<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:s="http://www.techrepublic.com/search" xmlns:dc="http://purl.org/dc/elements/1.1/"  xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
    <title><![CDATA[Discussion on Linux repository hit by malware attack ]]></title>
    <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103]]></link>
    <atom:link rel="hub" type="application/rss+xml" href="http://pubsubhubbub.appspot.com/" />
    <atom:link rel="self" type="application/rss+xml" href="http://www.techrepublic.com/forum/discussions/102-348103/rss" />

    <description><![CDATA[]]></description>
    <language>en-us</language>
    <lastBuildDate>2013-05-24T17:02:19-07:00</lastBuildDate>
             

    <item>
        <title><![CDATA['because MS servers &amp; users pcs get exploited each day']]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495618]]></link>
        <description><![CDATA[That may be the answer to your question right there. It happens on Windows systems every day; it's not news. It has to be something interesting like Morto which is special because it uses DNS for command/control and does not currently exploit a code vulnerability to propogate (it just tries to log in like any other remote terminal user would).Apple gets it pretty bad too. Every blunder that conflicts with the Apple utopian marketing message.I'm actually surprised by the lack of &quot;nah nah&quot; comments by other OS fans.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495618]]></guid>
        <dc:creator><![CDATA[Neon Samurai]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 14:26:47 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Yay Linux was attacked!!]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495537]]></link>
        <description><![CDATA[You're not proving you're mainstream until the hackers take the time to try and exploit your machines.  Just saying, why bother if no one's going to notice the attack? Am I right? Right!]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495537]]></guid>
        <dc:creator><![CDATA[gteachey@...]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 12:04:50 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[1 hit big news???]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495481]]></link>
        <description><![CDATA[This is the first time in my 13 plus years working with Linux that I see that there has been a &quot;malaware&quot; attack in the kernel let along Linux. Why is this such a headline when Microsoft servers &amp; users pc's get exploited each day with all sorts of crapWares???   I know US economy needs to get back on track and Microsoft is one of those big corps but common, what a cheap shot honestly...such a cheap shot...This headline was only at this site, znet and other commercial MS sites..very disappointing...]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495481]]></guid>
        <dc:creator><![CDATA[greenpoise]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 09:40:14 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Were they really after the content?]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495437]]></link>
        <description><![CDATA[Reading through the comments here the general thoughts are about the kernel files, etc.  As stated, the breach went undetected for 17 days.  If the afore mentioned security they have in place was doing it's job AND the intruders were there to alter the content, I would think that it would not have taken over 2 weeks to find out. They could have been there for 100 other reasons.  On the other hand they could have been going for some obscure pieces of code hoping they wouldn't get noticed.  Isn't that a scary thought.Bottom line, I hope that the kernel.org folks are not concentrating solely on the content, but I'm sure they're smarter than that.my .02c]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495437]]></guid>
        <dc:creator><![CDATA[flhtc]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 08:33:09 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[it's pretty comprehensive]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495427]]></link>
        <description><![CDATA[I'm trying to find the original article I read on it.In development, each file is signed so that if a non-dev change is made, the next dev to sync there local repository with the official repo gets a screen full of error messages (hey.. this file does not match it's hash value..).Once the kernel version is released as the current production version, the entire source tree gets signed along with the consolidated collection of per-file hash values being signed. Any change in the source breaks the file hash and overall tree hash.Now, here's where we get to distributions (how most folks get ther kernel source/binary). Not all distributions are equal and how a distro manages it's repository packages is indeed a defining and competitive attribute. If your distro is taking the kernel.org development source and hadning it to you as the official production release for the distribution; find a new distribution unless running development code is your intention. The distro should be giving you a production version of the kernel which means they can verify against a frozen source tree and it's stack of inter-reliant hash values.It seems that the current house of cards built out of each production version's hash values is comprehensive enough to identify unofficial changes. Maybe building a second house of cards out of each source tree with a secondary hash algarythm would increase identification of changed files though.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495427]]></guid>
