Ubuntu Linux Forums Hacked -- IP Address, Username, Email of 2M Accounts Compromised (betanews.com)

← Back to Stories (view on slashdot.org)

Ubuntu Linux Forums Hacked -- IP Address, Username, Email of 2M Accounts Compromised (betanews.com)

Posted by msmash on Friday July 15, 2016 @04:00AM from the security-woes dept.

Canonical announced on Friday that Ubuntu forums have been hacked. The company adds that data such as IP address, username, and email address of over two million users have been compromised. BetaNews reports: Keep in mind, this does not mean that the operating system has experienced a vulnerability or weakness. The only thing affected are the online forums that people use to discuss the OS. Still, such a hack is embarrassing as it happened due to Canonical's failure to install a patch.In a blog post, Jane Silber, Chief Executive Officer, Canonical said, "after some initial investigation, we were able to confirm there had been an exposure of data and shut down the Forums as a precautionary measure. Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched."

85 comments

Min score:

Reason:

Sort:

Too Bad They Used Linux by Anonymous Coward · 2016-07-15 04:04 · Score: -1

They should have used a BSD (preferably Open) for their host.
Oh well. Sucks to be them.
1. Re:Too Bad They Used Linux by LichtSpektren · 2016-07-15 04:14 · Score: 5, Informative
  
  The vulnerability was an SQL injection. The operating system had nothing to do with it.
2. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 04:45 · Score: 1, Funny
  
  They should have used SQL Server instead of MySQL.
3. Re:Too Bad They Used Linux by hideki.adam · 2016-07-15 04:55 · Score: 1
  
  It has nothing to do with that either.
  
  It's to do with inputs not being sanitized AGAIN at a guess. wouldn't matter which SQL it was if the code was written by a crack addicted monkey with no concept of security (which apparently it was)
4. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 04:59 · Score: -1
  
  Ah yes, here comes the Linux apologists trying to deflect any blame from Teh Liuxxxx!!!!!!
5. Re:Too Bad They Used Linux by CajunArson · 2016-07-15 05:15 · Score: 1
  
  Yeah, if that level of granularity was used every time there was a security vulnerability related to software that runs on Windows then it might be relevant.
  Not to mention the fact that Ubuntu isn't linux: It's a linux distribution that expressly provides an entire software stack, including the software that got hacked here.
  
  --
  AntiFA: An abbreviation for Anti First Amendment.
6. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 05:24 · Score: 0
  
  Looks like M$ is a contender in the race to the bottom.
  Seriously though, management, through rehire/outsourcing methods, keeps pushing wages down. As the wages get lower the skills brought to the workplace are also going to suffer. This is basic COMMON SENSE. Though, lately, I am thinking I should call it UNcommon sense, as nobody seems to display it anymore.
7. Re:Too Bad They Used Linux by perpenso · 2016-07-15 06:04 · Score: 2, Informative
  
  Yeah, if that level of granularity was used every time there was a security vulnerability related to software that runs on Windows then it might be relevant.
  Not to mention the fact that Ubuntu isn't linux: It's a linux distribution that expressly provides an entire software stack, including the software that got hacked here.
  Don't be obtuse. "Linux" is most commonly used to refer to the complete server or desktop environment. When Linux fans are championing and encouraging people to switch their server or desktop to Linux they are referring to the entire environment not merely the kernel. Just as when Windows gets hacked and its something in the "software stack" and not the kernel itself, often something from a 3rd party not Microsoft. Matter of fact when the only "Linux" thing in an environment is the Linux kernel we tend not to call it "Linux" at all, for example Android. So don't start with this "Linux" only refers to the kernel nonsense, that is not how the word is used, and that includes within the Linux community.
8. Re:Too Bad They Used Linux by AlphaBro · 2016-07-15 07:06 · Score: 3, Insightful
  
  The right sentiment, but not entirely true, actually. Some SQL injection bugs are only exploitable when a specific dialect of SQL is used under the hood. Some support query stacking (MSSQL), while others don't by default. Some allow for easy creation of files on the server's filesystem (MySQL), some don't. It's not exactly the norm, but also not uncommon for the behavior of a SQL dialect to mitigate a vulnerability. Not that one should rely on such behaviors for security, but it can assist. That's not to say this is a case where a different version of SQL would have helped, of course. I haven't looked at the details.
9. Re: Too Bad They Used Linux by Anonymous Coward · 2016-07-15 07:07 · Score: 0
  
