Date: Mon, 04 Jul 2011 22:31:07 -0500 From: HD Moore <hdm@...italoffense.net> To: Solar Designer <solar@...nwall.com> CC: oss-security@...ts.openwall.com, scarybeasts@...il.com Subject: Re: vsftpd download backdoored On 7/4/2011 9:26 PM, Solar Designer wrote: > On Tue, Jul 05, 2011 at 10:09:32AM +0800, Eugene Teo wrote: >> I did not verify. >> >> (09:55:37 AM) hdmoore: The timestamp on vsftpd-2.3.4.tar.gz >> http://bit.ly/j4VC5y indicates that the backdoor was present from Feb >> 15th -> July 3rd (via mc) > > Looks unrealistic to me. Feb 15 is when 2.3.4 was released by Chris. > A copy I downloaded has mtime Feb 15 (preserved from the official > download site) and ctime Mar 2 (when I downloaded it). It passes the > GPG signature check and lacks the backdoor. > > Additionally, searching for the SHA-256 digest that Chris posted reveals > only copies of his announcement of the incident and news stories about > it. No hits for any distro's filelists, etc. I wish we had MD5 and > SHA-1 to also search for, though. I don't have a copy of the backdoored > vsftpd tarball to compute those, but we can ask Chris for them. > > My gut feeling is that the backdoored tarball has been on the site for > 1 to 3 days. But I could be wrong. Thanks for the CC -- as a guess as to what happened; was this particular mirror compromised and the original tarball modified (along with its mtime) to match the original Feb 15th date? Does anyone have a "we noticed it first" flag that is before July 3rd? Debian (and most other repos) are storing the SHA-256/SHA1/MD5 of each source package, so a Feb 15 date does seem incredible, but so does the complete pwnage of a non-official mirror with the original mtime, at the same moment as an official dist server compromise. A nightly rsync would account for this, but we would need to know more about the mirror structure from Chris. I am happy to correct the metasploit module if new facts arrive; thank you to everyone who spends their free time dealing with this crap. -HD
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.