        <dc:creator><![CDATA[Neon Samurai]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 08:09:06 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[that's a good two cents]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495416]]></link>
        <description><![CDATA[I've never thought of that before... now you got me wondering if something like kerberos and ldap could work in tandem. ]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495416]]></guid>
        <dc:creator><![CDATA[pgit]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 08:00:26 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[goes to show...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495426]]></link>
        <description><![CDATA[...that all the hoopla over 'which is better, Linux or windows' is a waste of time. It doesn't matter how safe the OS is when you have vulnerable apps exposed to the world.I can't count the number of times I tried to point out that with all the UNIX/Linux exploits we've seen, the OS has actually been doing it's job splendidly; it's doing exactly what it's being told to do. It's just being told to do malicious, unintended things.In contrast, many windows exploits do alter the OS itself, not just an app running on top of it. But again it doesn't matter, it's some app, often with an end user using that app, that gets to malware ball rolling. Whatever the OS happens to be is relatively immaterial.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495426]]></guid>
        <dc:creator><![CDATA[pgit]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 07:57:21 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[more interestingly...]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495406]]></link>
        <description><![CDATA[This will likely strengthen the Linux community.I think the more interesting speculation here is who may have perpetrated the breach.Since the code is open that eliminates theft as the motive... leaving trophy hunting or the desire to inject a Trojan...]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495406]]></guid>
        <dc:creator><![CDATA[billyg@...]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 07:40:56 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[Two hashes are better than one]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495343]]></link>
        <description><![CDATA[Since those sites, kernel.org, Linux Foundation, and Linux.com, are the root site for kernel development of so many strtagically important systems you would think that for all files systemwide, they would use two hashes on everything.LIke an md5 and a sha1.  By using hashes from different families of logic it makes it harder to find a collision space.Just my $0.02.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495343]]></guid>
        <dc:creator><![CDATA[Editorial_Response]]></dc:creator>
        <pubDate>Tue, 13 Sep 2011 05:17:39 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[unique]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495247]]></link>
        <description><![CDATA[Speaks volumes to the stability of the Linux Kernal since this is news. As an administrator of an all Microsoft Network and frequently use military network computers...... I have so many security pop-ups and email marking tools that pop up that I think the Malware would have less of an iimpact on my workday.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495247]]></guid>
        <dc:creator><![CDATA[gabriel.tate@...]]></dc:creator>
        <pubDate>Mon, 12 Sep 2011 22:50:12 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[You need at least one breach to bring it home]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495139]]></link>
        <description><![CDATA[Granted, I suspect most of the kernel.org folks have probably seen at least one breach in the past but sometimes you need the reminder for why one should be paying attention to servers and to personal machines.As for any risk to the Linux source code.. nearly a non-issue. There are so many layers of hashing in place that any modification is going to be noticed.Everything is signed indavidually. Kernel developers all have mirrored repositories on there own systems which provide yet another validation or base to identify modification. Distributrions are also not pulling the latest kernel source and shipping it to end users so a worst case currently only affect folks who download direclty from kernel.org to roll there own.Not something to be dismissed outright either. Unless your a kernel.org member, may as well grab the popcorn and see how it all plays out.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495139]]></guid>
        <dc:creator><![CDATA[Neon Samurai]]></dc:creator>
        <pubDate>Mon, 12 Sep 2011 14:24:05 -0700</pubDate>
    </item>
             

    <item>
        <title><![CDATA[It will be perfectly fine]]></title>
        <link><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495095]]></link>
        <description><![CDATA[Only non-technical managers and Microsoft would do silly things like patch an OS, then create a new OS without all previous patches, then repeat the patching process.Developers create test cases and save them forever. These guys let their guard down, to be sure, but they will fix it and so it shall remain till doomsday. Or until they get caught with their pants down again. Besides, a little embarrassment is good for the soul; it reminds us not forget our frailties and maintains a modicum of humility. They'll get over it just fine.]]></description>
        <guid><![CDATA[http://www.techrepublic.com/forum/discussions/102-348103-3495095]]></guid>
        <dc:creator><![CDATA[todd_dsm]]></dc:creator>
        <pubDate>Mon, 12 Sep 2011 12:51:06 -0700</pubDate>
    </item>
    </channel>
</rss>

