[gentoo-dev] Hostile takeover of our github mirror. Don't use ebuild from there until new warning!

[gentoo-dev] Hostile takeover of our github mirror. Don't use ebuild from there until new warning!

[Francisco Blas Izquierdo Riera (klondike)]

[-- Attachment #1.1: Type: text/plain, Size: 542 bytes --]

Hi!

I just want to notify that an attacker has taken control of the Gentoo
organization in Github and has among other things replaced the portage
and musl-dev trees with malicious versions of the ebuilds intended to
try removing all of your files.

Whilst the malicious code shouldn't work as is and GitHub has now
removed the organization, please don't use any ebuild from the GitHub
mirror ontained before 28/06/2018, 18:00 GMT  until new warning.

Sincerely,
Francisco Blas Izquierdo Riera (klondike)
Gentoo developer.



[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[gentoo-dev] Re: Hostile takeover of our github mirror. Don't use ebuild from there until new warning!

[Francisco Blas Izquierdo Riera (klondike)]

[-- Attachment #1.1: Type: text/plain, Size: 796 bytes --]

El 28/06/18 a las 23:15, Francisco Blas Izquierdo Riera (klondike) escribió:
> Hi!
>
> I just want to notify that an attacker has taken control of the Gentoo
> organization in Github and has among other things replaced the portage
> and musl-dev trees with malicious versions of the ebuilds intended to
> try removing all of your files.
>
> Whilst the malicious code shouldn't work as is and GitHub has now
> removed the organization, please don't use any ebuild from the GitHub
> mirror ontained before 28/06/2018, 18:00 GMT  until new warning.
>
> Sincerely,
> Francisco Blas Izquierdo Riera (klondike)
> Gentoo developer.
>
>
Just to keep up with it. There is a more complete article published at
https://www.gentoo.org/news/2018/06/28/Github-gentoo-org-hacked.html




[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

[gentoo-dev] Re: Hostile takeover of our github mirror. Don't use ebuild from there until new warning!

[M. J. Everitt]

[-- Attachment #1.1: Type: text/plain, Size: 941 bytes --]

On 28/06/18 22:54, Francisco Blas Izquierdo Riera (klondike) wrote:
> El 28/06/18 a las 23:15, Francisco Blas Izquierdo Riera (klondike) escribió:
>> Hi!
>>
>> I just want to notify that an attacker has taken control of the Gentoo
>> organization in Github and has among other things replaced the portage
>> and musl-dev trees with malicious versions of the ebuilds intended to
>> try removing all of your files.
>>
>> Whilst the malicious code shouldn't work as is and GitHub has now
>> removed the organization, please don't use any ebuild from the GitHub
>> mirror ontained before 28/06/2018, 18:00 GMT  until new warning.
>>
>> Sincerely,
>> Francisco Blas Izquierdo Riera (klondike)
>> Gentoo developer.
>>
>>
> Just to keep up with it. There is a more complete article published at
> https://www.gentoo.org/news/2018/06/28/Github-gentoo-org-hacked.html
>
>
>
Antarus has also posted on g-announce ML fyi ;)


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [gentoo-dev] Hostile takeover of our github mirror. Don't use ebuild from there until new warning!

[Richard Yao]

> On Jun 28, 2018, at 5:15 PM, Francisco Blas Izquierdo Riera (klondike) <klondike@gentoo.org> wrote:
> 
> Hi!
> 
> I just want to notify that an attacker has taken control of the Gentoo
> organization in Github and has among other things replaced the portage
> and musl-dev trees with malicious versions of the ebuilds intended to
> try removing all of your files.
> 
> Whilst the malicious code shouldn't work as is and GitHub has now
> removed the organization, please don't use any ebuild from the GitHub
> mirror ontained before 28/06/2018, 18:00 GMT  until new warning.
Is the attacker using the account “gentoogang”?
> 
> Sincerely,
> Francisco Blas Izquierdo Riera (klondike)
> Gentoo developer.
> 
> 

Re: [gentoo-dev] Hostile takeover of our github mirror. Don't use ebuild from there until new warning!

[Richard Yao]

> On Jun 28, 2018, at 8:46 PM, Richard Yao <ryao@gentoo.org> wrote:
> 
> 
>> On Jun 28, 2018, at 5:15 PM, Francisco Blas Izquierdo Riera (klondike) <klondike@gentoo.org> wrote:
>> 
>> Hi!
>> 
>> I just want to notify that an attacker has taken control of the Gentoo
>> organization in Github and has among other things replaced the portage
>> and musl-dev trees with malicious versions of the ebuilds intended to
>> try removing all of your files.
>> 
>> Whilst the malicious code shouldn't work as is and GitHub has now
>> removed the organization, please don't use any ebuild from the GitHub
>> mirror ontained before 28/06/2018, 18:00 GMT  until new warning.
> Is the attacker using the account “gentoogang”?

Nevermind. After reading other mailing list threads, it is clear to me that he was the attacker. :/
>> 
>> Sincerely,
>> Francisco Blas Izquierdo Riera (klondike)
>> Gentoo developer.
>> 
>> 
> 
>