Five out of the project's eight servers were compromised and attacking other computers when they were taken offline.
The open-source Ubuntu project is on the mend after shutting down more than half of its servers this past weekend because they had been compromised and were launching attacks.
James Troup, who leads the Canonical sysadmin team, said in an online advisory that one of the hosted community servers that Canonical sponsored had been breached. Once technicians discovered that compromise, he said an investigation found that five of the eight machines had been breached and were actively attacking other machines. Troup's advisory did not note what machines were being attacked.
"Since it was reported that they were actively attacking other machines (and because it's What You Do), the decision was taken to shut the machines down," said Troup, who also is known as Elmo. "We started the procedure of bringing these machines up in a safe state so that we could recover data from them. Unfortunately, this took far longer than we would have hoped or liked due to a combination of having to use remote hands, arbitrary limits imposed by those remote hands, and (relative) lack of bandwidth to copy data off site."
Ubuntu is a community-developed, open-source Linux-based operating system. Canonical is the commercial sponsor of the Ubuntu project.
According to a notice in the Ubuntu newsletter, the servers were suffering from a few problems, such as missing security patches, FTP was being used to access the machines, and no upgrades "past breezy" were made due to problems with the network cards and kernels.
Troup noted that since FTP -- and not SFTP, without SSL -- was being used to access the machines, an attacker could have gotten access to the servers by sniffing the clear-text passwords. And since the servers had not been sufficiently upgraded, that also could allow an attack to gain root access.
"We're obviously working as fast as we can to restore services, however, we need to make sure they won't immediately be compromised again," added Troup.
Building A Mobile Business MindsetAmong 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps – and it's past time for those with no plans to get cracking.
Top IT Trends to Watch in Financial ServicesIT pros at banks, investment houses, insurance companies, and other financial services organizations are focused on a range of issues, from peer-to-peer lending to cybersecurity to performance, agility, and compliance. It all matters.
Join us for a roundup of the top stories on InformationWeek.com for the week of October 9, 2016. We'll be talking with the InformationWeek.com editors and correspondents who brought you the top stories of the week to get the "story behind the story."