Slashdot Mirror
Ubuntu Linux Forums Hacked -- IP Address, Username, Email of 2M Accounts Compromised (betanews.com)
Canonical announced on Friday that Ubuntu forums have been hacked. The company adds that data such as IP address, username, and email address of over two million users have been compromised. BetaNews reports: Keep in mind, this does not mean that the operating system has experienced a vulnerability or weakness. The only thing affected are the online forums that people use to discuss the OS. Still, such a hack is embarrassing as it happened due to Canonical's failure to install a patch.In a blog post, Jane Silber, Chief Executive Officer, Canonical said, "after some initial investigation, we were able to confirm there had been an exposure of data and shut down the Forums as a precautionary measure. Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched."
online forums software can be hard to update if any mods / plug in's are in use.
Love the metadata on the image they used in TFA.. "Hacker desk laptop hoodie hacking hooded". I guess a white dude with facial hair and a hoodie is automatically "hacking" if he has a laptop out.
Now, if you'll excuse me, I have backups to corrupt.
... those bastards.
On a related note, my lawyer wants to know what the terms, "ubuntu," and "linux," and "forum," mean.
Help here, please?
It little behooves the best of us to comment on the rest of us.
I read TFA and it seems like they had some good practices in place. True, there was some contiguous PII released that could be used, along with other data, to identify someone. That said, they didn't lose any passwords.
Good on them. Sure, getting hit sucks, but this could have been a lot worse.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
The vulnerability was an SQL injection. The operating system had nothing to do with it.
But this time, the attackers haven't got any passwords. From the announcement:
No active passwords were accessed; the passwords stored in this table were random strings as the Ubuntu Forums rely on Ubuntu Single Sign On for logins.
I hope they were not able to link my domain http://hackme.houghi.org/ to my IP address, because that would mean I am extremely hackable.
Don't fight for your country, if your country does not fight for you.
Paul Thurrott, is that you?
They should have hosted this stuff on open source software - it's super secure
They should have used SQL Server instead of MySQL.
It has nothing to do with that either.
It's to do with inputs not being sanitized AGAIN at a guess. wouldn't matter which SQL it was if the code was written by a crack addicted monkey with no concept of security (which apparently it was)
I log in using SSO. Has my account info been hacked too? If so, that's my main Google account :-(. Time to change some passwords, methinks.
Both the recent VerticalScope hack and this have one thing in common: vBulletin. It is a pile of junk, and especially since it was acquired by a firm known as Internet Brands. It is awful software, and a forum about an open source product which uses proprietary components is ethically unsound.
Yeah, if that level of granularity was used every time there was a security vulnerability related to software that runs on Windows then it might be relevant.
Not to mention the fact that Ubuntu isn't linux: It's a linux distribution that expressly provides an entire software stack, including the software that got hacked here.
AntiFA: An abbreviation for Anti First Amendment.
If only we had common uses of OpenID, compromising services would have essentially zero material benefit for the perpetrators...
Bye!
Yeah, if that level of granularity was used every time there was a security vulnerability related to software that runs on Windows then it might be relevant.
Not to mention the fact that Ubuntu isn't linux: It's a linux distribution that expressly provides an entire software stack, including the software that got hacked here.
Don't be obtuse. "Linux" is most commonly used to refer to the complete server or desktop environment. When Linux fans are championing and encouraging people to switch their server or desktop to Linux they are referring to the entire environment not merely the kernel. Just as when Windows gets hacked and its something in the "software stack" and not the kernel itself, often something from a 3rd party not Microsoft. Matter of fact when the only "Linux" thing in an environment is the Linux kernel we tend not to call it "Linux" at all, for example Android. So don't start with this "Linux" only refers to the kernel nonsense, that is not how the word is used, and that includes within the Linux community.
The right sentiment, but not entirely true, actually. Some SQL injection bugs are only exploitable when a specific dialect of SQL is used under the hood. Some support query stacking (MSSQL), while others don't by default. Some allow for easy creation of files on the server's filesystem (MySQL), some don't. It's not exactly the norm, but also not uncommon for the behavior of a SQL dialect to mitigate a vulnerability. Not that one should rely on such behaviors for security, but it can assist. That's not to say this is a case where a different version of SQL would have helped, of course. I haven't looked at the details.
Yeah, if that level of granularity was used every time there was a security vulnerability related to software that runs on Windows then it might be relevant.
Not to mention the fact that Ubuntu isn't linux: It's a linux distribution that expressly provides an entire software stack, including the software that got hacked here.
SQL injections have nothing to do with the platform you're running them on. It's a result of sloppy programming. The same thing can happen on just about every OS and every SQL daemon.
You might have a point about Windows being unfairly maligned if it weren't for e.g. Internet Explorer being so thoroughly integrated into the OS that its vulnerabilities in the browser can be exploited even if the user doesn't use it.
Ah yes, here comes the Linux apologists trying to deflect any blame from Teh Liuxxxx!!!!!!
That's a fair point, since Microsoft's products are totally immune to SQL injection -- oh wait, no they're not, you knob.
Years later, we still deal with SQL injections when it was supposed to be "resolved" by now.
This is not the same forum as askubuntu.com?
If you think sanitizing inputs protects against SQL injection, I have a bridge to sell you. You need to parameterize/prepare your inputs, which separates your commands from your data. If your inputs cannot change your commands, then all it well.
Nice link of how not to use MS SQL correctly. General rule of thumb, you can't fix stupid. They will always find a away to use tool incorrectly.