  It does lead to confusion though. It doesn't take a lot of giggling to see that.
10. Re:Too Bad They Used Linux by LichtSpektren · 2016-07-15 07:12 · Score: 1
  
  Yeah, if that level of granularity was used every time there was a security vulnerability related to software that runs on Windows then it might be relevant.
  Not to mention the fact that Ubuntu isn't linux: It's a linux distribution that expressly provides an entire software stack, including the software that got hacked here.
  SQL injections have nothing to do with the platform you're running them on. It's a result of sloppy programming. The same thing can happen on just about every OS and every SQL daemon.
  
  You might have a point about Windows being unfairly maligned if it weren't for e.g. Internet Explorer being so thoroughly integrated into the OS that its vulnerabilities in the browser can be exploited even if the user doesn't use it.
11. Re:Too Bad They Used Linux by LichtSpektren · 2016-07-15 07:15 · Score: 1
  
  Ah yes, here comes the Linux apologists trying to deflect any blame from Teh Liuxxxx!!!!!!
  That's a fair point, since Microsoft's products are totally immune to SQL injection -- oh wait, no they're not, you knob.
12. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 08:05 · Score: 0
  
  Well, the operating system allowed the modification of key files. wooops.
13. Re: Too Bad They Used Linux by Anonymous Coward · 2016-07-15 09:04 · Score: 0
  
  It does lead to confusion though. It doesn't take a lot of giggling to see that.
  No, it leads to no confusion at all. People who understand what a kernel is understand the dual use of the word "linux" and easily figure it out from context. For those that don't know what a kernel is there is no problem there either since the context matches what everyone tells them, including the fanboys, that linux is a complete operating system that rivals Windows and Mac OSX.
  But yeah, we do giggle at the fanboys who get all defensive when linux appears in a negative context.
14. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 09:07 · Score: 0
  
  Well, the operating system allowed the modification of key files. wooops.
  And Mac OS X does not allow modifications of system files and thus proves once again that it is the superior *nix environment. :-)
15. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 09:32 · Score: -1
  
  But... but.... but.... Teh Mikr0sophtzzzz!!!!!!
  That's all you Linux cunts know how to do when the truth comes out about your shit, right?
  Keep sucking Linus' cock. He loves splooging in your mouth.
16. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 09:56 · Score: 0
  
  You saw, or you were told?
17. Re: Too Bad They Used Linux by Anonymous Coward · 2016-07-15 12:00 · Score: 0
  
  It's funny when the person behind this comment is probably sitting on the toilet at work taking a shit laughing at his comment, and will go back to his desk and open a terminal or Linux virtual machine n keep working checking his anonymous comment.
18. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 13:15 · Score: 0
  
  Yeah. This ain't just the kernel getting a pass for semantic reasons. This is like saying that a bug in Photoshop is because Windoze is teh suck.
19. Re:Too Bad They Used Linux by Bengie · 2016-07-15 16:07 · Score: 2
  
  If you think sanitizing inputs protects against SQL injection, I have a bridge to sell you. You need to parameterize/prepare your inputs, which separates your commands from your data. If your inputs cannot change your commands, then all it well.
20. Re:Too Bad They Used Linux by Bengie · 2016-07-15 16:10 · Score: 1
  
  Nice link of how not to use MS SQL correctly. General rule of thumb, you can't fix stupid. They will always find a away to use tool incorrectly.
21. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 20:02 · Score: 0
  
  What's it like siding with lazy, ignorant people who misuse words?
22. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-15 22:19 · Score: 0
  
  The vulnerability was an SQL injection. The operating system had nothing to do with it.
  I didn't read the article but the summary does not mention SQL injection. From the summary:
  "... it happened due to Canonical's failure to install a patch."
23. Re:Too Bad They Used Linux by Anonymous Coward · 2016-07-16 05:33 · Score: 0
  
