The main source-code repository for the Free Software Foundation has been taken down following an attack that compromised some of the website's account passwords and may have gained unfettered administrative access. The SQL-injection attacks on GNU Savannah exploited holes in Savane, the open-source software hosting application …
To be fair, fairer, fairest...
"It being open-source software that anyone can audit, one might have expected the SQL injection vulnerability to have been discovered and fixed long ago. To be fair, GNU.org is by no means the only popular open-source project to have been ransacked by hackers."
To be fair, it being open-source software that anyone can audit, one might have expected the SQL vuln to have been exploited long ago (if it was that trivial).
To be "fairer", the raise in attacks against open-source repos is quite interesting. I can see two possible explanations:
1. open-source software has "gained" so much "traction" with the "market" (as the strategy boutiques put it) that it's become a wothy target for miscreants.
2. traditional target products (read Microsoft, Adobe, etc) are finally putting their act together and are increasingly harder to crack, comparatively making traditional strongholds look weaker than before.
To be the "fairest", both factors probably contribute, and I would hazard to say that it's a good sign for open-source software, as in most cases the code repositories were compromised, not the customer systems. When you think about it as a "customer" sysadmin, it feels much safer than MS /et al/ systems where the miscreants target YOU directly. Well, unless you're running Savane with MD5 hashes, but who in their right mind uses MD5 nowadays? ;-)
Semi-troll post, hence the icon.
Unsalted MD5? Muppets.
Yea yea, legacy app blah blah blah, should have updated the second the Rainbow tables were released.
Security and complacency do not mix
Isn't that now out of date? Should SHA1 or something be used instead? (Genuine question, it was an off-hand comment in a audiocast I listened to on Monday).
Hmm...seems it might be, considering one of the closing statements in the first post.
Upgrading to SHA1 is a bit strange, given it's already deprecated in most circles. While not totally broken, there's been enough progress in the cryptanalysis to display weaknesses to certain attacks.
Also, the keyspace just isn't enough these days:
They should select a stronger hashing algorithm, and use salts if they don't want this to happen again.
I had read of the EC2 crack, very interesting. I'm not a security expert (as you can tell) but all of this is very interesting.
The cryptanalytic attacks I've seen against MD5 and SHA-1 have been collision attacks, and so wouldn't weaken those hashes for secret-verification purposes. They weaken the hashes as verifiers for known pre-images, as in digital-signature applications.
Performance advances in brute-forcing hashes - rainbow tables, GPU clusters, etc - reduce the workload of finding a matching pre-image. But that applies to any hash algorithm that doesn't have a known attack better than brute-force for reversal. According to reports, Roth's attack (the Amazon EC2 GPU cloud one you refer to) just created SHA-1 rainbow tables for short passwords. The problem there isn't with SHA-1; it's with short passwords.
The fix isn't to change algorithms. It's to require strong passwords and use salts. Or better yet, drop the antiquated password mechanism entirely, as many security experts have long advocated.
pretend we don't know what you're referencing
What password mechanism do you think security experts are now advocating?
That's it. Oops. Even my netbuk uses salted shadow passworms.