3 ms·
I don't see how this is a 'full report'. For example: > There was a root privilege escalation on one of our platforms which permitted exposure of credentials t
by lysium 16y ago
I don't see how this is a 'full report'. For example:
> There was a root privilege escalation on one of our platforms which permitted exposure of credentials that were then used to access machines with externally-facing SSH.
How are the credentials exposed after escalation? What accounts on the externally-facing SSH machines were used? Why was it a problem that the externally-facing SSH machines could be accessed? Was the access through root accounts? Why do externally-facing SSH machines allow remote root-login?
Besides, why can I still download projects when the data validation is still ongoing?
Furthermore, the 'full report' does not say anything what SF.net plans about their ssh servers.
I understand the SF.net team does its best, but I am not so happy with that report.
- Tichy 16y agoWhat I really want is a list of compromised projects. They say it takes time to verify that, but I really hope they keep us posted.
- rst 16y agoWell, there's enough for an educated guess. My own reading was "someone used a root privilege escalation to ferret out ssh private keys, and then used them to log into our cloud as the admin with the compromised key." (I don't see an implication that ssh itself was configured to allow root access.) But there are other open questions --- the two of most interest to me are: What was the root privilege escalation that coughed up the credentials in the first place, and could the attacker have used it to do something else? Also, what was the extent of the compromised "zone", and how sure are they that the network partitioning held?