In August 2011, multiple servers used to maintain and distribute the Linux operating system kernel were infected with malware that gave an unknown intruder almost unfettered access. Earlier this week, the five-year-old breach investigation got its first big break when federal prosecutors unsealed an indictment accusing a South Florida computer programmer of carrying out the attack.
Donald Ryan Austin, 27, of El Portal, Florida, used login credentials belonging to a Linux Kernel Organization system administrator to install a hard-to-detect backdoor on servers belonging to the organization, according to the document that was unsealed on Monday. The breach was significant because the group manages the network and the website that maintain and distribute the open source OS that's used by millions of corporate and government networks around the world. One of Austin's motives for the intrusion, prosecutors allege, was to "gain access to the software distributed through the www.kernel.org website."The indictment refers to kernel.org officials P.A. and J.H., who are presumed to be Linux kernel developer H. Peter Anvin and kernel.org Chief System Administrator John "'Warthog9" Hawley, respectively. It went on to say that Austin used the credentials to install a class of extremely hard-to-detect malware known as a rootkit and a Trojan that logs the credentials of authorized users who use the secure shell protocol to access an infected computer.
According to the indictment:
The defendant, DONALD RYAN AUSTIN ("AUSTIN"), used credentials belonging to an individual, J.H., to gain unauthorized access to servers belonging to the Linux Foundation, the Linux Kernel Organization, and P.A. AUSTIN installed the Phalanx rootkit and Ebury Trojan on several of those servers, causing damage without authorization. AUSTIN also used the unauthorized administrative privileges to make other changes to the servers, such as inserting messages that would automatically display when the servers restarted. One of AUSTIN's goals was to gain access to the software distributed through the www.kernel.org website.
Prosecutors went on to say Austin infected Linux servers known as "Odin1," "Zeus1," and "Pub3," which were all leased by the Linux Foundation and used to operate kernel.org. The infections started around August 13, 2011 and continued until around September 1 of that year. Austin also stands accused of infecting a personal e-mail server belonging to Anvin during the same dates. There was no mention of "Hera," a kernel.org server that Linux Kernel officials say had been rooted when they disclosed bare-bones details of the breach shortly after it occurred. Kernel.org was offline for more than a month following the intrusion while the affected servers were rebuilt.
According to a Justice Department release, Austin was arrested by Miami Shores Police on Sunday following a traffic stop. The federal indictment was filed in June and was unsealed only after he was taken into custody. He was freed on $50,000 bond provided by the family of his girlfriend. He has been ordered to stay away from computers, the Internet, and any type of social media or e-mail. Court documents said he "may pose a risk of danger" because of a "substance abuse history." He is scheduled to appear in San Francisco federal court on September 22.
The indictment raises almost as many questions as it answers. Given that Linux is freely available, it's not clear what kernel.org-distributed software Austin hoped to obtain when he allegedly breached the site. Also noticeably absent is any explanation of how Austin initially obtained Hawley's credentials to gain unauthorized access, as prosecutors allege. There's also no detail about the messages that Austin allegedly caused to be displayed when the infected servers were restarted.
What's more, there's little information about Austin, who was just 22 years old when the breach occurred. No record exists of anyone named "Donald Ryan Austin" doing public Linux development or contributing to the Linux Kernel Mailing List. Attempts to reach Austin didn't succeed. Last, why prosecutors took five years to indict the suspect also remains a mystery.
Officials from kernel.org pledged to provide a full autopsy of the breach shortly after it occurred. They never made good on that promise and declined to comment for this post. In the past, they have said they were confident the 2011 breach didn't result in any malicious changes being made to Linux source code.
The intrusion may be the work of someone motivated by a grudge, the challenge of pulling it off, or some other personal motive. But it's not every day that someone gets three weeks of root access to the gateway to one of the world's most widely used operating systems. Until we know more about how and why this breach happened, we should push prosecutors and Linux officials for answers.
reader comments
58