Debian Development Machine ‘gluck’ Hacked!

Outsmart Malicious Hackers


Ah, I wonder what happened?

I’ve always been a great fan of Debian, all the way back into the early days of woody and backporting apt packages.

What a name too, gluck to me usually means g’luck or good luck ;)

Early this morning we discovered that someone had managed to compromise gluck.debian.org. We’ve taken the machine offline and are preparing to reinstall it. This means the following debian.org services are currently offline:

cvs, ddtp, lintian, people, popcon, planet, ports, release

Based on the results of our initial investigation we’ve locked down most other debian.org machines, limiting access to DSA only, until they can be fixed for what we suspect is the exploit used to compromise gluck.

We’re still investigating exactly what happened and the extent of the damage. We’ll post more info as soon as we reasonably can.

I wonder if it’s a 0-day for one of the services? I doubt it’s bad configuration?

If it’s 2.6 kernel though…I’ve noticed it’s pretty badly coded, but most of those exploits are local…they had to get in remotely somehow.

As a dev machine though it is possible a local user used a kernel exploit.

It could be speculated that it’s the Linux Kernel PRCTL Core Dump Handling Privilege Escalation Vulnerability.

Posted in: Exploits/Vulnerabilities, Linux Hacking

,


Latest Posts:


OSSIM Download - Open Source SIEM Tools & Software OSSIM Download – Open Source SIEM Tools & Software
OSSIM is a popular Open Source SIEM or Security Information and Event Management (SIEM) product, providing event collection, normalization and correlation.
What You Need To Know About KRACK WPA2 Wi-Fi Attack What You Need To Know About KRACK WPA2 Wi-Fi Attack
The Internet has been blowing up in the past week about the KRACK WPA2 attack that is extremely widespread and is a flaw in the Wi-Fi standard itself.
Spaghetti Download - Web Application Security Scanner Spaghetti Download – Web Application Security Scanner
Spaghetti is an Open-source Web Application Security Scanner, it is designed to find various default and insecure files, configurations etc.
Taringa Hack - 27 Million User Records Leaked Taringa Hack – 27 Million User Records Leaked
The Taringa hack is actually one of the biggest leaks of the year with 27 million weakly hashed passwords breached, but it's not often covered in the West.
A2SV - Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed A2SV – Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed
A2SV is a Python-based SSL Vulnerability focused tool that allows for auto-scanning and detection of the common and well-known SSL Vulnerabilities.
VHostScan - Virtual Host Scanner With Alias & Catch-All Detection VHostScan – Virtual Host Scanner With Alias & Catch-All Detection
VHostScan is a Python-based virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.


Comments are closed.