Linux IRC Server Gets Trojan, Press Harps On Linux Security
Linked by Jordan Spencer Cunningham on Mon 14th Jun 2010 23:58 UTC
Bugs & Viruses Recently, the Linux version of UnrealIRCd was discovered to have had a Trojan worm its way into the source code. Even more embarrassing for the developers of Unreal is that the Trojan's been holding open the backdoor in the source code since November of 2009-- not very recently. And, of course, bloggers and press in general are taking the opportunity of another breach in Linux security to point out doomsday devices that don't really exist.
E-mail Print r 5   · Read More · 111 Comment(s) http://osne.ws/i3c
Permalink for comment 430431
To read all comments associated with this story, please click here.
RE[3]: Comment by lemur2
by lemur2 on Thu 17th Jun 2010 00:29 UTC in reply to "RE[2]: Comment by lemur2"
lemur2
Member since:
2007-02-17

And as we have learned from the past, not only do most distributors not read the source, when they do make changes, its not always going to be a secure edit. This boils down to the distros were just lazy enough that they didn't get this latest source and compile it. If they had been following this as closely as say Firefox, there surely would have been an updated packed with the source version. But none of us have any evidence that at least one had not done this already.


It was getting what they thought was the latest source version, without accompanying signatures to verify its integrity, that caused this problem.

UnRealIRC is not in Debians repositories, for example, and hence not in Ubuntu's as well. Debian considered it too much of a security risk, and too obscure to be worth it.

AFAIK, it is not in Fedora's repositories, nor in SuSe's, nor in Mandriva's, nor in any of the distributions derived from any of these.

That is most distributions.

Edited 2010-06-17 00:30 UTC

Reply Parent Score: 2