Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Open Source Software

SourceForge Down After Attack [Updated] 143

Posted by timothy from the their-bad-childhood-affects-you dept.
Animats writes "SourceForge, a hosting site for many open source projects, is down today. Management claims they were attacked: 'We detected a direct targeted attack that resulted in an exploit of several SourceForge.net servers, and have proactively shut down a handful of developer centric services to safeguard data and protect the majority of our services.' Currently, CVS and SVN access to source code, even for reading, is unavailable, and there is no announced restoration time." (SourceForge and Slashdot are both part of Geeknet, Inc.) Update: 01/27 22:17 GMT by T : Mark Ramm of SourceForge contributes an update and some clarification: the site is up, and SVN is available, though CVS isn't. There's also a follow-up post on the site's blog.
This discussion has been archived. No new comments can be posted.

SourceForge Down After Attack [Updated] More

SourceForge Down After Attack [Updated]

Comments Filter:

  • Now who would go and attack SourceForge? Microsoft? Oracle?

    I just don't see why anyone would target an OSS repository.

    • Re:Attack by prononymous? (Score:5, Interesting)

      by quanticle ( 843097 ) on Thursday January 27, 2011 @05:37PM (#35024702) Homepage

      Well, if you wanted to sneak malicious code into an open-source project, cracking its repository might be a good way to do so.

      • It would be smarter to target the developer's box.
        • But what if you wanted to do it en masse- plus the fact that you get to target the code of the entire project all at once.

          • It's simple for the devs, now alerted to a potential compromise, to just branch the repo and do a quick diff between the last known good revision and the one on the server. I doubt a big public attack is going to compromise many projects and those it does manage to compromise are probably mismanaged anyway.

      • So the FBI is getting the band back together.
    • Heinous villainous scum that need to be dragged out into the street, beaten, tarred, feathered, and beaten again for good measure. That's who.

    • Re:Attack by prononymous? (Score:5, Funny)

      by tverbeek ( 457094 ) on Thursday January 27, 2011 @05:49PM (#35024882) Homepage
      Someone who really doesn't like the new Slashdot design?

    • Maybe the governments of Tunisia, Egypt, or Yemen, for example, object to these:

      http://sourceforge.net/search/?q=proxy [sourceforge.net]

    • LOIC was hosted on SourceForge. Five people were arrested in the UK today for (from the looks of it) using it. I'm not inferring anything, if I did it would be conspiracy theory...I'm just curious as to whether the events are unrelated?

    • I just don't see why anyone would target an OSS repository.

      The attack is probably blowback from the anger over the Slashdot design changes. Misguided, of course, but understandable? You tell me.

    • Re:Attack by prononymous? (Score:4, Insightful)

      by jellomizer ( 103300 ) on Thursday January 27, 2011 @07:27PM (#35026178)

      So if Microsoft and Oracle got attacked we would all be laughing at them and making fun of their poor security. But if SourceForge got attack it is nothing but sympathy. Umm I want to know as an OpenSource Software user... How they were able to break in where was the hole. Should we be worried about our software as well.

    • Re:Attack by prononymous? (Score:4, Funny)

      by mapkinase ( 958129 ) on Friday January 28, 2011 @08:49AM (#35030642) Homepage Journal

      They know the value of all the software on SourceForge and they wanted to steal it, pirate it, hack it, reverse engineer it and put it on tor... oh, wait.

    • Right, I think anonymous is too busy with Egypt and other real world issues -- anonymous press release [youtube.com]

      This has clear ulterior motives. But a OSS repo, that's really low :/
      Seems like an attack on our internet freedoms :/

    • I just don't see why anyone would target an OSS repository.

      As people love to parrot here, it's for the lulz, I imagine a lot of script kiddies would close down a hospital emergency ward if they could get away with it.

  • Hope they have checksums... (Score:2)

    by Anonymous Coward

    One hopes they have checksums when they come back up to make sure people have slipped shit in.

    • Re: (Score:3)

      by mlts ( 1038732 ) *

      Heck with checksums. PGP/gpg signed manifest files with SHA-512 hashes for every file stored, from source code tarballs to documentation, and the PGP/gpg keys signed by multiple trustworthy keys in a WOT. This way, dropping in a fake key on a keyserver, then some signed binaries would be found out almost immediately.

      For RPMs, if they are not gpg signed by someone, there is a security lapse. Same with Windows .MSI files which don't have Authenticode signatures (although the Windows certificate for a priva

    • wouldn't be an issue if they were using git. Every commit, every object is stored by SHA-1 hash. Additionally, developers have their own copy of the entire project and can verify that there were no other changes.
  • What point is there to hitting SourceForge?

