubling that this happened isn’t it sort of cool that it’s out in the open for everyone to see? At least due to open source the community can know what happened and even look for changes.
- dhimes 7y agoWhat sucks is that I just updated WSL immediately before coming to this article. Hopefully it's ok.
- tsjq 7y agodoes that imply Ubuntu code might've been compromised , and some trackers / keylogger codes planted ?
- deleted 7y ago[deleted]