Crackers Strike Gentoo Linux Server, Code Unharmed

In the latest of what is becoming a string of high-profile attacks on Linux, someone broke into one of the servers used to distribute versions of Gentoo Linux on Tuesday.

Officials at Gentoo Technologies Inc. on Wednesday posted a message in the companys online forums detailing the attack. The executives sought to reassure users and said they dont believe that the code stored on the server was affected by the compromise. The server is owned by a third party, which uses it to perform other tasks in addition to storing the Gentoo code.

The officials said the box is one of several that are part of a rotation of servers used to synchronize and update users versions of Gentoo. The company uses a unique technology known as portage, which allows users to download new packages and updates to the operating system by synchronizing their machines against the current build housed on the Gentoo servers. The company removed the compromised server from the rotation.

/zimages/2/28571.gif

The attack on Gentoo follows closely a similar compromise in late November of a server belonging to the Debian Project, which produces another distribution of Linux. And earlier this fall, someone tried to insert a back door into the Linux kernel itself, although that attempt was stopped.

/zimages/2/28571.gifTo read more about the Debian attack,click here.

Gentoo officials said that the compromised server has both an intrusion detection system and a file-integrity checker installed on it.

“We have a very detailed forensic trail of what happened once the box was breached, so we are reasonably confident that the portage tree stored on that box was unaffected,” the company said in its message to users.

The attacker apparently installed a rootkit on the server and then deleted a few files to cover his tracks.

Discuss This in the eWEEK Forum

/zimages/2/28571.gif