8/1 Bugtraq reports that openssh-3.4p1 was trojanned on http://ftp.openbsd.org,
and its mirrors.
\_ Link? And Is that what happened to csua?
\_ http://online.securityfocus.com/archive/1/285492/2002-07-29/2002-08-04/0
\_ Don't think so. That seems to have affected the
openssh-portable port.
\_ which... soda runs...
\_ dont bring facts into this. this is the motd, damn it!
\_ It's okay, they didn't.
\_ no it doesn't:
$ telnet soda 22
Trying 128.32.112.233...
Connected to http://soda.CSUA.Berkeley.EDU.
Escape character is '^]'.
SSH-1.99-OpenSSH_3.4
\_ genius wtf do you think that is? If it isn't an openbsd
machine and it's running openssh, it's the portable one
\_ I believe the FreeBSD uses the non-portable openssh
too, perhaps with their own patches. If FreeBSD was
using portable openssh, you'd see a version string
that looks like this: SSH-1.99-OpenSSH_3.4p1
\_ Hi. You're an idiot.
\_ Recent FreeBSD base system uses 3.4p1. There are
also two ports: security/openssh and
security/openssh-portable, which are a patched
OpenBSD version and the portable version,
respectively. Soda is running the former, AFAIK.
--dbushong
\_ The only installed openssh port I see is:
/var/db/pkg/openssh-3.4_4
\_ What's the bottom line? Is soda's current version compromised?
\_ I don't think so. Plus, the compromise is just a side effect
of the build, and (supposedly) should not affect the built
executables.
\_ No. The MD5 on the src tar ball in /usr/ports/distfiles
matches the correct MD5:
MD5 (openssh-3.4.tgz) = 39659226ff5b0d16d0290b21f67c46f2
soda$ cd /usr/ports/distfiles/ && md5 openssh-3.4.tgz
MD5 (openssh-3.4.tgz) = 39659226ff5b0d16d0290b21f67c46f2
\_ Here is what I've heard from a reliable source: (sorry, no
url)
"If you didn't rebuild OpenSSH from scratch in the past 36
hours you don't have to worry about it and the trojaned
code was replaced with a clean copy by 6am PDT. The trojan
was that someone added a line to a Makefile such that during
compilation, a socket is opened to a hacked machine once an
hour to await "commands" (or example, open a shell, or die).
The OpenSSH code base wasn't touched. The hacked machine was
wiped early early this AM.
I haven't heard anything about whether the SunOS 4.1.X FTP
server (the OpenSSH project hosts there because the people
who offered to host it there have lots of bandwidth) was
hacked, or if this was some kind of inside job from someone
who had appropriate levels of access on that host.
Like you doctor always said, check your md5 checksums and your
PGP sigs. The FreeBSD "ports" system does that automatically
and refused to build and install the tainted coded." |