[Unreal-users] countermeasures

[Bram M. (Syzop) <sy...@vu...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi all,

After receiving many questions of what we are doing with regards to the hack
incident, here's my reply:

First, we now PGP/GPG sign releases. Our GPG key is rel...@un...
(0x9FF03937). When downloading UnrealIRCd you will be given instructions on
how to verify the integrity of the file.

Second, we're now isolating/shielding the main site from the rest, and making
parts unmodifiable, to prevent catastrophes in case of a break-in.

Third, we added several methods of detection when files and other data is
modified.

Fourth, we'll only serve the files from the main site for now. While the
mirror admins did not have any blame in this, it does mean we only have to
protect our own site(s).

And finally we did some other things which I won't mention here.

In short: we've really tightened security since the break-in to make sure this
will never ever happen again. As you may understand, we really can't afford a
repeat of this incident.

On an unrelated side note, I find the claims in various media that this
security incident indicates that Linux and Open Source cannot be trusted and
that Microsoft and closed-software is better really silly. It lacks any
foundation. A hacker, once in, could just as easily have inserted the backdoor
in Windows software. In fact, it is *THANKS* to it being Open Source that this
backdoor got noticed, though - I fully agree - much too late.

- --
Bram Matthys
Software developer/IT consultant        sy...@vu...
PGP key:                       www.vulnscan.org/pubkey.asc
PGP fp: BBBC E14E 3D9B 3655 7BE1 24A0 E3A8 A873 9DF4 E5AF
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)

iD8DBQFMFosK46ioc5305a8RAmDEAKDTuw29yKIBaX5d0ps8HZWh+SZ11ACgwEES
3YAEvVlHmpWtxDSMHlbpvyI=
=1guj
-----END PGP SIGNATURE-----