  What's it like siding with lazy, ignorant people who misuse words?
  Yes, lazy ignorant people like Linus Torvalds who have been referring to the operating system as Linux since the early 1990s.
online forums software can be hard to update by Joe_Dragon · 2016-07-15 04:04 · Score: 1

online forums software can be hard to update if any mods / plug in's are in use.
1. Re:online forums software can be hard to update by Anonymous Coward · 2016-07-15 04:09 · Score: 0
  
  Online anything that uses plugins.
  We have a few Wordpress clients, and all of their environments are setup to auto-patch the core and plugins nightly.
  But that doesn't help us when they go an install some plugin they found that doesn't ever get updates.
2. Re:online forums software can be hard to update by dgatwood · 2016-07-15 04:37 · Score: 2
  
  online forums software can be hard to update if any mods / plug in's are in use.
  The thing is, you shouldn't need to update them. The biggest problem on the Internet today, IMO, is that so much of our user-facing infrastructure software was written before modern database access techniques, such as the use of parameterized queries.
  In my personal life, the very first thing I do before I install any piece of client-facing software is audit the thing top to bottom, making sure every single SQL query uses parameterized queries, and rewriting it when I see them. If the software is too big for this to be practical, it doesn't get installed on my server—a lesson I learned the hard way after a PHPBB instance got vandalized anonymously. As a result, I now use a custom fork of JXBD that replaces every single query with parameterized versions (available on GitHub). It is small enough to be auditable, and as an added bonus, I was able to integrate it more cleanly with my existing login infrastructure.
  If everyone would adopt that same level of caution, all this ancient cruft would get cleaned up pretty quickly, and folks wouldn't need to update their bulletin boards every few weeks to fix the latest SQL injection attack, because the BBSs' SQL access code would be secure by design. I would encourage Ubuntu to similarly systematically rework everything they run on their websites and then contribute fixes upstream so that everybody benefits from their effort.
  
  --
  Check out my sci-fi/humor trilogy at PatriotsBooks.
3. Re:online forums software can be hard to update by Qzukk · 2016-07-15 04:56 · Score: 1
  
  The real problem is that if you google for a tutorial, half the tutorials out there were written before modern database access techniques and nobody ever takes them down, so new programmers become "educated stupid" (to borrow from the timecube guy).
  
  --
  If I have been able to see further than others, it is because I bought a pair of binoculars.
4. Re:online forums software can be hard to update by The-Ixian · 2016-07-15 05:20 · Score: 1
  
  I had to search the Internet to know what a parameterized query is.
  I am not a programmer but I have written some web applications in Perl.
  Turns out, I have been using parameterized queries all along for my inserts and updates.
  So, there you go, Internet documentation, at least for Perl's DBI appears to "educate smart"
  
  --
  My eyes reflect the stars and a smile lights up my face.
5. Re:online forums software can be hard to update by Anonymous Coward · 2016-07-15 07:53 · Score: 0
  
  True, but note that parametrized queries are not the panacea of safe SQL-ing. All is good with that until the driver has a bug and allows an injection. Happened with Drupal. Happened with some Java things. Don't know if it ever happened to PDO and PsycoPg.
6. Re:online forums software can be hard to update by Anonymous Coward · 2016-07-15 08:00 · Score: 0
  
  Yes, Perl, Python and probably even Java. It is that piece of shit template-language and bad excuse for a programming-language-wannabe called PHP that caused this mess. So many PHP "tutorials" That just mysql_query("SELECT user_id WHERE username=$_POST['username'] AND password=$_POST['password']");
7. Re:online forums software can be hard to update by dgatwood · 2016-07-15 08:15 · Score: 1
  
