FreeBSD.org intrusion announced November 17th 2012 | The FreeBSD Project

From: FreeBSD Security Officer <security-officer@FreeBSD.org> To: FreeBSD Security <FreeBSD-security@FreeBSD.org> Bcc: freebsd-announce@freebsd.org, freebsd-security-notifications@FreeBSD.org Reply-To: secteam@FreeBSD.org Subject: Security Incident on FreeBSD Infrastructure
On Sunday 11th of November, an intrusion was detected on two machines within the FreeBSD.org cluster. The affected machines were taken offline for analysis. Additionally, a large portion of the remaining infrastructure machines were also taken offline as a precaution.
We have found no evidence of any modifications that would put any end user at risk. However, we do urge all users to read the report available at http://www.freebsd.org/news/2012-compromise/ and decide on any required actions themselves. We will continue to update that page as further information becomes known. We do not currently believe users have been affected given current forensic analysis, but we will provide updated information if this changes.
As a result of this event, a number of operational security changes are being made at the FreeBSD Project, in order to further improve our resilience to potential attacks. We plan, therefore, to more rapidly deprecate a number of legacy services, such as cvsup distribution of FreeBSD source, in favour of our more robust Subversion, freebsd-update, and portsnap models.
More information is available at http://www.freebsd.org/news/2012-compromise/
Saturday November 17th, 2012
Update: 30th April 2013
Update: 23rd March 2013
Update: 3rd March 2013
Update: 29th December 2012
Update: 27th November 2012
Update: 22nd November 2012
Update: 18th November 2012
Initial Details: 17th November 2012
What has FreeBSD.org done about this?
Port managers and cluster administrators have completed the restoration of binary package building in the last few weeks. This has brought us back the continuous updates for the old-style binary packages on the 8.x and 9.x -STABLE branches. Note that, as beneficial consequences, Release Candidate builds for the 8.4 release cycle can now include binary packages on the install media, and the Project was able to add the missing binary packages retroactively for 9.1-RELEASE on i386 and amd64 platforms.
Port managers are currently working on introducing new-style (as known as "pkgng") binary packages in the coming months, please check the FreeBSD ports announcements list for further gradual status updates.
This is planned to be the last status update to this page. An official announcement will be sent to the FreeBSD announcements mailing list with the further details soon.
Port managers have successfully restored some of the Project’s binary package building capacity. There are some issues left still to resolve, e.g. how to publish the resulting package sets in a secure manner or how to build packages seamlessly for 8.x and 9.x systems on a recent 10.x system that the head node ("pointyhat") is running, but we are very close to finish with the preparations required for providing binary packages for the upcoming 8.4 and further releases.
Redports underwent a full security audit, and as a result could be brought back on line. This took place on the 5th February, and since then more backend hardware has been added to bring it back up to full strength. On 11th February, sanity checks for ports have been turned back on, reenabling generation and update of the INDEX files used. The portsnap(8) service has been switched from CVS to SVN on 25th February. The binary package building infrastructure has undergone a major security review, and as a result many changes have been made to the code. The review completed on the 16th February and we are now in the process of bringing it up on new hardware. At this point, we expect new binary packages to be available in 2-4 weeks.
With the exception of systems relating to the building and testing of packages, all FreeBSD.org infrastructure has now been brought back online. A full audit of the third party package build infrastructure code ("pointyhat") and package testing infrastructure ("redports") continues, and neither system will be brought back online until audits are complete.
As a result, FreeBSD 9.1-RELEASE will be published with only minimal i386 and amd64 (x86_64) precompiled package sets available, and with no packages available for other architectures. This package set will be available on the DVD image, and are sufficient to install either the GNOME or the KDE desktop environment. For any other uses, or for any packages not included on the CD, either using the most recently available -stable package collection or compiling ports from the ports tree are recommended. Packages for 9.1-RELEASE will be made available at a later date. Instructions for obtaining and updating the ports tree can be found in the FreeBSD Handbook.
Due to the legacy third-party package build controller head nodes being offlined pending reinstall, we have been unable to build new package sets over the last two weeks. As a result, FreeBSD 9.1-RELEASE has been delayed as it was felt that we should not ship the release without at least a minimal package set available. We are now in a position where we are once again able to build third-party packages for both of our Tier-1 architectures (i386 and amd64), and are planning on releasing it within the next few days with only a slightly limited set of packages. Please note that historically we have also provided packages on a best-effort basis for some of our Tier-2 architectures such as sparc64, ia64 and powerpc. We are not currently expecting to be in a position to build any Tier-2 packages before FreeBSD 9.1 ships, so initially no precompiled packages will be available for these platforms. We may be in a position to provide some packages for these architectures shortly after the release.
A few reports covering this incident on external tech news websites have confused details relating to how this incident was discovered. Over the last fe