Ubuntu Tackling Breach That Hit Half Its Servers - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Software // Enterprise Applications

Ubuntu Tackling Breach That Hit Half Its Servers

Five out of the project's eight servers were compromised and attacking other computers when they were taken offline.

The open-source Ubuntu project is on the mend after shutting down more than half of its servers this past weekend because they had been compromised and were launching attacks.

James Troup, who leads the Canonical sysadmin team, said in an online advisory that one of the hosted community servers that Canonical sponsored had been breached. Once technicians discovered that compromise, he said an investigation found that five of the eight machines had been breached and were actively attacking other machines. Troup's advisory did not note what machines were being attacked.

"Since it was reported that they were actively attacking other machines (and because it's What You Do), the decision was taken to shut the machines down," said Troup, who also is known as Elmo. "We started the procedure of bringing these machines up in a safe state so that we could recover data from them. Unfortunately, this took far longer than we would have hoped or liked due to a combination of having to use remote hands, arbitrary limits imposed by those remote hands, and (relative) lack of bandwidth to copy data off site."

Ubuntu is a community-developed, open-source Linux-based operating system. Canonical is the commercial sponsor of the Ubuntu project.

According to a notice in the Ubuntu newsletter, the servers were suffering from a few problems, such as missing security patches, FTP was being used to access the machines, and no upgrades "past breezy" were made due to problems with the network cards and kernels.

Troup noted that since FTP -- and not SFTP, without SSL -- was being used to access the machines, an attacker could have gotten access to the servers by sniffing the clear-text passwords. And since the servers had not been sufficiently upgraded, that also could allow an attack to gain root access.

"We're obviously working as fast as we can to restore services, however, we need to make sure they won't immediately be compromised again," added Troup.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
How to Create a Successful AI Program
Jessica Davis, Senior Editor, Enterprise Apps,  10/14/2020
Think Like a Chief Innovation Officer and Get Work Done
Joao-Pierre S. Ruth, Senior Writer,  10/13/2020
10 Trends Accelerating Edge Computing
Cynthia Harvey, Freelance Journalist, InformationWeek,  10/8/2020
White Papers
Register for InformationWeek Newsletters
Current Issue
[Special Report] Edge Computing: An IT Platform for the New Enterprise
Edge computing is poised to make a major splash within the next generation of corporate IT architectures. Here's what you need to know!
Flash Poll