Linux kernel.org Hacker Arrested After Traffic Stop

Outsmart Malicious Hackers


So it seems the alleged kernel.org hacker has finally been caught, kinda by accident after being stopped for a traffic violation. It was quite a high profile hack, especially in the open source community as anyone downloading kernel files during that period could have theoretically been compromised.

Linux kernel.org Hacker Arrested After Traffic Stop

It’s unlikely the kernel code was actually tampered with due to the hashes for each file being distributed widely, but still – it had people rumbled.

A man who allegedly hacked the Linux Kernel Organization’s kernel.org and the Linux Foundation’s servers has been collared by cops.

Donald Ryan Austin, 27, of El Portal, Florida, will appear in court in San Francisco later this month. He is accused of four counts of “intentional transmission causing damage to a protected computer.” The charges were filed in absentia against Austin.

It is alleged his hacking spree forced the two Linux groups to shut down completely to clean up a malware infection. Austin was stopped on Thursday this week by police in Miami Shores for a traffic offense – and was arrested when he identified himself.

Court documents [PDF] claim that in 2011, Austin managed to steal the credentials of one of the Linux server admins and used these to install the Phalanx malware, a self-injecting kernel rootkit designed for the Linux 2.6 branch that hides files, processes and sockets and includes tools for sniffing a TTY program.


It’s still a pretty hardcore compromise though the reasons for it never seem to have surfaced, nor the in-depth post-mortem kernel.org folks promised to publish.

It’s also a little odd such a technical compromise used off the shelf tools that could easily be detected and identified (Phalanx and Ebury).

Using Phalanx, he is also accused of installing the Ebury trojan, which is designed for Linux, FreeBSD or Solaris hacking, onto numerous servers run by the groups. This harvested login credentials of people using the servers and forwarded them to the attacker.

Austin’s goal, according to the prosecution, was to “gain access to the software distributed through the www.kernel.org website,” presumably to tamper with it. He is also accused of leaving messages on the system for others to find, and of hacking the personal email server of one member of the Linux Foundation.

Some of the Linux servers were offline for almost a month, while administrators picked over files to make sure that the attacker hadn’t left any more nasty surprises in there. It took over five years of sleuthing to find out who could have been responsible, and now the Feds think they have their man.

Austin was released from jail on payment of $50,000 in bail money, and will have to appear in court in San Francisco at 09:30 on September 21 before the Honorable Sallie Kim. If found guilty, he faces a possible sentence of 40 years in prison and $2m in fines.

As usual with these type of cyber-crimes cases in the US, they are VERY strict and the maximum sentence is 40 years in prison plus a $2 Million fine.

A little harsh for something that was non-commercial and didn’t seem to do any long term damage. We will have to wait for the actual sentencing on Sept 21st to see what happens next.

Source: The Register

Posted in: Linux Hacking, Malware


Latest Posts:


What You Need To Know About KRACK WPA2 Wi-Fi Attack What You Need To Know About KRACK WPA2 Wi-Fi Attack
The Internet has been blowing up in the past week about the KRACK WPA2 attack that is extremely widespread and is a flaw in the Wi-Fi standard itself.
Spaghetti Download - Web Application Security Scanner Spaghetti Download – Web Application Security Scanner
Spaghetti is an Open-source Web Application Security Scanner, it is designed to find various default and insecure files, configurations etc.
Taringa Hack - 27 Million User Records Leaked Taringa Hack – 27 Million User Records Leaked
The Taringa hack is actually one of the biggest leaks of the year with 27 million weakly hashed passwords breached, but it's not often covered in the West.
A2SV - Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed A2SV – Auto Scanning SSL Vulnerability Tool For Poodle & Heartbleed
A2SV is a Python-based SSL Vulnerability focused tool that allows for auto-scanning and detection of the common and well-known SSL Vulnerabilities.
VHostScan - Virtual Host Scanner With Alias & Catch-All Detection VHostScan – Virtual Host Scanner With Alias & Catch-All Detection
VHostScan is a Python-based virtual host scanner that can be used with pivot tools, detect catch-all scenarios, aliases and dynamic default pages.
Equifax Hack Blamed On Single Employee Equifax Hack Blamed On Single Employee
We wrote about the Equifax Hack, Data Breach and Leak last month, which happened due to a flaw in Apache Struts that for some reason hadn't been patched.


One Response to Linux kernel.org Hacker Arrested After Traffic Stop

  1. ic34xe September 8, 2016 at 6:25 pm #

    its because of fear in the us they thrive by fear and are quite pathetic in regards to long sentences sad f e ck ers cant believe a hack would be worse than killing someone in a drunken collision but wait if you have dollar thats ok you can buy your way out or at least to a house arrest!

    only reason they are chasing hackers hard because they got exposed by their own lame ass processes, deserve everything they get!