Slashdot Mirror
Ubuntuforums.org Hacked
satuon writes "The popular Ubuntu Forums site is now displaying a message saying there was a security breach. What is currently known: Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database. The passwords are not stored in plain text. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP. Ubuntu One, Launchpad and other Ubuntu/Canonical services are NOT affected by the breach."
Nelson - Ha Ha!
It's good the Ubuntu Forums has alerted us that this breach has occurred and that we need to change our passwords. It would be nice however if when they put up the announcement page, thus taking Ubuntu Forums off-line that they also give us a link to a page or other device to change our password.
I'd change my password if there were a way to do it.
Especially on servers... Not only is all the crap installed by default annoying, but it probably leaves a lot of nice security holes too.
Using other distros not related to Ubuntu, but based on Debian or really anything else is always a better option.
I call bullshit. This is clearly a lie brought to you by Microsoft and Apple and the Government. Everyone knows that Linux can't be hacked.
tsop tsrif. parc ho
I Guess these guys should have used Windows.
Bla Bla Bla...
Really Folks the OS or how the software is license doesn't equate to security or quality. Treat every system that is open to the outside world as potentially vulnerable to attack and make sure your logins and passwords are completely encrypted even in your database. If you can see then it is vulnerable. As well you better be sure you use some salting in your hashing as well
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
AKA: we didn't use bcrypt, and just base64 encoded the passwords. Prepare to get buttraped.
Well, I hope they insert a fucking fix for Youtube. It still doesn't work on U.
It looks like at some point in the past I must have actually signed up to the forums (though I barely, if ever, used them). Hopefully they have some kind of "delete inactive accounts" thing set up, because I really don't want spam on behalf of, of all things, fucking Ubuntu. But I'm guessing they don't. Could they have not just protected the e-mail addresses just a little bit fucking better? I don't care about the password, because it's generic as all hell, but I will be pissed if now I become a spam target.
Does anyone remember what password policy the forums had, trying to work out which password I was using for it.
null
Forum attacks have increased in recent years and it seems to be the newest go-to vulnerability. This is not platform specific so no need to just bash Linux or even Ubuntu specifically. Really, its time for people to get serious about Forums and mailing list software where security is concerned. All of us know forum software is among the most used and abused software out there but mostly just underfunded. I invite all of you progressive thinkers out there to take this staple of development and communication to the next level because I for one would gladly pay license fees for an efficient and secure forum platform. I don't care what the excuse is 90% of the time for why it happened its always watered down to some story about someone forgetting to do something within the realm of conceivable human error- the fact is it happens too many times and I don't feel safe registering on most forums nowadays. So lets make a difference we can do this BETTER.
holy fuck, are you retarded.. and I prefer windows.
You'd hope so. That would be standard policy you'd assume by now (hashes are easy), but apparently it's still important to mention this given there are still way too many outfits storing plain-text passwords in their systems.
I remember reading the following advice - if you're unsure about the security of any company with whom you've got a password-secured account with, just check to see if they have some kind of password recovery link on their login page. Normally these links should email you with a temporary password so you can make a new one, but if they happen actually email you with your actual password... RUN!!!
A lot of distro forums don't provide you with the ability to delete your account. These include Linux Mint, Arch and Archbang.
So how do I know if I have at some stage in the past made an account on the forum?
I have an account but have no idea what the password is. I wish they would just email us our own hash.
Well thank god I've not used the same password on anything since about 1997.
Sadly the dangers of using the same password on multiple accounts is something I had to learn the hard way back then, but I learned my lesson.
I can't remember which of my 3 passwords I used in that forum, so I don't know which other services I need to change my password ... Could they post the list in plain text so I could check it?
But Linux is more secure with many eyes!
I don't get it. If passwords were not in plain text, what should mean they are encrypted, you should not have need to change passwords in other stupid services.
So the passwords WERE in plain text format so crackers got passwords and email addresses in clear form that they can use them.
Canonical just doesn't care about anyones security unless you pay them.
Neither of you seem to have any idea what the security implications are.
"His name was James Damore."
It probably wasn't much better than that. Don't know if it's still current, but the Javascript of their login form used to do this:
<form id="navbar_loginform" onsubmit="md5hash(vb_login_password, vb_login_md5password, vb_login_md5password_utf, 0)" method="post" action="login.php?do=login">
That's what they get for using vBulletin rather than using a FLOSS product they could audit.
How about using PHPBB3, a product which was thoroughly audited during development? Or how about adding a forum extension to Launchpad?
Now I *know* the gobbledygook password you generated for me is not compromising me anywhere else on the net. I have no financial interest in LastPass; just a big fan.
The link can be made such that it only works once.
For the attacker before the mail even gets to the intended user.
