Linux kernel.org Hacker Arrested After Traffic Stop


So it seems the alleged kernel.org hacker has finally been caught, kinda by accident after being stopped for a traffic violation. It was quite a high profile hack, especially in the open source community as anyone downloading kernel files during that period could have theoretically been compromised.

Linux kernel.org Hacker Arrested After Traffic Stop

It’s unlikely the kernel code was actually tampered with due to the hashes for each file being distributed widely, but still – it had people rumbled.

A man who allegedly hacked the Linux Kernel Organization’s kernel.org and the Linux Foundation’s servers has been collared by cops.

Donald Ryan Austin, 27, of El Portal, Florida, will appear in court in San Francisco later this month. He is accused of four counts of “intentional transmission causing damage to a protected computer.” The charges were filed in absentia against Austin.

It is alleged his hacking spree forced the two Linux groups to shut down completely to clean up a malware infection. Austin was stopped on Thursday this week by police in Miami Shores for a traffic offense – and was arrested when he identified himself.

Court documents [PDF] claim that in 2011, Austin managed to steal the credentials of one of the Linux server admins and used these to install the Phalanx malware, a self-injecting kernel rootkit designed for the Linux 2.6 branch that hides files, processes and sockets and includes tools for sniffing a TTY program.


It’s still a pretty hardcore compromise though the reasons for it never seem to have surfaced, nor the in-depth post-mortem kernel.org folks promised to publish.

It’s also a little odd such a technical compromise used off the shelf tools that could easily be detected and identified (Phalanx and Ebury).

Using Phalanx, he is also accused of installing the Ebury trojan, which is designed for Linux, FreeBSD or Solaris hacking, onto numerous servers run by the groups. This harvested login credentials of people using the servers and forwarded them to the attacker.

Austin’s goal, according to the prosecution, was to “gain access to the software distributed through the www.kernel.org website,” presumably to tamper with it. He is also accused of leaving messages on the system for others to find, and of hacking the personal email server of one member of the Linux Foundation.

Some of the Linux servers were offline for almost a month, while administrators picked over files to make sure that the attacker hadn’t left any more nasty surprises in there. It took over five years of sleuthing to find out who could have been responsible, and now the Feds think they have their man.

Austin was released from jail on payment of $50,000 in bail money, and will have to appear in court in San Francisco at 09:30 on September 21 before the Honorable Sallie Kim. If found guilty, he faces a possible sentence of 40 years in prison and $2m in fines.

As usual with these type of cyber-crimes cases in the US, they are VERY strict and the maximum sentence is 40 years in prison plus a $2 Million fine.

A little harsh for something that was non-commercial and didn’t seem to do any long term damage. We will have to wait for the actual sentencing on Sept 21st to see what happens next.

Source: The Register

Posted in: Linux Hacking, Malware


Latest Posts:


Nipe - Make Tor Default Gateway For Network Nipe – Make Tor Default Gateway For Network
Nipe is a Perl script to make Tor default gateway for network, this script enables you to directly route all your traffic from your computer to the Tor network.
Mosca - Manual Static Analysis Tool To Find Bugs Mosca – Manual Static Analysis Tool To Find Bugs
Mosca is a manual static analysis tool written in C designed to find bugs in the code before it is compiled, much like a grep unix command.
Slurp - Amazon AWS S3 Bucket Enumerator Slurp – Amazon AWS S3 Bucket Enumerator
Slurp is a blackbox/whitebox S3 bucket enumerator written in Go that can use a permutations list to scan externally or an AWS API to scan internally.
US Government Cyber Security Still Inadequate US Government Cyber Security Still Inadequate
Surprise, surprise, surprise - an internal audit of the US Government cyber security situation has uncovered widespread weaknesses, legacy systems and poor adoption of cyber controls and tooling.
BloodHound - Hacking Active Directory Trust Relationships BloodHound – Hacking Active Directory Trust Relationships
BloodHound is for hacking active directory trust relationships and it uses graph theory to reveal the hidden and often unintended relationships within an AD environment.
SecLists - Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells SecLists – Usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells
SecLists is the security tester's companion. It's a collection of multiple types of lists used during security assessments, collected in one place.


One Response to Linux kernel.org Hacker Arrested After Traffic Stop

  1. ic34xe September 8, 2016 at 6:25 pm #

    its because of fear in the us they thrive by fear and are quite pathetic in regards to long sentences sad f e ck ers cant believe a hack would be worse than killing someone in a drunken collision but wait if you have dollar thats ok you can buy your way out or at least to a house arrest!

    only reason they are chasing hackers hard because they got exposed by their own lame ass processes, deserve everything they get!