<story><title>Rubygems.org compromised</title><url>http://rubygems.org/gems/exploit/versions/22.31.31</url></story><parent_chain><item><author>willyt</author><text>Maybe I dont understand PGP and this is a stupid question, but if the site is compromised, would it not be possible for them to just put a different key up? One which they knew the private key for? How would you know the public key on the compromised site has not been changed unless you could compare it to the PGP key from before the site was compromised?</text></item><item><author>tptacek</author><text>The Rubygems team (or even just the person who writes the security page) can just generate a new one, for &quot;security@rubygems.org&quot; or whatever, and it can be shared by the team.&lt;p&gt;The purpose of the key is to allow people to report security vulnerabilities without worrying that by doing so they&apos;re giving ammunition to people snooping emails.</text></item><item><author>jasonkester</author><text>What would the PGP key be for?</text></item><item><author>tptacek</author><text>If you want security notices to go to the Rubygems team, you have to set up a security page that tells people how to do that. Like everyone else, I appreciate your volunteer work, but no amount of goodwill creates the ability for people to read your mind.&lt;p&gt;Please post a security page. It literally doesn&apos;t need anything more than an email address and a PGP public key.&lt;p&gt;By the way: if Rubygems needs security help, it looks like there&apos;s quite a number of people who are willing to pitch in. When I published a FreeBSD crt0 bug back in 1996, I was given commit privs. I thought that was a pretty effective way to co-opt adversarial researchers.</text></item><item><author>qrush</author><text>Hi everyone -&lt;p&gt;A full post-mortem is coming, but here&apos;s what happened from my perspective. I got mentioned on twitter about this thread while I was on the bus. I asked @evanphx to put the site into maintenance mode immediately.&lt;p&gt;Once I got on wifi, I downloaded the &quot;exploit&quot; gems and found that they used the Psych hack to post config/initializers/* and config/*.yml to Pastie. Luckily, none of our API keys were actually in those files - our config is a bit different since you can still run RubyGems.org on Heroku, which needs to put secret keys in the ENV.&lt;p&gt;I deleted the exploit gems permanently along with the throwaway account that posted them...that&apos;s why this post&apos;s URL is a 404.&lt;p&gt;I&apos;ve reset our S3 keys just to be sure and any other keys we had on our production site. From what we know right now, no other changes on our S3 bucket have taken place, and we&apos;re going to check the logs to make sure. Once we get a real fix for this issue out, pushing gems will be enabled again.&lt;p&gt;Just a general PSA -&lt;p&gt;Please, if you find an issue like this, be nice. Tell the maintainers privately. Don&apos;t post to Reddit, HN, or a public Gist. RubyGems.org is completely volunteer run. No one gets paid to work on it. Thanks for your patience everyone.</text></item></parent_chain><comment><author>rmoriz</author><text>You can publish the key on keyservers and get some trust on it.&lt;p&gt;e.g&lt;p&gt;&lt;a href=&quot;http://pgp.mit.edu:11371/pks/lookup?search=37signals&amp;#38;op=index&quot; rel=&quot;nofollow&quot;&gt;http://pgp.mit.edu:11371/pks/lookup?search=37signals&amp;#38;op=...&lt;/a&gt;&lt;p&gt;&lt;a href=&quot;http://pgp.mit.edu:11371/pks/lookup?search=heroku&quot; rel=&quot;nofollow&quot;&gt;http://pgp.mit.edu:11371/pks/lookup?search=heroku&lt;/a&gt;</text></comment>
<story><title>Rubygems.org compromised</title><url>http://rubygems.org/gems/exploit/versions/22.31.31</url></story><parent_chain><item><author>willyt</author><text>Maybe I dont understand PGP and this is a stupid question, but if the site is compromised, would it not be possible for them to just put a different key up? One which they knew the private key for? How would you know the public key on the compromised site has not been changed unless you could compare it to the PGP key from before the site was compromised?</text></item><item><author>tptacek</author><text>The Rubygems team (or even just the person who writes the security page) can just generate a new one, for &quot;security@rubygems.org&quot; or whatever, and it can be shared by the team.&lt;p&gt;The purpose of the key is to allow people to report security vulnerabilities without worrying that by doing so they&apos;re giving ammunition to people snooping emails.</text></item><item><author>jasonkester</author><text>What would the PGP key be for?</text></item><item><author>tptacek</author><text>If you want security notices to go to the Rubygems team, you have to set up a security page that tells people how to do that. Like everyone else, I appreciate your volunteer work, but no amount of goodwill creates the ability for people to read your mind.&lt;p&gt;Please post a security page. It literally doesn&apos;t need anything more than an email address and a PGP public key.&lt;p&gt;By the way: if Rubygems needs security help, it looks like there&apos;s quite a number of people who are willing to pitch in. When I published a FreeBSD crt0 bug back in 1996, I was given commit privs. I thought that was a pretty effective way to co-opt adversarial researchers.</text></item><item><author>qrush</author><text>Hi everyone -&lt;p&gt;A full post-mortem is coming, but here&apos;s what happened from my perspective. I got mentioned on twitter about this thread while I was on the bus. I asked @evanphx to put the site into maintenance mode immediately.&lt;p&gt;Once I got on wifi, I downloaded the &quot;exploit&quot; gems and found that they used the Psych hack to post config/initializers/* and config/*.yml to Pastie. Luckily, none of our API keys were actually in those files - our config is a bit different since you can still run RubyGems.org on Heroku, which needs to put secret keys in the ENV.&lt;p&gt;I deleted the exploit gems permanently along with the throwaway account that posted them...that&apos;s why this post&apos;s URL is a 404.&lt;p&gt;I&apos;ve reset our S3 keys just to be sure and any other keys we had on our production site. From what we know right now, no other changes on our S3 bucket have taken place, and we&apos;re going to check the logs to make sure. Once we get a real fix for this issue out, pushing gems will be enabled again.&lt;p&gt;Just a general PSA -&lt;p&gt;Please, if you find an issue like this, be nice. Tell the maintainers privately. Don&apos;t post to Reddit, HN, or a public Gist. RubyGems.org is completely volunteer run. No one gets paid to work on it. Thanks for your patience everyone.</text></item></parent_chain><comment><author>tptacek</author><text>Publishing the key is what allows you to detect malicious changes to the key.</text></comment>