  Certainly, but when those bugs are discovered, they typically get patched automatically as part of your normal OS update schedule, not as a specific patch to the web frontend (which often gets heavily customized for a particular site, and thus are messier to upgrade). And those bugs are hopefully rare.
  As for Drupal, that's actually just another example of the problem I'm describing. A high-level CMS should not provide its own database drivers that construct SQL queries themselves. From a security perspective, IMO, that's really not significantly different from building SQL queries by string concatenation, except that the Drupal solution is cleaner and more general-purpose. It is still a user-facing web front end that is doing its own SQL construction when it could get that functionality almost for free by using code that the PHP core already provides.
  IMO, Drupal should be working with various groups that provide the drivers that are built into PHP already, adding features as needed to support their requirements, with the goal of eventually removing their own drivers entirely. Every time you reinvent the wheel, you significantly increase the risk of adding bugs. More code requires more maintainers, and there are only so many people who care about improving SQL drivers. Thus, the more SQL drivers available for each SQL implementation, the lower quality each one will be. And if every large web service provided its own driver, you'd have hundreds of these things, each with its own bugs.
  This really is one of those areas where less is more. I'll give Drupal a partial pass for now, because they were doing this back in a day when parameterized queries probably weren't supported in the PHP core. But in the long run, all that custom driver code needs to die and be replaced with one of the standard drivers. From a security perspective, that's the only approach that really makes sense.
  
  --
  Check out my sci-fi/humor trilogy at PatriotsBooks.
Fantastic by subk · 2016-07-15 04:04 · Score: 2

Love the metadata on the image they used in TFA.. "Hacker desk laptop hoodie hacking hooded". I guess a white dude with facial hair and a hoodie is automatically "hacking" if he has a laptop out.

--
Now, if you'll excuse me, I have backups to corrupt.
1. Re:Fantastic by Anonymous Coward · 2016-07-15 04:10 · Score: -1
  
  I agree. They should've used a nigguh because we know that only nigguhs and tacos can be gangstas. If a whitie does it then its legal, see Clinton as an example.
2. Re: Fantastic by Anonymous Coward · 2016-07-15 04:20 · Score: 0
  
  Just make sure you use -uh of -ah on the suffix, then it's okay, I think? That means they're cool and our educated friends in society. Don't even think about the -er, oh god no, cause then uze bout to die muthafuckah, (see what I did there?). Even Asian dude baddass Jackie Chan couldn't pull this off successfully.
3. Re:Fantastic by Anonymous Coward · 2016-07-15 04:50 · Score: -1
  
  Niggas steal laptops and sell them for crack they don't know how to use them, and tacos only know how to use facebook
4. Re:Fantastic by KiloByte · 2016-07-15 07:58 · Score: 1
  
  Crap, a hoodie! I knew I've forgotten something in order to be a real hacker!
  
  --
  The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
5. Re:Fantastic by antdude · 2016-07-16 06:32 · Score: 1
  
  They should had used Mr. Robot's Elliot Alderson then. :P
  
  --
  Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
I'm going to sue ... by CaptainDork · 2016-07-15 04:10 · Score: 2

... those bastards.
On a related note, my lawyer wants to know what the terms, "ubuntu," and "linux," and "forum," mean.
Help here, please?

--
It little behooves the best of us to comment on the rest of us.
1. Re:I'm going to sue ... by Errol+backfiring · 2016-07-15 04:23 · Score: 1
  
  "Ubuntu" means "I am because you are", "Linux" is an open source operating system and a "forum" is a place where people get together. In other words, this is all about sharing. In this case they shared passwords, even without trying to. Your point is ...?
  
  --
  Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
2. Re:I'm going to sue ... by 110010001000 · 2016-07-15 04:29 · Score: 1
  
  Linux is a kernel. There are no people on a forum, just HTML.
3. Re: I'm going to sue ... by Anonymous Coward · 2016-07-15 04:34 · Score: 0
  
  HTML is people too. #codelivesmatter
4. Re:I'm going to sue ... by dgatwood · 2016-07-15 04:39 · Score: 1
  
  So I am a kernel because you are HTML?
  
