Ubuntu Tackling Breach That Hit Half Its Servers - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Software // Enterprise Applications

Ubuntu Tackling Breach That Hit Half Its Servers

Five out of the project's eight servers were compromised and attacking other computers when they were taken offline.

The open-source Ubuntu project is on the mend after shutting down more than half of its servers this past weekend because they had been compromised and were launching attacks.

James Troup, who leads the Canonical sysadmin team, said in an online advisory that one of the hosted community servers that Canonical sponsored had been breached. Once technicians discovered that compromise, he said an investigation found that five of the eight machines had been breached and were actively attacking other machines. Troup's advisory did not note what machines were being attacked.

"Since it was reported that they were actively attacking other machines (and because it's What You Do), the decision was taken to shut the machines down," said Troup, who also is known as Elmo. "We started the procedure of bringing these machines up in a safe state so that we could recover data from them. Unfortunately, this took far longer than we would have hoped or liked due to a combination of having to use remote hands, arbitrary limits imposed by those remote hands, and (relative) lack of bandwidth to copy data off site."

Ubuntu is a community-developed, open-source Linux-based operating system. Canonical is the commercial sponsor of the Ubuntu project.

According to a notice in the Ubuntu newsletter, the servers were suffering from a few problems, such as missing security patches, FTP was being used to access the machines, and no upgrades "past breezy" were made due to problems with the network cards and kernels.

Troup noted that since FTP -- and not SFTP, without SSL -- was being used to access the machines, an attacker could have gotten access to the servers by sniffing the clear-text passwords. And since the servers had not been sufficiently upgraded, that also could allow an attack to gain root access.

"We're obviously working as fast as we can to restore services, however, we need to make sure they won't immediately be compromised again," added Troup.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
2021 Outlook: Tackling Cloud Transformation Choices
Joao-Pierre S. Ruth, Senior Writer,  1/4/2021
Enterprise IT Leaders Face Two Paths to AI
Jessica Davis, Senior Editor, Enterprise Apps,  12/23/2020
10 IT Trends to Watch for in 2021
Cynthia Harvey, Freelance Journalist, InformationWeek,  12/22/2020
White Papers
Register for InformationWeek Newsletters
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you.
Flash Poll