On Sat, Oct 01, 2005 at 11:36:52PM +0100, Marcus Cooper wrote:

On 01/10/05, Chema Ollés wrote:

...

Hi: I see... :-( No words

According to this (it's a archive of attacks) http://www.zone-h.org/defacements/filter/filter_defacer=IHS%20IRAN%20HACKERS... they appear to have hit quite a few Novell sites.

A few minutes ago it said that opensuse.org was hosted on a Novell Netware server which struck me as a bit odd, but it's been changed now.

Looking at the source, there is a picture that points to ihsteam.com. That is hosted in the US: houghi@penne : mx ihsteam.com Information on ihsteam.com with ns3.simorgh.co.uk. as primary nameserver: Primary and secondary nameservers : ns3.simorgh.co.uk. ns4.simorgh.co.uk. A record and CNAME: ihsteam.com. 14400 IN A 147.202.64.138 Record for www.ihsteam.com: www.ihsteam.com. 14400 IN CNAME ihsteam.com. ihsteam.com. 14400 IN A 147.202.64.138 MX record for ihsteam.com: ihsteam.com. 14400 IN MX 0 ihsteam.com. Known A records for ihsteam.com on ns3.simorgh.co.uk. ihsteam.com. 14400 IN A 147.202.64.138 ihsteam.com. 14400 IN A 147.202.64.138 ns3.simorgh.co.uk. 14400 IN A 147.202.64.138 ns4.simorgh.co.uk. 14400 IN A 147.202.64.139 Reversed for 147.202.64.138 and is in United States . Reversed for 147.202.64.139 and is in United States . houghi -- Quote correct (NL) http://www.briachons.org/art/quote/ Zitiere richtig (DE) http://www.afaik.de/usenet/faq/zitieren Quote correctly (EN) http://www.netmeister.org/news/learn2quote.html

Am Sonntag, 2. Oktober 2005 02:42 schrieb pmoellon:

houghi wrote:

...

On Sat, Oct 01, 2005 at 11:36:52PM +0100, Marcus Cooper wrote:

...

On 01/10/05, Chema Ollés wrote: ... But i hope if they have, they will use it that way; NOT like defacing wiki and opensuse and other, even if they feel it's their right. Because what is really needed on Earth is peace.

Et terra in pacem.

Have nicers things to do like trying to understand why xmms (not using Amarok) "hangs" (not the process, the music!),

Hmm, tonight I tried Alpha1 (x86) on my laptop and xmms and amarok works great (self-compiled libxine) BTW: The konqueror shows a lot of information for mp3-files, but none for ogg-files. Am I missing some libs or is there no meta-info for ogg build-in?

goes to the beginning, and have other odd behaviour, while reading from a vfat disk.

vfat not yet tried, nfs-/smb-shares works.

Maybe a question of codepage or iocharset.

No, not for binary data like music. With the wrong codepage/iocharset the filenames get trashed. -- mdc

Ohhh .. interesting ...opensuse targeted due to being an open project .. but Iran not being allowwed nuclear power ? houghi wrote: Darn. It is just after midnight on a saturday night, so I hope they can solve this fast. houghi --------------------------------- How much free photo storage do you get? Store your holiday snaps for FREE with Yahoo! Photos. Get Yahoo! Photos

On Sun, Oct 02, 2005 at 01:25:37AM +0200, Eberhard Moenkeberg wrote:

Hi,

On Sat, 1 Oct 2005, Marcus Cooper wrote:

...

Looks like Iran Hackers have defaced opensuse.org

Wow, indeed:

Anybody with phonenumbers for people who can be called? Either here or in the US or wherever? I already send an email to webmaster @ novell.com, opensuse.org and suse.de, but I am not sure these will be read. If you have a number and are unable to call, I can do it with skype. No real cost involved. houghi -- Quote correct (NL) http://www.briachons.org/art/quote/ Zitiere richtig (DE) http://www.afaik.de/usenet/faq/zitieren Quote correctly (EN) http://www.netmeister.org/news/learn2quote.html

On Sun, Oct 02, 2005 at 04:09:09PM +0200, meister@netz00.com wrote:

...

