[linux-audio-announce] Main AGNULA Host attacked (and potentially compromised)

+-----------------------------------------------------------------+
| ______ ______ _ _ _ |
| /\ / _____) ___ \| | | | | /\ |
| / \ | / ___| | | | | | | | / \ |
| / /\ \| | (___) | | | | | | | / /\ \ |
| | |__| | \____/| | | | |___| | |_____| |__| | |
| |______|\_____/|_| |_|\______|_______)______| |
| |
+-----------------------------------------------------------------+

     [Sorry for cross-posting. Feel free to forward around]

Florence, 19 April 2005

+++ Main AGNULA Host attacked (and potentially compromised)

On Sunday, April 16 2005, the main AGNULA host (agnula.speech.kth.se,
hosting lists.agnula.org, www.agnula.org, download.agnula.org,
devel.agnula.org, muzik.agnula.org and related services) was subject
to an attack (see below). The attacker(s) (whose identity is unknown
as of today) managed to download, *but not succesfully run*, a
backdoor on the system; thanks to the tight security measures
implemented on the host - and after a thorough check of the whole
system - we believe that the latter was *not* compromised.

However, following good security practices and common sense, we can
not guarantee the integrity of the host. Since we had already planned
an extensive upgrade of the server, we decided to go down the safer
route: completely wipe out the system, reinstall everything from
scratch and recover backup data from the day before the attempted
compromise.

The wipeout/installation/recover operations will begin tomorrow (April
20, 2005) early afternoon (approximately 3:00 p.m., Central European
Time). They should be concluded *at most* on Monday (April 25, 2005)
- we actually hope to do everything much quicker, but you will
understand our main concern in this moment is reliability and not
speed. In the meantime, we urge you to use the mirrors at:

* http://freesoftware.ircam.fr/mirrors/agnula/

* http://ccrma.stanford.edu/mirrors/agnula/

The mailing lists (including the archives), the main web site, the
AGNULA Libre Music web site, the AGNULA Development platform will be
unusable until after the reinstallation process is finished.

We are quite confident that you can safely download and install the
latest released version of A/DeMuDi (1.2.1-rc2) as well as all the
previous ones, as the relevant ISO images were uploaded on the server
before the attack and we have no tangible proof that they have been
tampered with.

+++ The attack

The attack used a bug in GForge 3.x "scm" subsystem.

We decided not to immediately disclose full information on the type of
the attack; we promptly informed to the maintainers of the affected
program, and we are waiting for the "green light" on their side before
posting details in the wild.

We urge all administrators of GForge-based systems (all 3.x series
seem affected by it) to temporarily disable the "scm" subsystem, until
a proper patch has been issued.

The discovery and the analysis were conducted by Filippo Morelli
<spike@email-addr-hidden-ft.org>. We would like to publically thank him for his
prompt action and detailed report, that allowed us to take the
necessary steps very quickly.

+++

About AGNULA: Agnula (acronym for A GNU/Linux Audio distribution,
pronounced with a strong g) is the name of a project funded until
April 2004 by the European Commission (number of contract:
IST-2001-34879; key action IV.3.3, Free Software: towards the critical
mass). After the end of the funded period, AGNULA is continuing its
work, aiming to spread Libre Software in the professional audio/video
arena.

Big thanks to the following institutions for their help in supporting
AGNULA:

- Firenze Tecnologia <http://www.firenzetecnologia.it>

  for paying Free Ekanayaka to work full-time on maintaining A/DeMuDi;

- Swedish Royal Institute of Technology <http://www.kth.se/>

  for housing the main AGNULA server

- IRCAM <http://www.ircam.fr> and CCRMA <http://ccrma.stanford.edu/>

  for providing mirror space and bandwidth

Best regards,

--
The AGNULA Team                                   info@email-addr-hidden        
Our mailing lists:                        http://lists.agnula.org/
Our web site:                               http://www.agnula.org/
"There's no free expression without control on the tools you use"
 
_______________________________________________
linux-audio-announce mailing list
linux-audio-announce@email-addr-hidden
http://music.columbia.edu/mailman/listinfo/linux-audio-announce