  --
  Check out my sci-fi/humor trilogy at PatriotsBooks.
5. Re:I'm going to sue ... by Anonymous Coward · 2016-07-15 05:42 · Score: 0
  
  Yeah, you should sue the entire internet. Good luck with that.
6. Re:I'm going to sue ... by dcollins117 · 2016-07-15 07:53 · Score: 4, Informative
  
  Ubuntu is an ancient african word meaning "I couldn't figure out how install Debian."
  I know it's old, but that's one of my favorite jokes.
7. Re:I'm going to sue ... by Anonymous Coward · 2016-07-15 09:48 · Score: 0
  
  On my new laptop, that was literally true. Only connection fast enough to download packages was through wifi, and wifi driver was not a standard Debian package, making life miserable for the better part of a week while I tried to figure it out. Multiple attempts through USB key failed; no CD drive. Eventually gave up and put Ubuntu on. Not really a fan, just happens to work.
8. Re:I'm going to sue ... by Anonymous Coward · 2016-07-15 10:40 · Score: 0
  
  I have been using Ubuntu for a while, due to wanting to just have something that works and supports some of the stuff I wanted to do without a lot of hassle. About a year ago, mostly because I hate Unity, I moved to Mate which is an Ubuntu distro that supports the forked Gnome 2. Many, many problems went away and I was back in an environment I could stand, again without a lot of hassle.
9. Re:I'm going to sue ... by Anonymous Coward · 2016-07-15 11:01 · Score: 0
  
  Mate is not an Ubuntu distro.
10. Re:I'm going to sue ... by Anonymous Coward · 2016-07-16 00:16 · Score: 0
  
  Mate is an Ubuntu distro.
  FTFY.
  https://ubuntu-mate.org/
I am pretty happy with this by HBI · 2016-07-15 04:10 · Score: 1

I read TFA and it seems like they had some good practices in place. True, there was some contiguous PII released that could be used, along with other data, to identify someone. That said, they didn't lose any passwords.
Good on them. Sure, getting hit sucks, but this could have been a lot worse.

--
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
1. Re:I am pretty happy with this by Anonymous Coward · 2016-07-15 04:28 · Score: 0
  
  Good on them. Sure, getting hit sucks, but this could have been a lot worse.
  They got hit with a SQL injection.
  Everyone of them needs to line up in their tidy whiteys and run a gauntlet where they are beaned with Windows and AOL disks until they bleed; while being laughed at. If any are on Slashdot, they should be marked with a dunce cap by their UID.
  And we should start a meme - hacked by script kiddies should be known as being "Canonical'd".
2. Re: I am pretty happy with this by Anonymous Coward · 2016-07-15 04:42 · Score: 0
  
  Heh, yeah, like the semi-recent Mint issue where bad OS isos got distributed from the repo with backdoors?
3. Re: I am pretty happy with this by Anonymous Coward · 2016-07-15 04:45 · Score: 0
  
  These are our guys, though, AC! It's ok when we make mistakes. Just ask the parent!
  Now, if this was Micro$haft, your comments would be fine.
Again? by Anonymous Coward · 2016-07-15 04:12 · Score: 0

23/07/2013
Hello,
You are receiving this message because you have an account registered with this address on ubuntuforums.org.
The Ubuntu forums software was compromised by an external attacker. As a result, the attacker has gained access to read your username, email address and an encrypted copy of your password from the forum database.
If you have used this password and email address to authenticate at any other website, you are urged to reset the password on those accounts immediately as the attacker may be able to use the compromised personal information to access these other accounts. It is important to have a distinct password for different accounts.
The ubuntuforums.org website is currently offline and we are working to restore this service. Please take the time to change your ubuntuforums.org account password when service is restored.
We apologize for any inconvenience to the Ubuntu community, thank you for your understanding.
The Canonical Sysadmins.
1. Re:Again? by NotInHere · 2016-07-15 04:21 · Score: 1
  
  But this time, the attackers haven't got any passwords. From the announcement:
  
  No active passwords were accessed; the passwords stored in this table were random strings as the Ubuntu Forums rely on Ubuntu Single Sign On for logins.
Yeah right by Anonymous Coward · 2016-07-15 04:22 · Score: -1

Like there really 2 million people that would stoop low enough to use linsux, let alone a specific version. Talk about padding your account registrations!
This 'leak' was probably an internal job to show off these inflated numbers!
1. Re:Yeah right by sgage · 2016-07-15 04:26 · Score: 1
  
  Paul Thurrott, is that you?
2. Re:Yeah right by Anonymous Coward · 2016-07-15 05:55 · Score: 0
  
  Well probably 1.9 million of those were spam accounts. Ever ran a forum?
hackme.houghi.org by houghi · 2016-07-15 04:22 · Score: 1

I hope they were not able to link my domain http://hackme.houghi.org/ to my IP address, because that would mean I am extremely hackable.

