Slashdot Mirror
OpenSUSE Forums Defaced, Email Addresses Leaked
sfcrazy writes "The openSUSE Forums were hijacked yesterday. An alleged Pakistani hacker who goes by handle H4x0r HuSsY reportedly exploited a vulnerability in the vBulletin 4.2.1 software SuSE uses to host the forum. vBulletin is a proprietary forum software. The openSUSE team notes that user passwords were not compromised. 'Credentials for your openSUSE login are not saved in our application databases as we use a single-sign-on system (Access Manager from NetIQ) for all our services. This is a completely separate system and it has not been compromised by this crack. What the cracker reported as compromised passwords where indeed random, automatically set strings that are in no way connected to your real password.' It's shocking to learn that SUSE/openSUSE are using proprietary forum software vBulleting as well as proprietary single sign on solution."
SuSE was using vBulletin 4.x which has no known fix for the security hole, and they are leaving the forums offline for now. It seems likely they'll be upgrading to the 5.x series.
What, maybe they wanted to pay for something, rather than use the open-source alternative, which isn't always the best choice.
... no it's not shocking, you use the best tool for the job.
People seem to confuse those terms. AFAIK vBulletin is proprietary and charges a reasonable fee to use. I have no idea if the source is available but is appears to be mostly PHP, Javascript, and HTML - so maybe.
vbulletin has been going down the drain for years already. this isn't surprising to say the least.
Why are major linux distributions relying on proprietary software after the whole BitKeeper fiasco anyway?
No, vBulletin is a software package, or a program, or even "vBulletin is software" -- but never "a software." You don't have "a hardware" or "an information" or "a clothing" -- you have a piece of hardware, a piece of information, a piece of clothing, and a piece of software. Grammar check, please.
The mods on Ubuntu forums hand out refractions like there's no tomorrow. Anyone who has much as criticizes Unity or mentions the embeded sypware gets an immediate refraction.
H4x0r HuSsY. You just can't make this stuff up.
I always choose an OSS product, even if it means I get less functionality. Another thing I've noticed of late is more and more developers I keep up with are moving towards the BSD license. Are you guys seeing this? This is happening in the US as well as the EU. It's an interesting trend.
I know how to jimmy my neighbors windows open but that does not make it OK to do so. H4x0r HuSsY... you are a D-Wad...
as a long time OpenSuSE user the forum has beed a problem for a very long time
Novel controls it
NOT OPENSUSE !!!!!!
and this has been a long standing problem for the site admins
they really do not control it
as in the VERY LONG STANDING issue of the code and font and css used for the forum topics
one MUST turn off the min. size font used
or use a 9 pt font
that can ONLY be changed by Novel and NOT by the OpenSUSE forum
"I don't pitch OpenSUSE Linux to my friends, i let Microsoft do it for me
I'm just worried it would take lots of extra time and effort to type something like H4x0r HuSsY multiple times a day.
Same thing to this one:
https://www.google.com/search?q="You+have+registered+the+following+telephone+number+in+the+National+Do+Not+Call+Registry"
How can Google index a page that is not linked anywhere?
It's shocking to learn that SUSE/openSUSE are using proprietary forum software vBulleting as well as proprietary single sign on solution.
While vBulletin isn't under GPL, it is pretty liberal. You get the source code, you can modify and compile the source code, you may not redistribute it or remove the copyright notices. So, technically while not open source, your real limitation is in being allowed to redistribute it (not removing copyright is part of GPL, too).
vBulletin has pretty much become crap since Internet Brands bought it. Even IPB would be a bit more tolerable...
It is time the United States of America sends UAVs into Pakistan to wipe this H4x0r HuSsY off the planet. What? You were thinking the same thing when you realized this Paki must be a terrorist. "Die. Die. Die." as the Daleks say.
It was patched to 4.2.2 in October, 4.2.1 had serious issues, even with 4.2.2 there have been 2 security announcements to remove vulnerable files (which are not needed to run the forum).
People need to stop using shit written in PHP,
They got what they deserved, stupid bastards.
Another website intrusion leaking the personal data that they insisted on before allowing me access. I'm about sick of this crap.
Which of my email addresses did they get? Checking... Checking... Oh, yea. It was a throwaway.
NetIQ Access Manager is rock solid and massively scalable. I support multiple systems that use it for over 30 million users. Nothing better for web access management.
In this case it's even better. None of the user authentication data is on the NetIQ appliance. It's all stored on an LDAP server even further back behind additional firewalls.
The forums were not hacked. They upgraded to latest OpenSuSE Factory, which includes cdrtools again.
And guess what, this time the Anti-SuSE message in cdrtools really went big time.
I have a hard time believing that there's anyone in Pakistan that actually owns a computer, let alone knows how to find and run script-kiddie scripts. I mean that country seems full of people so mind-boggling stupid that it's a wonder they know how to eat, breathe and procreate. Yes, I know they allegedly have nuclear weapons but how can they have smart people in a place so full of seemingly retarded people living so deep in the dark ages that cavemen seems sophisticated in comparison. It boggles the mind.
Okay, yes I guess there must be exceptions to the rule but while they may be smart in some ways, they're clearly not smart enough to get rid of all the stupid people grabbing the international headlines by doing something ridiculous on a daily basis.
I'm sorry, but as long at you allow crazed-looking bearded toothless men waving Korans and AK47's yelling "Down with USA!" to fill the streets, you're just not going to get any respect whatsoever. And as long as these people hide internationally wanted terrorists, the US is going to hit them with drones and Hellfire missiles in order to do something about the menace they cause. I'm sure the US government is sorry about any collateral damage but when they're hiding behind women and children, someone else is bound to get hurt on the way. Unfortunately for their women and children they're all about yelling and posing but deep within they're just sad cowards that are not men enough to stand tall and fight fair, and thus they deserve what they get.
Shitty Linux.. Novell and Canonical can blow my dog.
Used insecure proprietary software; got pwned. If the software has pretty GUIs and simple tools, that makes it nicer and easier for the hackers to pwn you.
Best tool for the job? Not if its security sucks.
I know I'm late to the party, but I can't let this one slip :-). So, a bit of Free Software Philosophy 101 to serve up
First off, Stallman's definitions of Software Freedoms:
Secondly the consequence: Nobody but vBulletin is allowed to patch the hole, from a legal standpoint, lacking freedom 1, and thus lacking freedoms 2 and 3. Legally, SUSE cannot modify/improve/patch the software - they can only purchase upgrades.
I leave this here, you know, just in case.
-- "Simplicity is prerequisite for reliability." --Dijkstra
I'm not sure what the license actually says, so I'm not sure if they expressly disallow people from making changes or not. Practically, they couldn't do that, if they are distributing the code then people are able to change it. It might not make sense to change it if you're just going to update at some point in the future, but it's a possibility.
Anyway, the reason I kept posting things like that was because people kept referring to the software as "closed-source" or something like that, when it's not. The source is open, it's just not free. The major difference between vBulletin and any other open-source PHP project is the license, that's it. It's open-source software that isn't free (both kinds).
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black