    • Re:Qui bono? (Score:4, Interesting)

      by Securityemo ( 1407943 ) on Thursday January 27, 2011 @05:36PM (#35024672) Journal
      Because it's a high-profile site, and presumably staffed by people who know what they are doing? Eg., for the kicks?

      • Re:Qui bono? (Score:5, Insightful)

        by dave562 ( 969951 ) on Thursday January 27, 2011 @05:46PM (#35024836) Journal

        That was my thought. Everyone talks about how OSS is so secure. If you had a bone to pick with that notion, why not go over one of the highest profile examples of OSS? I'm sure that they're running Apache, right? Probably MySQL too? Surely they aren't hosting their sight on IIS and powering it with Asp.Net, are they?

        It would be great if situations like this brought the entire computer using community closer together. The reality is that no matter how epicly great your software might be, there are people out there looking to bring it down. It doesn't matter if you run Microsoft, Apple or OSS. There are bugs in your applications and there are incentives for finding and exploiting those bugs.

        • I think for some projects, Linus' Law does apply -at least, it makes sense- but it obviously doesn't mean any OSS code is perfectly secure nor even that the average OSS project is more secure than proprietary code.

          But I don't see how a single attack on SF proves anything; you'd have to make a study across a statistically valid sample of projects to determine if, eliminated all other variables, OSS code has or nor a better track record.

          • A study using proper sampling wouldn't necessarily mean anything, either.

            Software project A could have more vulnerabilities than project B. If attackers are more interested in B for some reason, maybe it's more popular or the sites running it are more interesting, B could have more "discovered" vulnerabilities.

            A correct study would have to pay someone to do a thorough security audit of source code for n major open source and closed source software projects, which would be extremely expensive, and getting t

    • What point is there to hitting SourceForge?

      Someone clearly didn't like open source. I wonder who they were..

    • Re: (Score:3)

      by McNihil ( 612243 )

      Possibly a misdirection and general smoke and mirrors technique but I doubt it... Could be that they hit the wrong IP... network order error and it was 60.181.34.216 that is inside China that was the true target and not sourceforge.

      Now with that IP one could glean some more info WHY an attack was necessary.... and so on.

    • Re: (Score:2)

      by Hatta ( 162192 )

      To hide back doors in source code?

  • Why (Score:3, Interesting)

    by Anrego ( 830717 ) * on Thursday January 27, 2011 @05:32PM (#35024602)

    What the hell did sourceforge ever do to anyone?

    I guess this could have been an attempt to spread some malware or something (by poisoning popular projects)?

    Off topic: how many people actually download directly from sourceforge any more. I have to imagine the majority of users (even before the mass ubuntu influx) get their stuff second hand through their favorite distro’s repository these days. I know I haven’t been there with any regularity since my `ol slackware days *tugs pants up past waist*.

    • Could be some hot young group of crackers just wants to make a name for themselves.

    • Re:Why (Score:5, Insightful)

      by quanticle ( 843097 ) on Thursday January 27, 2011 @05:41PM (#35024750) Homepage

      If you're using OSS software on Windows, SourceForge is the place to go. This fact lends support to my hypothesis that the attack was cover for injecting malware into open-source projects. Windows is malware's biggest target, and users are beginning to gravitate towards using open source tools over piracy (mainly due to fears of malware, ironically enough). With that in mind, I guess Sourceforge was a pretty big target for crackers.

      • Re: (Score:1)

        by Anonymous Coward

        There is at least one very popular and highly rated piece of software on SF that distributes binaries bungled with spyware at the time of writing, this isn't related to the present event though.

        • Re:Why (Score:5, Insightful)

          by Securityemo ( 1407943 ) on Thursday January 27, 2011 @06:54PM (#35025750) Journal
          Have the SF admins been notified of this? And this claim is based on manual binary dissection, not just it tripping AV "behaviour analysis"? And lastly, what are you up to if you're not telling which one?

          • No it's based on OMG OMG OMG HOW THE FUCK DO THEY DARE TRY AND MAKE MONEY WITH A WAY I DON'T APPROVE OF.

            It's talking about them bundling toolbars with their software. Every piece of software I've seen like that on source forge has always had an easy way to choose not to install them.

        • Re: (Score:1)

          by Anonymous Coward

          Why would you say that without naming the software? Without that, you'll just be (rightfully) ignored.