--
Don't fight for your country, if your country does not fight for you.
1. Re:hackme.houghi.org by KiloByte · 2016-07-15 08:16 · Score: 1
  
  Leaked IP address, username and email address. Hmm... Let's take a look at any Debian bug report submitted using reportbug:
  From kilobyte@angband.pl Wed Jul 13 16:11:52 2016
  Received: (at submit) by bugs.debian.org; 13 Jul 2016 16:11:52 +0000
  [...]
  Received: from tartarus.angband.pl ([2a03:9300:10::8])
  by buxtehude.debian.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128)
  (Exim 4.84_2)
  (envelope-from <kilobyte@angband.pl>)
  id 1bNMlM-0000VI-F4
  for submit@bugs.debian.org; Wed, 13 Jul 2016 16:11:52 +0000
  Received: from umbar.angband.pl ([2001:6a0:118::6])
  by tartarus.angband.pl with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
  (Exim 4.84_2)
  (envelope-from <kilobyte@angband.pl>)
  id 1bNMlF-0007IU-CZ; Wed, 13 Jul 2016 18:11:47 +0200
  Received: from kilobyte by umbar.angband.pl with local (Exim 4.87)
  (envelope-from <kilobyte@angband.pl>)
  id 1bNMlF-0003mb-0h; Wed, 13 Jul 2016 18:11:45 +0200
  And no, censoring Received: headers in mboxes on the web view wouldn't solve problems, as anyone can subscribe to debian-bugs-dist@lists.debian.org and receive all BTS mails as a mailing list.
  Then let's take a look at LKML, especially patches submitted via git send-email.
  Hmm... perhaps there's nothing that special in this Ubuntu leak?
  
  --
  The creatures outside looked from Alt-Right to Antifa; but already it was impossible to say which was which.
Should have used open source! by chuckugly · 2016-07-15 04:28 · Score: 1

They should have hosted this stuff on open source software - it's super secure
1. Re:Should have used open source! by LichtSpektren · 2016-07-15 07:19 · Score: 1
  
  They should have hosted this stuff on open source software - it's super secure
  This isn't zero-day attack. Whoever was the sysadmin for the Ubuntu forums didn't apply a security patch. The same thing can happen if you don't patch a Microsoft SQL Server.
2. Re:Should have used open source! by Anonymous Coward · 2016-07-15 07:42 · Score: -1
  
  Spin, German Nazi cocksucker, spin that shit!
WRONG, LUDDITE! by Anonymous Coward · 2016-07-15 04:30 · Score: -1

They should have used Appdows 10, because only apps can app apps! LUDDITE software like LUDDITE BSD and LUDDITE Linux is what allowed LUDDITE hackers to hack their LUDDITE forums!
Apps!
Maybe they were fully updated? by Anonymous Coward · 2016-07-15 04:32 · Score: -1

Maybe they were fully updated...but since they are running Ubuntu, that means that they are still stuck with 2 year old packages.
This is what I hate about Debian and derivatives. It takes forever for them to adopt upstream changes because of their boneheaded definition of stability.
Their packages are stable only in the sense that packages don't get updated, not because they are functional and well behaved. There are plenty of applications that, right now, are broken, while a fix is available from upstream.
Oh sure, they apply "security fixes" from upstream once in a while. But that means that now not only are you running an old version of software, now you also have some untested patches put together by some guy that potentially has no clue what is going on. This usually ends up in tears (remember the Debian openssl fiasco?).
But even when maintainers are paying attention, they still manage to fuck up. They missed (or rather, ignored) the xscreensaver "time bomb" until it became a huge issue, despite the fact that it would jump out at you in a diff (it was a gigantic block of code after all) and the fact that Slackware and Gentoo noticed it about a year before.
So, no more Debian for me. You keep your terrible distro.
Linux! by Anonymous Coward · 2016-07-15 04:38 · Score: 0

