Linux Kernel Host Kernel.org Breached

Filed under
Linux
Security
Web

The site that hosts the Linux kernel's source code, Kernel.org was compromised earlier this month. The discovery was made on August 28th, and steps are being taken now to enhance security for the site and recovery is underway. The kernel code repositories are believed to be unaffected.

According to an unattributed post on the front page of Kernel.org, intruders managed to gain access via a compromised user credential. It's currently unknown how the attacker managed to escalate to root access.

After gaining access, the attacker modified files related to SSH services and added a trojan startup file to the system startup scripts. The trojan was discovered due to an error showing in a system log from a program not actually installed on the server (Xnest).

The status now is

Also: The Cracking of Kernel.org by Jon Corbet

And: kernel.org