Ubuntu Forums hack exposes 2 million users

[steven36]

An unnamed hacker took usernames, email addresses, and salted and hashed passwords.

 

 

The company that builds Ubuntu, a popular Linux distribution, has said its forums were hacked Thursday.

 

Canonical, which develops the operating system, said in a statement on Friday that two million usernames, email addresses, and IP addresses associated with the Ubuntu Forums were taken by an unnamed attacker.

 

The attacker was able to exploit an SQL injection vulnerability in an add-on used by older vBulletin forum software.

 

That gave the attacker access to the forum's databases, but the company said that only limited user data was accessed and downloaded.

 

The statement stressed that no code or repository data was accessed, and the attacker couldn't write data to the database or gain shell access. The attacker also didn't gain access to any other Canonical or Ubuntu service.

 

Since the breach, the servers were wiped, rebuilt, and hardened, passwords were changed, and the forum software was fully patched.

 

The statement added that although the forums relied on Ubuntu's single sign-on service, the passwords were hashed and salted, turning them into randomized strings of data. But the statement did not say which hashing algorithm was used -- some algorithms, like MD5, are still in use but are deprecated, as they can be easily cracked.

 

A spokesperson for the company did not immediately respond to a question about the hashing algorithm. (We'll update if we hear back.)

 

It can't hurt to change your passwords to be safe, and to enable two-factor authentication.

 

The popular forum software has long been a target for hackers and attackers as an easy point of access to other systems. Most recently, as many as 45 million accounts from over a thousand car, tech, and sports forums owned by Canadian media giant VerticalScope were hacked after an attacker exploited known flaws in the software.

 

Some of the installations date back to 2007 and hadn't been updated since.

 

Data from the Ubuntu Forum breach does not appear to be for sale on the dark web -- at least for now.

 

Source

http://www.zdnet.com/article/ubuntu-forums-hack-exposes-two-million-users/

 

[SnakeMasteR]

So, it required a hack until patching the forum software? I hope the add-on was worth it.

[steven36]

Ubuntu Forums hacked (again)

 

Canonical, the company behind Ubuntu, has warned that there has been a security breach on the Ubuntu Forums site, resulting in the theft of two million members' usernames, IP addresses, and email addresses:

 

Quote

 

At 20:33 UTC on 14th July 2016, Canonical’s IS team were notified by a member of the Ubuntu Forums Council that someone was claiming to have a copy of the Forums database.

After some initial investigation, we were able to confirm there had been an exposure of data and shut down the Forums as a precautionary measure. Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched.

 

Yes, you read that correctly. A patch was available, but no-one bothered to install the patch at Ubuntu Forums.

 

What a goof. If you don't patch the software running on your website, don't be surprised if a hacker compromises your system and makes off with your customer's data.

 

If you think you may have heard a similar story in the past, your memory isn't deceiving you. Ubuntu Forums was previously hacked in 2013.

 

Source:

https://www.grahamcluley.com/2016/07/ubuntu-forums-hacked/

 

[DKT27]

Looks like I do have the company's account, but not connected on their forums.

 

Its quite hard to keep track of hacked sites these days, the harder part being which of your password got compromised and which other site might be effected by it. The obvious reason being so many sites being hacked these days. Atleast looks so.

[pc71520]

https://insights.ubuntu.com/2016/07/15/notice-of-security-breach-on-ubuntu-forums/

 

http://www.theregister.co.uk/2013/07/21/ubuntu_forums_breached_18_passwords_pinched/

 

http://thehackernews.com/2016/07/ubuntu-hacked.html

 

http://securityaffairs.co/wordpress/49388/data-breach/ubuntu-online-forums-hacked.html

 

[oliverjia]

5 hours ago, steven36 said:

Ubuntu Forums hacked (again)

 

Canonical, the company behind Ubuntu, has warned that there has been a security breach on the Ubuntu Forums site, resulting in the theft of two million members' usernames, IP addresses, and email addresses:

 

 

Yes, you read that correctly. A patch was available, but no-one bothered to install the patch at Ubuntu Forums.

 

What a goof. If you don't patch the software running on your website, don't be surprised if a hacker compromises your system and makes off with your customer's data.

 

If you think you may have heard a similar story in the past, your memory isn't deceiving you. Ubuntu Forums was previously hacked in 2013.

 

Source:

https://www.grahamcluley.com/2016/07/ubuntu-forums-hacked/

 

 

The admins of that forum should be also fired and they should never get a similar job in the future. These stupid morons did not have the basic sense of security while they have millions of personal login info in their hands. Is it that hard to have their software up to date?