• We’re currently investigating an issue related to the forum theme and styling that is impacting page layout and visual formatting. The problem has been identified, and we are actively working on a resolution. There is no impact to user data or functionality, this is strictly a front-end display issue. We’ll post an update once the fix has been deployed. Thanks for your patience while we get this sorted.

Watch out for backdoors *Important for *nix users and anyone interrested in security

N

n0cmonkey

Elite Member
SF Online article (hopefully the link works)

This mentions how the source code for several programs has been backdoored recently. One of the programs is one I use quite often (although Im not sure yet if the version I use was backdoored yet), irssi.

Another was Fragroute. Im not sure if dsniff and other Dug Song programs were infected or not, but its best if you check out your source. monkey.org (Dug Song's host) surprised me. I never thought they would get cracked. Oh well. Its a learning experience.

One of my main points for pointing this out is that when there are digital signatures available, please check them. I havent been doing that everytime (OpenBSD ports do that for me sometimes), but Ill definitely keep on the lookout for them in the future. Also, keeping track of what is going on with your machine is very important.

 
yep, i almost crapped my pants when i found out. turns out that the backdoor in irssi was in the configure script, and thus only affected you if you built it from source (read: debian saves the day! 😉)
 
If someone can crack the servers that host the content and modifies the source, they can just as easily modify the checksums to reflect the updated files.

Considering most software packages use MD5 checksums instead of digital signatures, they're no help.
 
Originally posted by: GigaCluster
If someone can crack the servers that host the content and modifies the source, they can just as easily modify the checksums to reflect the updated files.

Considering most software packages use MD5 checksums instead of digital signatures, they're no help.
Click to expand...

The creator of irssi is using his gpg key. Your point has been brought up before (it is a good point though!) and I have seen no good solutions for it. The only solution I can come up with is storing the key/md5 sum/sha1 sum on multiple servers. Just because a cracker got into one doesnt mean he got all 3 (or whatever.
 
thats some sweet cracking! LOL wish I could do all that! Security is my favorite part of computer systems! Anyone recommend some good sites that focus on security flaws and uptodate news on security related things! The site that I was visiting just vanished it had one of those news flash uptodate things that was really cool!
 
You must log in or register to reply here.

TRENDING THREADS

Back
Top