          • Re: (Score:1)

            by Anonymous Coward

            http://en.wikipedia.org/wiki/PDFCreator#Inclusion_of_malware

    • Yes, but some of us are developing software and use the sourceforge repository. First and foremost, sourceforge is about development and creativity, not strictly software distribution.

      • Re: (Score:2)

        by Anrego ( 830717 ) *

        Of course.. but developers of software projects don't make a good target for malware injection.

        • I was more responding to your off-topic comment as to who works directly with sourceforge. That would be everyone who works on open source projects hosted there. I don't think malware is a likely goal.

    • I know I havenâ(TM)t been there with any regularity since my `ol slackware days *tugs pants up past waist*.

      Double old-man points for using a backtick instead of a single quote

      Minus 10,000 nerd points for putting it on the wrong side of "ol"

    • I build a lot of the libraries I use from source and use a lot of the dev versions, so I end up at sourceforge a decent amount of time. Actually, considering that two of the biggest python libraries are hosted on sourceforge (scipy/numpy) and I really need to update my local versions, this even kind of affects me.

    • Because Sourceforge only hosts Linux software right?

    • What the hell did sourceforge ever do to anyone?

      Sourceforge is root canal. The valley of the shadow.

      The living dead.

      FOSS is more than Linux -
      and the bare repository of files is of no use to anyone unless you know what you are looking for.

      Windows doesn't have a repository. What is does have is resources like Download.com. One-stop shopping for editorial reviews, tutorials, screenshots, demos and so on.

    • Re: (Score:3)

      by Nimey ( 114278 )

      Windows users will d/l their binaries directly.

    • Re: (Score:1)

      by maxume ( 22995 )

      They have a really crappy web interface for the mailing list archives that they host.

    • Re:Why (Score:5, Informative)

      by diamondsw ( 685967 ) on Thursday January 27, 2011 @06:19PM (#35025310)

      I have to imagine the majority of users get their stuff second hand through their favorite distro's repository these days.

      Yes, because everyone who uses SourceForge is on Linux. There is such a thing as open source Windows and Mac software you know.

    • it's the SCO inserting patented code for later legal action.

    • Who ever went there with any regularity? I only go there when I must download something from them. And I have to say that I wish people would stop hosting projects there, because I have more problems with sourceforge failing to deliver me pages than any other major site.

  • Aw, crap. (Score:4, Interesting)

    by Nefarious Wheel ( 628136 ) on Thursday January 27, 2011 @05:34PM (#35024630) Journal
    This has to be a moneyed interest.

    Whoever you are, out there, you're not a clever geek, you're just an asshole.

    • Maybe they are a clever geek asshole? Or even better, a group of clever geek assholes?

    • This has to be a moneyed interest.

      Why can't it be a government interest carpet-bombing the location of a single piece of software it finds offensive or illegal?

    • They are really, really, dumb. For real.

      • Obviously we have a hacker at SourceForge, climbin' in your cvs, snatchin' your projects up, tryin' to infect them so y'all need to sign your commits, switch to git/hg, sign your commits, switch to git/hg, sign your commits, switch to git/hg... hide your binaries too, cuz they're infecting everything out here...

    • This has to be a moneyed interest.

      Trust me on this.

      Sourceforge has probably soured more users on open source than any other website on the planet.

           

      • No kidding. Maybe it's being "attacked' by a good Samaritan sick of dealing with SourceForge's particular brand of unusable crap.

        Hey, maybe SourceForge will actually wake up, pay attention to the site, and *improve* it as a result of this!

        Nah.

  • Can really free a portal for open-source software development be such a pebble in a shoe for someone? I can't think of none, *wink wink*, maybe someone who does not like stuff licensed under gpl, *nudge nudge*, oh noes... who can possibly believe in closedsource software as a future for the consumer out there? Oh, i dont know....

    • I can't think of none, *wink wink*, maybe someone who does not like stuff licensed under gpl, *nudge nudge*

      No less than three governments are currently trying to contain revolutions or mass protests. Why can't one of them be launching attacks against open-source tools to help people communicate?

  • sourceforge.net [sourceforge.net]

  • Password Database stolen? (Score:4, Interesting)

    by Securityemo ( 1407943 ) on Thursday January 27, 2011 @05:51PM (#35024914) Journal
    Since they took down SFTP access, presumably someone got their hands on passwords/the password database.

  • Slashdot (Score:5, Funny)

    by chargersfan420 ( 1487195 ) on Thursday January 27, 2011 @05:52PM (#35024932)
    Good thing Slashdot is still up and running!

    Unless... it was replaced with an impostor with some bad design decisions!