If you have a number and are unable to call, I can do it with skype. No real cost involved.

Hi houghi,

did you make skype for linux work over a proxy or direct? For me direct works, but using the same proxy and the same settings as in windows results in no connection. There is even no request send to my proxy.

No proxy. Never used a proxy. houghi -- Quote correct (NL) http://www.briachons.org/art/quote/ Zitiere richtig (DE) http://www.afaik.de/usenet/faq/zitieren Quote correctly (EN) http://www.netmeister.org/news/learn2quote.html

On Sat, Oct 01, 2005 at 07:35:43PM -0400, Jorge Fábregas wrote:

On Saturday 01 October 2005 6:20 pm, Marcus Cooper wrote:

...

Looks like Iran Hackers have defaced opensuse.org

I can see it. It has been more than 30 minutes since since OP posted the msg. Where's the sysadmin?? :(

Seems they are working on it. I asume they first need to close the leak before they can put it back. houghi -- Quote correct (NL) http://www.briachons.org/art/quote/ Zitiere richtig (DE) http://www.afaik.de/usenet/faq/zitieren Quote correctly (EN) http://www.netmeister.org/news/learn2quote.html

On Sunday 02 October 2005 02:16, Eberhard Moenkeberg wrote:

On Sun, 2 Oct 2005, houghi wrote:

...

On Sat, Oct 01, 2005 at 07:35:43PM -0400, Jorge Fábregas wrote:

...

On Saturday 01 October 2005 6:20 pm, Marcus Cooper wrote:

...

Looks like Iran Hackers have defaced opensuse.org

I can see it. It has been more than 30 minutes since since OP posted the msg. Where's the sysadmin?? :(

Seems they are working on it. I asume they first need to close the leak before they can put it back.

Yes. Adrian has alarmed the people in Provo. Only the Wiki part of www.opensuse.org is located in Provo, everything else is in Nuernberg. So the distribution itself is not polluted.

Yes, thank you all for your mails. And the others for calling me. Provo is already working on the problem. sorry for that adrian -- Adrian Schroeter SUSE Linux Products GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany email: adrian@suse.de

Am Sonntag, 2. Oktober 2005 01:35 schrieb Jorge Fábregas:

...

Looks like Iran Hackers have defaced opensuse.org I can see it. It has been more than 30 minutes since since OP posted

On Saturday 01 October 2005 6:20 pm, Marcus Cooper wrote: the msg. Where's the sysadmin?? :(

In the next bar, having a drink, it's saturday night ;-) -- mdc

On Sun, Oct 02, 2005 at 07:45:42AM +0100, James Ogley wrote:

Mental note, when I give the CD set to some friends who want to try out Linux for the first time, suggest they wait a day or so before checking the website...

Why wait a day, I hope it is fixed it when SUSE 10.0 comes out. houghi -- Quote correct (NL) http://www.briachons.org/art/quote/ Zitiere richtig (DE) http://www.afaik.de/usenet/faq/zitieren Quote correctly (EN) http://www.netmeister.org/news/learn2quote.html

On Sun, Oct 02, 2005 at 09:12:53AM +0200, Dominique Leuenberger wrote:

Are there any informations available on how the break-in happened? What module exactly was exploited? I think it would be essential to know so others can learn out of this case.

I asume that the main action is now solving the problem. Giving the solution will come after that. At this moment it is not, so we have to wait. houghi -- Quote correct (NL) http://www.briachons.org/art/quote/ Zitiere richtig (DE) http://www.afaik.de/usenet/faq/zitieren Quote correctly (EN) http://www.netmeister.org/news/learn2quote.html

On Sunday 02 October 2005 09:12, Dominique Leuenberger wrote:

houghi wrote:

...

