The Security team over at the FreeBSD project is of the opinion that hackers were able to gain access to the servers using legitimate SSH keys and not by exploiting any operating system vulnerabilities. Instances of intrusion were first detected on November 11. FreeBSD project, through a message on public announcements mailing list said, “On Sunday 11th of November, an intrusion was detected on two machines within the FreeBSD.org cluster.”
FreeBSD has claimed that the security breach hasn’t affected the project’s core components like kernel or system libraries but, has only affected third-party software packages being distributed by the project. The security team over at FreeBSD hasn’t found any evidence of modifications to third-party packages but, they haven’t ruled out the possibility of such changes.
According to the team, if users are having third-party packages that have been downloaded and installed before September 19 and after November 11, there is no reason to worry. “If you are running a system that has had no third-party packages installed or updated on it between the 19th September and 11th November 2012, you have no reason to worry.” But, the team has said that there is no guarantee about the integrity of packages available for installation between 19th September 2012 and 11th November 2012.
Following this security breach, the project is planning to adopt more robust distribution services like Subversion system while deprecating legacy distribution services like those based on CVSup.