Linked by Jordan Spencer Cunningham on Mon 14th Jun 2010 23:58 UTC
Bugs & Viruses Recently, the Linux version of UnrealIRCd was discovered to have had a Trojan worm its way into the source code. Even more embarrassing for the developers of Unreal is that the Trojan's been holding open the backdoor in the source code since November of 2009-- not very recently. And, of course, bloggers and press in general are taking the opportunity of another breach in Linux security to point out doomsday devices that don't really exist.
Thread beginning with comment 430047
To view parent comment, click here.
To read all comments associated with this story, please click here.
RE[2]: Comment by lemur2
by lemur2 on Tue 15th Jun 2010 03:43 UTC in reply to "RE: Comment by lemur2"
Member since:

Distributor don't read the source code every time they package a software. Most of them just update the content of the "src" folder with the new code and and edit the debian/changelog file. It does not prevent infected software from going in, signed or not.

BTW, GPG signing of the code and requiring it to be installed via a package manager would have prevented this particular incident from happening to the UnrealIRCd application.

Edited 2010-06-15 03:44 UTC

Reply Parent Score: 2

RE[3]: Comment by lemur2 - Gentoo
by jabbotts on Tue 15th Jun 2010 19:41 in reply to "RE[2]: Comment by lemur2"
jabbotts Member since:

Except in the case of Gentoo. Hopefully a more complete list of affected distributions will turn up in the next few days though. It would be interesting to see how far it managed to get. Ideally, with reports of Windows and other platform's who had the malicious tarball compiled for use.

Reply Parent Score: 2