""Openness is essential for trust..." --Whitfield Diffie, Sun Microsystems
BWAHAHAHAHAHAHAHAHAHAHAHAHAHAHA!!!!
Posted on 10/09/2002 5:54:22 PM PDT by Bush2000
Hackers send Sendmail a message
Online vandals hacked into the primary download server for Sendmail.org and replaced key software with a Trojan horse, a Sendmail development team member said Wednesday. The apparent attack on Sendmail didn't leave a back door in the popular open-source e-mail software package, as previously believed, but compromised the download software on the Sendmail consortium's primary server so that every tenth request for source code would receive a modified copy in reply.
"The exploited code that we see is not in our (development) tree at all," said Eric Allman, chief technology officer of Sendmail Inc., which sells a version of the open-source e-mail server program, and a member of the Sendmail Consortium, the development group for the software. "It seemed to be going to the (Sendmail) host, but it was delivering a corrupted file that wasn't on our server anywhere."
The problem apparently only affects source code for version 8.12.6 of Sendmail downloaded between Sept. 28 and Oct. 6, according to an advisory posted by the Computer Emergency Response Team (CERT) Coordination Center on Tuesday.
While the Sendmail development group is only just starting its forensic analysis of the computer that hosted the files, Allman said that its current theory is that the FTP (file transfer protocol) server had been hacked. If a user tried to download the latest Sendmail source code from the ftp.sendmail.org server, a compromised copy of the code would be sent instead about 10 percent of the time.
"It was a little bizarre that way," said Allman.
If the evidence confirms the theory, the hack would definitely be a strange way to compromise a downloadable file, said Marc Maiffret, chief hacking officer for security software firm eEye Digital Security.
"I'm not sure why they would want to do that," he said.
A Trojan horse--like the instrument that led to the downfall of the city of Troy--is a program that appears to be a legitimate piece of software but in fact has unwanted functions that allow a company or hacker to access the victim's computer.
The FTP server compromised by this attack apparently provided people who requested downloads not with the Sendmail source file, but with a Trojan-horse copy. This copy included a non-Sendmail test component that, when compiled, started a program that opens a covert channel to another server on the Internet. That server has since been configured to block the covert connection, according to messages posted to the Bugtraq security list.
Taking into account the 1-in-10 ratio, about 200 people may have downloaded the corrupted software over that eight-day period, said Sendmail's Allman. The development group is trying to contact everyone who downloaded the source code.
Both Sendmail and the CERT Coordination Center stressed that any software that is downloaded from the Internet should be verified using common cryptographic tools and the file's signature.
"Anyone that downloaded the code and followed good software practices would have found that this software was bogus," said Marty Linder, team leader for incident handling for CERT Coordination Center.
Linder stressed that, while the open development projects that give open-source its name may seem to invite problems like those of Sendmail, companies working on proprietary software have also run into problems.
In October 2000, Microsoft's source code may have been compromised by a hacker that penetrated the company's network allegedly with the help of a malicious program known as the Qaz Trojan.
"The same thing can happen if an intruder compromises the source tree of a private company," Linder said. "It's just another method for injecting badness into software."
You really don't have a life. Do you?
|
|
|
 |
FreeRepublic , LLC PO BOX 9771 FRESNO, CA 93794
|
|
|
|
[Open Source Software Hacked] The software wasn't hacked. The FTP server was compromised, and every ten user got a trojan file. And again, thank god nobody ever hacks an IIS web server!!! (ill to my stomach from the sarcasm overdose)
Just stick with windoze and you won't have to worry about us dirty open source savages.
Over and over an over you use this forum as a platform for your odd promotion of Microsoft. Or the trashing of technologies that you don't like. I've asked you before and I'll ask you again. Why?
If you are such a bright guy and can code like you say why come here for this? Build your own sand box for this kind of stuff. If people are as interested in your thoughts and ideas as you seem to think they are then they will come.
In the meantime, please explain to me what this post has to do with conservatism in America.
They are all going to have some holes.
The people that don't have a life are the hackers who seem to have nothing productive to do other than exploit some code.
There was a talk show host in Tampa several years ago that used that expression with his IQ challenged callers.
When I first heard the expression I couldn't stop laughing.
Still laughing...
No, I'm not!!(sounds familiar)
Bush2000 signed up 1998-04-08.
Location: Seattle
Hmmmm... does somebody work in Redmond???? Yeah, I think so.
That would explain why he's such a little shill for Bill.
If you don't like the technology posts (especially those by bush2000) why do you rean them? And why do you respond to them? Are you paying for the freerepublic's bandwidth all by yourself?
Now to the article...I think it's important to note that all major software has bugs. The important thing isn't how many bugs have been found in the past, but how sound and thouroughly tested is the product.
For example, Oracle had it's unbreakable campaign. Guess what? It was broken several times over. Putting out false info and a false sense of security is the biggest security risk you can have.
Open source does have good points on why it's secure. But the very same reasons that make it secure also make it vulnerable to attack--everyone can read the source code. Just pray the white hats find the weak spots before the black hats.
Things are getting more and more secure. Honestly I think open source has done everyone a great favor in making security a journey and not a finalized product. I believe the major software makers are getting on board with that mindset.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.