The email can be sent encrypted to your public key.
For those people who have the discretionary income to fly to key signing parties.
The pasword-change code can be sent to your cellphone number
For people who already pay hundreds of dollars a month for cell phone service. A lot of households still share a POTS house phone among members because it's cheaper than a cell phone with unlimited minutes per person.
I agree with you that something reversible like encryption is not the best primitive to protect a shared secret when users are logging in to a server, such as the case in the article. But when the server is itself logging in to another server, it still needs to store a shared secret reversibly. For example, this secret might be an API key used by the payment processor to charge a credit card or a transaction ID used by the payment processor to refund a charge.
BTW: Some people don't have cellphones.
Some people don't have Internet. In any case, you already need your own phone number to sign up for Facebook unless you still have access to a university e-mail address.
aptitude for package management (which brings in X windows)
Why bring in aptitude? I thought that from the command line, apt-get did the same thing.
Talking about a "base install" for such a system is like talking about [camping]
How much does OpenSSH + the basic LAMP stack add to the base install?
It probably wasn't much better than that. Don't know if it's still current, but the Javascript of their login form used to do this:
<form id="navbar_loginform" onsubmit="md5hash(vb_login_password, vb_login_md5password, vb_login_md5password_utf, 0)" method="post" action="login.php?do=login">
That's probably just to avoid sending the password over the wire in clear text.
If they always use that, including on the signup page, they wouldn't even have your password in the first place, only the md5hash of your login + password.
Should have used NetBSD.
It took 4 years after they were notified until they took the site down, in the future.
Little asshole "Penguins" around here SCREAM how "the fix is in" on everything in the world (and, they're right on that much - it is, sadly: Bent statistics, sockpuppet supporters fake reviews & all) but, when you SPEAK TRUTH ABOUT THEIR SHIT? They do the EXACT SAME as those they bitch about: "Quick - cover up that truth that makes us look the bullshit artist 'FUD' spreaders WE HAVE BEEN FOR MORE THAN A DECADE ON SLASHDOT!" and the downmod of YOUR POST, proves it. They're hypocritical little pots calling a kettle black that will do ANYTHING to further their own agenda (hoping their OS of choice gets more market share & thus more job possibles for them) and no better than the bodies they themselves bitch about.
I don't really use facebook. Signed up about a year ago, to see what it was, but never put any private information there. No photos, no friends, no anything. I didn't use my real name, but something close. My real name is extremely rare - only 1 other person in the world has it and we're related somehow. His middle initial is different.
Anyway, facebook doesn't have my real name, any phone number, the email address I gave them is used for nothing - except facebook to have ... it redirects twice to get to an emailbox that I actually see.
When did facebook start requiring a phone number?
Just curious. These days I only have a SIP account for phoning out to normal numbers. No POTS phone, no cell phone.
I'm still confused that people are soooo hard up for dates as to use facebook/twitter/whatever at all. See a pretty girl,. walk over and ask her out - she says yes or no. Simple.
That is what they get from using PHP running on a shitty debian(which itself is shitty) derivative.
Piling shit on top of shit and then shitting on that pile usually results in a nasty mess.
Grats, you earned it
Never. I've never given my cell number out.
I've never given my home number out.
I give out a g-voice number with which I can filter incoming crap. The google-voice account isn't connected to any accounts that I use for anything else. Definitely NOT used for gmail.
I was notified by email early today, I use lastpass to generate new passwds so probably uneffected, but there must be plenty of red faces over at ubuntu forums
Wow. has *everybody* forgotten about plain old paper? I got sick of forgetting passwords, so wrote (printed, actually) them down on paper. I have a highly encrypted file where I store the digital master for reprinting or updates to the list. The only inconvenient bit about it is that i can't copy and paste from a paper list, and copy/paste is a secure way to enter a password.. it makes keyloggers useless. Don't lose the paper, or forget the master password for the digital backup, though. I did once ;-(
what is left for a hacker?
Just got a email from them ::
---------- Forwarded message ----------
From: Ubuntu forums
Date: 23 July 2013 23:02
Subject: Important information from Ubuntuforums.org
To:
Hello,
You are receiving this message because you have an account registered with this address on ubuntuforums.org.
The Ubuntu forums software was compromised by an external attacker. As a result, the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum database.
If you have used this password and email address to authenticate at any other website, you are urged to reset the password on those accounts immediately as the attacker may be able to use the compromised personal information to access these other accounts. It is important to have a distinct password for different accounts.
The ubuntuforums.org website is currently offline and we are working to restore this service. Please take the time to change your ubuntuforums.org account password when service is restored.
We apologize for any inconvenience to the Ubuntu community, thank you for your understanding.
The Canonical Sysadmins.