If you are someone who are read lot of infosec news then i’m sure you must have heard of how Popular linux distribution Gentoo Linux official github account was hacked last week . After the account was hacked, hacker changed some codes and added some malicious scripts in it that delete’s all the user files.
Gentoo is a free operating system with Pre compiled binaries and it is an ideal secure server for development workstation, professional desktop, gaming system, embedded solution.
The incident took place on 28 June at approximately 20:20 UTC and Gentoo regained control by 2018-06-28 23:10 UTC.
According to gentoo, the hack has not affected the code hosted on the the gentoo infrastructure and the code hosted in github is just a mirror . Gentoo.org was not compromised.
How they got hacked ?
Gentoo developers have revealed that the attackers were able to gain administrative privileges for its github account after guessing the account password. Its 2018 and i don’t know why organisations like Gentoo does not use 2 factor authentication.
The organisation could have been saved if it was using a two-factor authentication, which requires an additional passcode besides the password in order to gain access to the account.
Steps taken to improve future attacks
After this incident, gentoo took the following steps to protect themselves from future attacks :
- Making frequent backups of its GitHub Organization.
- Enabling two-factor authentication by default in Gentoo’s GitHub Organization, which will eventually come to all users the project’s repositories.
- Working on an incident response plan, particularly for sharing information about a security incident with users.
- Tightening up procedures around credential revocation.
- Reducing the number of users with elevated privileges, auditing logins, and publishing password policies that mandate password managers.
- Introducing support for hardware-based 2FA for Gentoo developers