On Sun, Oct 02, 2005 at 07:45:42AM +0100, James Ogley wrote:

...

Mental note, when I give the CD set to some friends who want to try out Linux for the first time, suggest they wait a day or so before checking the website...

Why wait a day, I hope it is fixed it when SUSE 10.0 comes out.

houghi

Are there any informations available on how the break-in happened? What module exactly was exploited? I think it would be essential to know so others can learn out of this case.

Only some vague information. But the images of the server will go to our security team, so we will know more exactly later. However, it was not the latest mediawiki version, which was running .... I heard that the server will be back with current mediawiki in about 3 hours (no guarantee). good morning :) bye adrian -- Adrian Schroeter SUSE Linux Products GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany email: adrian@suse.de

On Sunday 02 October 2005 10:20, houghi wrote:

On Sun, Oct 02, 2005 at 10:11:41AM +0200, Adrian Schroeter wrote:

...

I heard that the server will be back with current mediawiki in about 3 hours (no guarantee).

Is that a backup, or the real thing? If a backup, from when? It could be that people have done changes that were not on the backup.

The database is on a different system, which is not affected to my knowledge. So there will be no data loss, in worst case some invalid injections, which can get returned. However, we will know in more detail, when the forensic team and the security-team reviewed the images. bye adrian -- Adrian Schroeter SUSE Linux Products GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany email: adrian@suse.de

On Sun, Oct 02, 2005 at 09:12:53AM +0200, Dominique Leuenberger wrote:

houghi wrote:

...

On Sun, Oct 02, 2005 at 07:45:42AM +0100, James Ogley wrote:

...

Mental note, when I give the CD set to some friends who want to try out Linux for the first time, suggest they wait a day or so before checking the website...

Why wait a day, I hope it is fixed it when SUSE 10.0 comes out.

houghi

Are there any informations available on how the break-in happened? What module exactly was exploited? I think it would be essential to know so others can learn out of this case.

Please do not confuse defacement with a break in.

Cheers, Dominique

--------------------------------------------------------------------- To unsubscribe, e-mail: opensuse-unsubscribe@opensuse.org For additional commands, e-mail: opensuse-help@opensuse.org

On Sun, Oct 02, 2005 at 10:13:15AM +0200, Adrian Schroeter wrote:

...

Why wait a day, I hope it is fixed it when SUSE 10.0 comes out.

The SL 10.0 release will not get delayed by this, because the ftp/rsync/... servers are complete independent from the wiki server.

I understand. I just was asuming that it was solved when 10.0 comes out. So there would be no reason to wait. houghi -- Quote correct (NL) http://www.briachons.org/art/quote/ Zitiere richtig (DE) http://www.afaik.de/usenet/faq/zitieren Quote correctly (EN) http://www.netmeister.org/news/learn2quote.html

James Ogley writes:

...

Why wait a day, I hope it is fixed it when SUSE 10.0 comes out.

It's an RC1 set sitting on my desk right now.

Oh, and before I write an accompanying wiki entry on how to install the popular non-free plugins (flash/real/adobe) as well as mplayerplug-in (as soon as the PackMan crew do a 10.0 build of it), is there one already? I looked, but couldn't find it.

flash/real/adobe will be available on ftp.suse.com as part of the extra tree...

[...]

Andreas -- Andreas Jaeger, aj@suse.de, http://www.suse.de/~aj SUSE Linux Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126

James Ogley writes:

...

flash/real/adobe will be available on ftp.suse.com as part of the extra tree...

cool, will the extra tree be available as a YaST repo?

yes.

(and what will the details be?) :)

Check the 10.1-Alpha1 tree on ftp.suse.com, Andreas -- Andreas Jaeger, aj@suse.de, http://www.suse.de/~aj SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 Nürnberg, Germany GPG fingerprint = 93A3 365E CE47 B889 DF7F FED1 389A 563C C272 A126