6 ms·

So... what’s the risk? If a person updated their Ubuntu computers this or last week, are they in trouble?

C14L 7y ago
That's actually the important question that Canonical should answer ASAP.
quaquaqua1 7y ago
Ironically I only use Ubuntu in a sandboxed environment, fresh install every time. I run apt get update and dont do any personal info stuff on it. This is out of sheer laziness because a USB stick is easier to plug in than Sata. Today I learned it is now has security features as well :) Canonical is a great thing in my life. Hope they haven't been hit too hard and that they learn how to prevent it.
- yani 7y ago
  I do not see how this will make you safer than running the distro from a disk drive. I believe you are at a higher risk than others because you are running apt update on every boot and thats how you would get infected if launchpad was compromised - but it is not.
CameronNemo 7y ago
Probably not. The vast majority of Ubuntu development occurs on Launchpad. A few important projects are developed on Github, though. Notably, LXC and LXD. The maintainers of these projects are quite active, and would likely have seen any harmful changes being made.
- stgraber 7y ago
  The LXC and LXD repositories are under https://github.com/lxc https://github.com/lxc which is a different Github organization with a much much smaller set of members (17 currently) than CanonicalLtd. We require 2FA for all accounts under the lxc organization and only grant the access that's actually needed by those contributors. So while it's not impossible that one of our members' credentials may get compromised, especially when considering the use of access token, current access is as restricted as you would expect for those repositories. It's also worth noting that because of Git's own design, even should one of those accounts get compromised, it would be fairly simple to spot and revert any changes that may have occurred.
  - CameronNemo 7y ago
    Thanks for pointing this out!
  - panpanna 7y ago
    I am more afraid of someone compromising the linuxcontainer.org image servers. I wonder what security they have on place...
dpb1 7y ago
Hijacking top comment... We can confirm that on 2019-07-06 there was a Canonical owned account on GitHub whose credentials were compromised and used to create repositories and issues among other activities. Canonical has removed the compromised account from the Canonical organisation in GitHub and is still investigating the extent of the breach, but there is no indication at this point that any source code or PII was affected. Furthermore, the Launchpad infrastructure where the Ubuntu distribution is built and maintained is disconnected from GitHub and there is also no indication that it has been affected. We plan to post a public update after our investigation, audit and remediations are finished. Thank you, your trust in Canonical is important to us, which is why we make privacy and security a priority. -David on behalf of Canonical
- gaia 7y ago
  Thank for the update, David. Would this be an affected store? https://us.images.linuxcontainers.org/images/ubuntu/bionic/amd64/default/ https://us.images.linuxcontainers.org/images/ubuntu/bionic/a...
  - dpb1 7y ago
    From our investigation so far, they do not appear to be, No.
- noobermin 7y ago
  At least it wasn't as juvenile as the (possible actual) juvenile "hack"[0] of Gentoo's repos that had insertions of "rm -rf /" at the wrong places (where they wouldn't even execute) and insertions of racial slurs into readmes. [0] https://wiki.gentoo.org/wiki/Project:Infrastructure/Incident_Reports/2018-06-28_Github https://wiki.gentoo.org/wiki/Project:Infrastructure/Incident...
- mdt711 7y ago
  Launchpad doesn't look very trustworthy either: https://launchpad.net/projects/+all https://launchpad.net/projects/+all
  - 7y ago

C14L 7y ago

That's actually the important question that Canonical should answer ASAP.

Ironically I only use Ubuntu in a sandboxed environment, fresh install every time. I run apt get update and dont do any personal info stuff on it. This is out of sheer laziness because a USB stick is easier to plug in than Sata. Today I learned it is now has security features as well :) Canonical is a great thing in my life. Hope they haven't been hit too hard and that they learn how to prevent it.

yani 7y ago
I do not see how this will make you safer than running the distro from a disk drive. I believe you are at a higher risk than others because you are running apt update on every boot and thats how you would get infected if launchpad was compromised - but it is not.

CameronNemo 7y ago

Probably not. The vast majority of Ubuntu development occurs on Launchpad. A few important projects are developed on Github, though. Notably, LXC and LXD. The maintainers of these projects are quite active, and would likely have seen any harmful changes being made.

stgraber 7y ago
The LXC and LXD repositories are under https://github.com/lxc https://github.com/lxc which is a different Github organization with a much much smaller set of members (17 currently) than CanonicalLtd. We require 2FA for all accounts under the lxc organization and only grant the access that's actually needed by those contributors. So while it's not impossible that one of our members' credentials may get compromised, especially when considering the use of access token, current access is as restricted as you would expect for those repositories. It's also worth noting that because of Git's own design, even should one of those accounts get compromised, it would be fairly simple to spot and revert any changes that may have occurred.
- CameronNemo 7y ago
  Thanks for pointing this out!
- panpanna 7y ago
  I am more afraid of someone compromising the linuxcontainer.org image servers. I wonder what security they have on place...

dpb1 7y ago

Hijacking top comment... We can confirm that on 2019-07-06 there was a Canonical owned account on GitHub whose credentials were compromised and used to create repositories and issues among other activities. Canonical has removed the compromised account from the Canonical organisation in GitHub and is still investigating the extent of the breach, but there is no indication at this point that any source code or PII was affected. Furthermore, the Launchpad infrastructure where the Ubuntu distribution is built and maintained is disconnected from GitHub and there is also no indication that it has been affected. We plan to post a public update after our investigation, audit and remediations are finished. Thank you, your trust in Canonical is important to us, which is why we make privacy and security a priority. -David on behalf of Canonical

gaia 7y ago
Thank for the update, David. Would this be an affected store? https://us.images.linuxcontainers.org/images/ubuntu/bionic/amd64/default/ https://us.images.linuxcontainers.org/images/ubuntu/bionic/a...
- dpb1 7y ago
  From our investigation so far, they do not appear to be, No.
noobermin 7y ago
At least it wasn't as juvenile as the (possible actual) juvenile "hack"[0] of Gentoo's repos that had insertions of "rm -rf /" at the wrong places (where they wouldn't even execute) and insertions of racial slurs into readmes. [0] https://wiki.gentoo.org/wiki/Project:Infrastructure/Incident_Reports/2018-06-28_Github https://wiki.gentoo.org/wiki/Project:Infrastructure/Incident...
mdt711 7y ago
Launchpad doesn't look very trustworthy either: https://launchpad.net/projects/+all https://launchpad.net/projects/+all
- 7y ago