The FreeBSD team has announced over the weekend that two machines within the FreeBSD.org cluster have been compromised and have been consequently pulled offline for analysis.

"These machines were head nodes for the legacy third-party package building infrastructure. It is believed that the compromise may have occurred as early as the 19th September 2012," they announced, and explained that it seems that the intrusion was made possible by a leak of an SSH key from a developer, and was not due to any vulnerability or code exploit within FreeBSD.

They pointed out that FreeBSD's base repositories containing the kernel, system libraries, compiler, core command-line tools, and daemons were not compromised, and neither was the freebsd-update(8) binary upgrade mechanism.

"However, the attacker had access sufficient to potentially allow the compromise of third-party packages," they wrote. No evidence of that has been found during in-depth analysis, but they have still decided to work on the assumption that third-party packages generated and distributed within 19th September and 11th November 2012 could theoretically have been modified.

Upon discovering signs of the intrusion on Sunday 11th of November, the FreeBSD Cluster Administration team apparently shut down the two compromised machines as well as every other machine to which the attacker may have had access, then proceeded to audit its repositories for server intrusions and malicious commits.

They also checked the all FreeBSD base release media and install files on the master FTP distribution sites, and removed the package set built for the upcoming 9.1-RELEASE because they didn't have a copy to verify the package against.

"As a result of this event, a number of operational security changes are being made at the FreeBSD Project, in order to further improve our resilience to potential attacks. We plan, therefore, to more rapidly deprecate a number of legacy services, such as cvsup distribution of FreeBSD source, in favor of our more robust Subversion, freebsd-update, and portsnap models," they finally announced, and offered recommendations both to users that might have been affected by the intrusion (those who had third-party packages installed or updated on their machines within 19th September and 11th November 2012) and to those that need to stop using the deprecated distribution mechanisms.