MySQL.com Hacked to Serve Malware (PC World)

Inside the Free Software community shutting people up doesn't work very well. But outside, there are a lot of reasons for people to stay quiet or toe the line, even if they're smart enough to figure out the truth.

This particular type of attack is usually automated, some compromised machine out there is banging away at some known vulnerability and using it to install the scripts. There can even be a cascade, machine #1 compromised by hand is trying SSH password dictionaries, when it gets into machine #2 this way, it runs a program that uses the machine #2 to try to find vulnerable web sites. When machine #2 finds a web site, running on machine #3 it inserts the Javascript, and when the ordinary user operating machine #4 visits the site, he gets malware injected. Now machine #4 is sending spam email advertising a "cheap Viagra" site. The bad guys broke into one machine, and soon they have a hugely profitable botnet, without a stroke of additional work!

Either all these FLOSS sites suddenly "got the openness religion" at the same time, themselves, and started reporting the cracks that have been going on all along...

OR, there's a quite recent and rather large wave of these cracks, all happening within weeks of each other either due to some new development, or due to pure chance.

The first possibility, that these sites all suddenly "got religion" and started reporting successful cracks that have been happening all along, seems rather unlikely.

That leaves the second (compound) possibility, that they're suddenly getting attacked more. While this could /indeed/ be mere chance, it does suggest some currently still without direct public evidence targeting as well, or why so close together now, instead of six months or a year ago, when most of these sites were running more or less the same security as they are now?

Now it's reasonable to note that for most of the community it doesn't really matter whether there's some sort of conspiracy or not, just as for most, it doesn't matter whether then VP Chaney was involved in some 9/11 conspiracy or not -- the effect on those involved and the wider world was the same either way, for them, it didn't and doesn't MATTER. So the debate is in this regard rather academic... for most people at least.

But regardless of the reason, conspiracy or simple chance, the fact is that there's now at least THREE headline FLOSS sites that have been penetrated within weeks of each other. Linux.com and the Linux Foundation, kernel.org, and now MySQL.com (which tho it is arguably heading more open-core than truly open source, it still has the FLOSS profile and reputation).

And dlang's point stands. This really SHOULD serve as a wakeup call to the FLOSS community as evidently one was needed. LOCK DOWN YOUR SERVERS! Regardless of whether it was simply luck before, or whether we're being deliberately targeted now, IT'S HAPPENING NOW! The FLOSS community was all too complacent before, and now our sites are being cracked open left and right. If you're in a FLOSS project that hasn't been cracked yet, consider yourself lucky, not blessed. If there was ever a time for vigilance and going over those security policies one, or ten, more times, this is it. It doesn't hurt to get a pair of eyes from outside the project to take a look as well.

Talking about which... We have the Software Freedom Law Center and various other cooperative legal endeavors. And there's freedesktop.org, the FHS and LSB, POSIX, etc, on the technical interoperative side. But I'm not aware of any formal FLOSS-based organization that helps individual FLOSS sites and organizations with their security, providing a trusted set of outside eyes to look at security procedures, etc, and make recommendations for tighter security, preferably on a quid-pro-quo or at least lower than security consultant market rates, for what are after all often partially or fully volunteer operations with relatively low budgets.

Now certainly, both the Linux foundation and kernel.org have a reasonable donation base, and MySQL.com has its new corporate masters. But consider, how long would it have taken an outside pair of eyes to nail the formerly hundreds of shell access accounts at kernel.org, one per git repo, and recommend pretty much exactly what they're doing now, gitolite, instead? Kernel.org has been hosting git accounts for long enough now, that surely, a timely review six months or a year ago might well have prevented the situation as it is today.

And evidently, if inside eyes saw it, they didn't carry the necessary urgency and weight to do anything about it. One would hope that an official opinion from someone coming in from an external organization dedicated to providing just this sort of external eyes security review services would have carried the necessary additional weight and urgency, instead of having it forced on them by hindsight.

So indeed, there's community organizations for legal support and technical interoperability; where's the community organization providing site security audit support, etc?

Duncan