Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×

Alerts This Week
Warning Icon 1 449
Alerts This Week
Warning Icon 1 449

Kernel.org Breach: SSH Trojan and Compromise Discovered

Calendar Aug 31, 2011 • User Avatar Anthony Pell
1 min read
General Esm H446
Topics%20covered

Topics Covered

security incident trojan source code theft SSH service kernel compromise user credential security recovery
The site that hosts the Linux kernel's source code, Kernel.org was compromised earlier this month. The discovery was made on August 28th, and steps are being taken now to enhance security for the site and recovery is underway. The kernel code repositories are believed to be unaffected. According to an unattributed post on the front page of Kernel.org, intruders managed to gain access via a compromised user credential. It's currently unknown how the attacker managed to escalate to root access.

After gaining access, the attacker modified files related to SSH services and added a trojan startup file to the system startup scripts. The trojan was discovered due to an error showing in a system log from a program not actually installed on the server (Xnest).

The link for this article located at ReadWriteWeb is no longer available.