Recently, the Linux version of UnrealIRCd was discovered to have had a Trojan worm its way into the source code. Even more embarrassing for the developers of Unreal is that the Trojan's been holding open the backdoor in the source code since November of 2009-- not very recently. And, of course, bloggers and press in general are taking the opportunity of another breach in Linux security to point out doomsday devices that don't really exist.
To read all comments associated with this story, please click here.
Member since:2007-02-17
in this case - 6 months, and nobody noticed? that kind of failure cannot possibly be described correctly.
On Ubuntu, there are at least three different IRC servers that can be installed directly via the normal repositories using apt-get or synaptic.
http://ubuntuforums.org/showthread.php?t=233146
They are ircd-hybrid, bahamut and ircd-ircu
http://ircd-hybrid.com/
http://www.dal.net/?page=Bahamut
http://coder-com.undernet.org/
I would suggest perhaps that the audience for this UnrealIRCd program is not all that large. Maybe nobody downloaded it.
Member since:2010-06-15
I'm registering just because watching you talk out of a completely ignorant position is just maddening.
Most irc daemons are compiled from source, they are not fetched as packages. You have a number of compile-time options you have to consider, such as setting hard-coded options and limits that may matter based upon the services you provide. Deploying a server from a package is ill-advised and I cannot think of any major IRC network where they would commonly link to a server running such a thing, since all of them have configuration standards you have to meet, not all of them similar and not all of them may be tunable via a configuration file depending on your ircd.
In fact, out of the three you listed there, one of them had a spotty security track record already on its own (Bahamut), one has been forked and pretty much depreciated (Hybrid, the biggest backers are pushing Ratbox) and the other is obscure at best (ircu), being an absolutely archaic codebase used primarily by a single, formerly notable network.
Calling UnrealIRCd 'obscure' because it's not on a package list is taking the cake on this drivel I see you post here. Had you even done a cursory search on this, such as checking any of the sites constantly scanning for and crawling ircd servers -- you'd find out that Unreal is actually the most popular ircd deployed, period.
http://searchirc.com/ircd-versions
Seriously.
So yes, this is a bigger deal than you'd think.
Member since:2006-02-15
in this case - 6 months, and nobody noticed? that kind of failure cannot possibly be described correctly.
The explanation is rather simple: it was not the main server that was compromised nor any distribution repositories, only mirror servers. As such the malware issue couldn't be very widespread. Even more so that UnrealIRCD is mostly used by rather small IRC networks; had it been used by a very large network the backdoor would most likely have been noticed a whole lot earlier (if they had downloaded UnrealIRCD from a mirror and not from the actual distro repos, which is highly unlikely and stupid anyway in the case you host a public server.)
It's just plain common sense that it took a while to be found.
"The Verge has learned that HTC's Chief Product Officer, Kouji Kodera, left the company last week. Kodera was responsible for HTC's overall product strategy, which makes the departure especially notable on the heels of the global launch of the make-or-break One. It's not just Kodera. In the past three-odd months, HTC has lost a number of employees in rapid succession." I really hope HTC pulls it together.
"It is with huge pleasure that the Debian GNU/Hurd team announces the release of Debian GNU/Hurd 2013. This is a snapshot of Debian 'sid' at the time of the Debian 'wheezy' release (May 2013), so it is mostly based on the same sources. It is not an official Debian release, but it is an official Debian GNU/Hurd port release." Important note: 75% of Debian packages are supported bu Debian GNU/Hurd. Impressive.
"The first killer app was VisiCalc. This early spreadsheet turned the Apple II from a hobbyist toy to a business computer. VisiCalc came with room for improvement, though. In addition, a new architecture and operating system, the Intel-based IBM PC and MS-DOS, also needed a spreadsheet to be taken seriously. That spreadsheet, released in early 1983, would be Lotus 1-2-3, and it would change the world. It became the PC's killer app, and the world would never be the same. On May 14, IBM quietly announced the end of the road for 1-2-3, along with Lotus Organizer and the Lotus SmartSuite office suite. Lotus 1-2-3's day is done." Impressive 30 year run.
"There's a disconnect between how Apple CEO Tim Cook sees his company's tax strategies and how some members of the US Senate view it. That became clearer than ever today after Cook and two other Apple executives testified before Congress, explaining why they're holding most of their international income in Irish subsidiaries like Apple Operations International, which declare no tax residency anywhere in the world. AOI hasn't filed a tax return anywhere in the world for the last five years, yet it earned $30 billion in income from 2009 to 2012, according to a Senate report released yesterday." Just because something is legal, doesn't mean it's just. Apple, Google, Microsoft, and many more - these companies might not be breaking any laws, but it's obvious to anyone that what they are doing is scummy.
The new WebKit Opera for Android has been released. "Opera 14 for Android is built on top of Chromium 26, with a total overhaul of the UI in native code, making it fit well with the latest Android design guidelines. Go get the build from Google Play or point your browser to m.opera.com, and give it a spin!"
The Verge pointed me to a blog post by Leap Motion - which reveals how their Kinect-like motion control works with Windows 8. "From the second you plug in your Leap Motion Controller, you'll be able to browse the web and interact with your computer just by moving your hands and fingers in the air. With Leap Motion technology and Windows, you can do everything that's possible with multi-touch inputs - without actually touching anything. This also means that existing applications in Windows 7 and 8 will respond to your natural hand and finger movements. Soon, we'll show you how Leap Motion will work with Mac OS X." Quite cool.PocketNow interviews Marc Dillon, and there's an interesting note about why Jolla is keeping the display properties under wraps: "We're leaving some of those details out because we do understand that there are a lot of really big players in the market and they tend to take certain components in the market and dominate them. We created the ability to actually be able to run Sailfish on multiple hardware displays and be able to swap components, so this is part of the demand and supply planning phase. We are committed to this industrial design which is a 4.5-inch display, an 8 megapixel camera on the back and a front-facing camera at the front, and the exact specs of the display we'll provide when we're close to delivery." Something you rarely hear anything about.
"This is my NeXTstation Turbo Color booting the Mac System 7.1 Operating System using a hardware add-on called 'Daydream'. The Daydream has a Mac ROM and a few custom ICs in it and hooked up to the NeXTs DSP port. Turns your NeXT into a full fledged 68k powered Mac." So cool.
"The NetBSD Project is pleased to announce NetBSD 6.1, the first feature update of the NetBSD 6 release branch. It represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. Please note that all fixes in the prior security/bugfix updates (NetBSD 6.0.1 and 6.0.2) are also in 6.1."
"At the end of a week in which Electronic Arts confirmed it wasn't developing a thing for the Wii U, one of the software engineers in EA Sports' Canada studio, in a series of since-deleted tweets, disparaged the console as 'crap' and suggested Nintendo should give up on hardware altogether. 'The Wii U is crap. Less powerful than an Xbox 360. Poor online/store. Weird tablet', tweeted Bob Summerwill, listed as a senior software engineer at EA Canada, in a reply to a tweet posting a link about EA's no-Wii U news. 'Nintendo are walking dead at this point'." The Wii U is turning into the 21st century's Virtual Boy.
Member since:
2009-12-14
i remember when wordpress 2.1.1 was compromised in this way ( http://wordpress.org/development/2007/03/upgrade-212/ ) but the issue was caught pretty fast.
in this case - 6 months, and nobody noticed? that kind of failure cannot possibly be described correctly.