The team behind the FreeBSD operating system has recently reported that an intrusion into two of its hosts was noticed on 11 November. The security team says that the two affected servers were taken offline straightaway and that investigations show that the first unauthorised entree likely took place on 19 September.
Evidently, the intruders did not exploit any security holes in FreeBSD; instead, they stole the SSH key of a developer with regular access privileges.
The team alleges that it’s now audited the basic system (base) in addition to the third-party packages: no unauthorized modifications have been found in the base system’s source code, and all program packages that are presently available to download have also been verified. However, the developers mention that they can’t assure the integrity of packages that were downloaded between 19 September and 11 November.
The project urges that administrators of computers that were updated during this time should consider reinstalling affected systems from trusted authors.
The developers added that they themselves can’t ensure the integrity of package sets that have been uploaded for the future FreeBSD 9.1, and that these sets will be rebuilt before the release of this version of the OS.