    • Re: (Score:3, Funny)

      by Anonymous Coward

      I knew something was suspicious with cmdrBurrito

    • Re: (Score:3)

      by sorak ( 246725 )

      Good thing Slashdot is still up and running!

      Unless... it was replaced with an impostor with some bad design decisions!

      So the bad news is that slashdot got hacked. The good news is that they fixed Idle.

      • Good thing Slashdot is still up and running!

        Unless... it was replaced with an impostor with some bad design decisions!

        So the bad news is that slashdot got hacked. The good news is that they fixed Idle.

        Nope, I can still see it.

    • Re: (Score:2)

      by sznupi ( 719324 )
      If the goal of the attacks turns out to be corruption of the new Slashcode / its SF project... is there anybody here who would be really surprised? ;)

    • Good thing Slashdot is still up and running!

      Unless... it was replaced with an impostor with some bad design decisions!

      I see this site's owners are preparing themselves a get-out-of-jail-free card.

      "See, it wasn't us! Do you seriously believe that a proper company could have fucked up so obviously and so badly?!"

  • possible explanation (Score:5, Interesting)

    by Anonymous Coward on Thursday January 27, 2011 @05:52PM (#35024938)

    http://www.exploit-db.com/papers/15823/

    You would think that the authors of Ettercap, one of the most popular
    whitehat pentesting tools, would know the basics of security.
    Apparently they don't, or they just don't give a shit about what
    happens to their users.

    So, why is their website so insecure? Ettercap's message board is
    hosted at Sourceforge, so they share a server with thousands of other
    customers. Every single customer is able to execute commands and
    access the other project directories. Pretty stupid, eh? You only need
    to find one hole in one hosted site and you can access ALL the project
    databases. Of course that isn't ALoR's fault, it's Sourceforge's
    fault. Regardless, people who care about security and data integrity
    wouldn't use such a shitty provider, would they?

  • The attacker(s) really must be either. Taking down a benign and beloved website which is frequented by a legion of genius coders is really asking for it.
    • Meh they could have done worse...they could have attacked 4chan, Wikileaks, or another site that is likely to get the whole of Anon on their asses. At worse all that would happen to them on Slashdot/Sourceforge would be us finding out a link to a website run by the attackers, posting a link to it on the front page, and letting the /. effect do the rest.

      • Re: (Score:1)

        by f3rret ( 1776822 )

        Honestly though I'm fairly certain that 4chan has 'hacked' itself a number if times. Seriously, I'm not sure where they organize their little raids but there's a board (well or some boards) somewhere where IPs are posted for that hideously stupid LOIC program they use for their little DDoS attacks; since most of the people there are presumably completely ignorant script kiddies, it'd be trivial for someone who was bored or had some beef with 4chan to post the IP of 4chan there and the legions of idiots woul

  • Site seems to be up and working fine for me. All the way through to downloading code and executables.

  • Take note when people post exploits (Score:5, Interesting)

    by Anonymous Coward on Thursday January 27, 2011 @06:06PM (#35025124)

    This was posted on Full Disclosure 4 days ago. http://seclists.org/fulldisclosure/2011/Jan/424 [seclists.org]

    Seems they left the backdoor open even after being notified.

    • Mod parent up, I should have checked there before starting to ramble. Interesting thing I noticed though: that paper from exploitdb claims that those happy ninjas had access to the ettercap project account for the past 5 years.
  • This is the ultimate in bullying someone that doesn't deserve it. Kinda like the poor fat kid in middle school that got beat up by the entire football team because they didn't like the way I smelled.

    • This is the ultimate in bullying someone that doesn't deserve it. Kinda like the poor fat kid in middle school that got beat up by the entire football team because they didn't like the way I smelled.

      I hope that you vowed to track them all down as adults, and ruin their lives one by one, causing one to go to prison for life for distributing child pornography, another to be executed for high treason by supplying atomic secrets to North Korea, another to be cast into the hellish undersea domain of The Elder Ones and yet another to be sold to Al Qaida as target practice for rabies grenades, until finally, the team captain came to you, begging on his knees, for you just to finish him quickly with a bullet

  • Somebody tried to fix the new Slashdot UI code - and it was also used by SourceForge?
  • SVN may be up, but SVN browse code [sourceforge.net] (via a web browser, what they call "ViewVC") is still failing.

  • > SVN is available, though CVS isn't

    Perhaps this is a good time to consider upgrading to git, eh? Nothing like a server outage to remind you of the problems associated with a central repository, which you probably haven't even backed up.

Slashdot Top Deals

BLISS is ignorance.

Close