Linux Australia breached, personal details leaked

The open-source and free software user group Linux Australia said personal information for attendees of two conferences it hosts may have been leaked after malware was found on one of its servers.

The information may have included first and last names, postal and email addresses, phone numbers and hashed passwords, wrote Joshua Hesketh, Linux Australia’s president, on a message board. Financial data was not affected, he wrote.

The breach affects those who registered for the group’s Linux conference over the last three years and for python programming conference Pycon Australia in 2013 and 2014, he wrote. Attendee data for those conferences was held on the compromised server.

Although there aren’t indications that information was removed from the server, those affected are advised to change the password they used to register, especially if the same one is used on other websites.

Linux Australia discovered the breach on March 24 after it noticed conference management software it uses called Zookeepr started sending a large number of error reporting emails, Hesketh wrote. A server had been attacked two days prior.

“It is the assessment of Linux Australia that the individual utilized a currently unknown vulnerability to trigger a remote buffer overflow and gain root level access to the server,” Hesketh wrote.

The attacker installed a remote access tool and then botnet command and control software.

Linux Australia has decommissioned the infected server and strengthened security on the new one. Hesketh wrote that the new server will have “a far more rigorous operating schedule applied to it.” A log analysis tool has also been installed.

Websites for the conferences will in the future be archived six months after a conference concludes and then kept on a separate server and deleted from Zookeepr, Hesketh wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk