Kernel.org servers infected with backdoors for two years from 2009 | Hacker News Reader

Kernel.org servers infected with backdoors for two years from 2009

arstechnica.com

139 pointsyau8edq12i11 comments

Open articleView on HN

The title is quite clickbaity I think, because of this:

> Occurred no later than August 12, 2011, and wasn't detected for another 17 days

which also had a discussion on HN in 2013:

Who rooted kernel.org servers two years ago? (https://news.ycombinator.com/item?id=6438326) - Sep 2013 (45 comments)

The article from ESET is here,

Ebury is alive but unseen: 400k Linux servers compromised for cryptocurrency theft and financial gain (https://www.welivesecurity.com/en/eset-research/ebury-alive-...) - May 2024

but the article itself only serves as an introduction to the PDF:

https://web-assets.esetstatic.com/wls/en/papers/white-papers...

What's new (versus when the story broke years ago) is:

> A 47-page report summarizing Ebury's 15-year history said that the infection hitting the kernel.org network began in 2009, two years earlier than the domain was previously thought to have been compromised.

I think you grok that, but I don't think the title is clickbait.

I read the arstechnica post and didn't grok that at all; thanks for explaining. I spent the whole article wondering what prompted them to report on something that happened over a decade ago now.

It definitely buries the lede and is overcomplicated

> Maintainers reneged on a promise[0] to provide an autopsy of the hack, a decision that has limited the public’s understanding of the incident.

[0] https://arstechnica.com/information-technology/2013/09/who-r...

This bit makes it sound like 3 letter agencies were involved?

Or someone famous and thin skinned was involved? That’s where my mind went

This was in the news a while ago. It was a guy in his 20s in Miami: https://regmedia.co.uk/2016/09/02/linux_hack.pdf.

Who is also in the Panama Papers... https://offshoreleaks.icij.org/nodes/12097929

But they were talking about the GoDaddy hack with Ebury, and Austin was only kernel.org, linux foundation and probably apache.org.

So who was GoDaddy? Not NSA for sure. They call it the Ebury group and they do have some hints

I don't see any mention of GoDaddy being hacked with Ebury in the ESET report or the Ars article.

Why on earth jump to the most outrageous conspiracy? That's an absurd leap.

AHEM... opsec fail.

Reply on news.ycombinator.com