So cool a security I thought you would enjoy it!
Fitting by Anonymous Coward · 2016-07-15 04:49 · Score: -1

That's what happens when you use a Linux distribution that aspires to become Windows.
SSO affected too? by t4eXanadu · 2016-07-15 04:57 · Score: 1

I log in using SSO. Has my account info been hacked too? If so, that's my main Google account :-(. Time to change some passwords, methinks.
1. Re:SSO affected too? by Anonymous Coward · 2016-07-15 07:02 · Score: 0
  
  Why would you ever use SSO for something on the Internet?!?
2. Re:SSO affected too? by Anonymous Coward · 2016-07-15 07:24 · Score: 0
  
  I log in using SSO. Has my account info been hacked too? If so, that's my main Google account :-(. Time to change some passwords, methinks.
  The SSO in use is based on OpenID and stored elsewhere. Your password should be fine, but if you are using the same passwords for more than one site, you should change them regardless.
m,od d0wn by Anonymous Coward · 2016-07-15 05:00 · Score: -1

Platform fotr the was at the same
it wuz haxx0rz! by Anonymous Coward · 2016-07-15 05:03 · Score: 0

Because informing people of what really happened would be just too burdensome.
Blame Internet Brands by Lirodon · 2016-07-15 05:07 · Score: 1

Both the recent VerticalScope hack and this have one thing in common: vBulletin. It is a pile of junk, and especially since it was acquired by a firm known as Internet Brands. It is awful software, and a forum about an open source product which uses proprietary components is ethically unsound.
Today's security is tomorrow's breach headline: by Anonymous Coward · 2016-07-15 05:26 · Score: 0

16-7: Ubuntu Single Sign On Servers Hacked.
OpenID... by ADRA · 2016-07-15 05:32 · Score: 1

If only we had common uses of OpenID, compromising services would have essentially zero material benefit for the perpetrators...

--
Bye!
SOMEBODY ON THE INSIDE. by Anonymous Coward · 2016-07-15 05:41 · Score: 0

Microsoft and CIA (FBI/NSA) have to-and-fro deal.
Quick, make Linux look hackable too, our investors are pissed. Ok!
(Debian has FBI working on some of their teams too, expect same later there)
Open Source by Anonymous Coward · 2016-07-15 06:05 · Score: -1

But, but teh Open Source and the "many eyes".
Four million eyeballs to verify software with by Anonymous Coward · 2016-07-15 06:11 · Score: 0

They should have hosted this stuff on open source software - it's super secure
Yes, those two million users have four million eyeballs to verify the software with.
They should have used RUST by Anonymous Coward · 2016-07-15 06:19 · Score: 0

If they'd RUSTed the forum in RUST the hackers wouldn't have had any chance to RUST through the impenetrable security RUST offers. RUST!!
Why can't these jerks do someting useful? by Anonymous Coward · 2016-07-15 06:37 · Score: 0

I guess you need these twits to expose the sloppy practices out there but it would be truly impressive if they could go after AT&T and others for using some of the *sshole collection agencies that spam our cell phone accounts with BS collection calls that don't relate to us. In other words, there are a lot of targets for a public service type of hacking out there. It must be more fun for them to be jerk off twits than to go after public nuisance targets.
Ubuntu is one of the systemds right? by Anonymous Coward · 2016-07-15 06:46 · Score: 0

Ubuntu is a systemd right? Like there's Windows, Mac, and Systemd computers? Can it also run Linux, maybe in some kind of VM?
Sigh by nnull · 2016-07-15 08:05 · Score: 1

Years later, we still deal with SQL injections when it was supposed to be "resolved" by now.
1. Re:Sigh by Anonymous Coward · 2016-07-15 09:22 · Score: 0
  
  Years later, we still deal with SQL injections when it was supposed to be "resolved" by now.
  Can't fix stupid.
Why dont they use a mail list? by Anonymous Coward · 2016-07-15 09:19 · Score: 0

Stop being weirdos. Nobody wants to create yet another account.
Is it the same as askubuntu.com? by meadow · 2016-07-15 09:23 · Score: 1

This is not the same forum as askubuntu.com?