Hack me.

[kaffemonster]

On a danish news site, citing this article, a discussion arose. Did the laptop running Ubuntu survive because Ubuntu is a more secure OS than OSX and Vista, or because the hackers spared it?

In stead of jumping into the usual web forum flamewars, I decided to challenge them...

A standard PC has a fresh install of Ubuntu 8.04 LTS. It has gotten the updates that popped up in update manager, otherwise it is untouched. No measures have been taken to protect it.

The pc is sitting behind a router. Nothing fancy, just a router designed for home use. No measures have been taken to protect the router other than changing the admin password. This router is on a standard ADSL with the IP adress 83.95.212.118

There is a single user account on the pc, as it is a "virgin" installation. The first person to leave a .txt file with contact info (name/nick and e-mail) on this users desktop will be declared the winner of this little challenge.

Bring it on, hack me.

UPDATE 05/27/08:
Joe Bloggs is now using the computer.

The router thingymajig that his friend set up confused him, so he's now plugged directly into the DSL line at 83.95.212.118

He uses an email client for downloading his mail via Pop3. He happily posted his new e-mail address in a discussion forum: ubuntujoe1337@gmail.com

One of these days he might even install flash so he can visit Youtube. His friend told him it has funny videos. Joe likes the funny.

[yopnono]

Were they using routers on the hacking contest? You see a router gives you some protection. Plug it directly to the internet.

[kaffemonster]

Nope, I don't think they were - I'm trying to do a common, end-user setup scenario.

Will leave the router on for 48 hours from now, then plug it directly to the intarweb

[Monicker]

I had read somewhere that the person who hacked the Mac admitted to going into the contest with the specific goal of compromising it. Personally, I think that most of the people who took part in this contest were more interested in hacking the Mac and Windows boxes first. These are some very talented people and I think they would have gotten the Ubuntu machine if they had focused on it.

I'll have to dig up a link for where to back up my first sentence.

[moonpup]

Hi,

The test you are conducting above has an unreal expectation. First off, if you are not forwarding any ports from the router to the Ubuntu box, then all you are asking people to do is hack at your router.

To make this a real test, you need to remove the router from the picture or at least put the Ubuntu box in the dmz section of the router so that is out on the internet, otherwise this test is useless.

Put the box out publicly on the internet and run some services.

[Dr Small]

First off, I can not connect. What services have you opened? Apache, SSH ?

Because the real hack would be finding a flaw in the service rather than the system itself.

[moonpup]

Exactly my point above... put the Ubuntu box in the dmz of the router or connect it directly to the internet.

[kaffemonster]

Everybody always claim they don't need no firewall when behind a router, only to have someone tell them that at router offers no protection. I thought I would test this...

Will remove router tomorrow and note that "Routers scares hackers away"

[robertchahine]

good luck guys

[ASULutzy]

Is this a clean Ubuntu install with absolutely no ports open?

IMO you should make it a more "typical" setup and get ssh going, maybe an apache webserver, VNC server, something. Or else you're just asking people to bang their heads off a wall