Security Breach On The Ubuntu Forums

hogndog · Jul 20, 2013

Just went there looking for some information and was greeted by this..

There has been a security breach on the Ubuntu Forums. The Canonical IS team is working hard as we speak to restore normal operations. This page will be updated regularly with progress reports.

What we know

* Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database.
* The passwords are not stored in plain text. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP.
* Ubuntu One, Launchpad and other Ubuntu/Canonical services are NOT affected by the breach.
Click to expand...

http://ubuntuforums.org/announce.html?t=1582084&page=2&p=9891841

Hogndog

shuverisan · Jul 21, 2013

~ Snipped as per TOS ~

Anyone know what hashing algo they used on pw's?

anon · Jul 21, 2013

1.82m affected by Ubuntu Forums data breach; passwords stolen

http://www.neowin.net/news/182m-affected-by-ubuntu-forums-data-breach-passwords-stolen

The Ubuntu forums are the latest to suffer a data breach, from a hacker, taking place last night.
An estimated 1.82 million accounts have been affected and at the time of writing the site is still down for maintenance.
Click to expand...

Baserk · Jul 21, 2013

awkwardpenguin said:

Anyone know what hashing algo they used on pw's?
Click to expand...

According to the AK wielding, rage loving penguin link;

You can stop worrying about your passwords. Yes, they were encrypted. Encrypted with the default vBulletin hashing algorithm (md5(md5($pass).$salt). Whilst it may not be the strongest, when you're dealing with 1.8m users it would take a very long time to get anywhere with the hashes. You don't have to worry about a DB leak. That isn't how I like to do things.

If I do get into a website, most of the time there's no REAL malicious intentions. Grab the database, leave a message. That's it. I don't like to over-do things. Might cause some downtime, but what if it WAS the "syr14n c3b3r 4rmy" (not that their brain-dead brains have the power to do anything whatsoever), and they did have malicious intentions, and they did leak the database and use it to their own advantage?

Oh, and keep on raging and sending me rage tweets, I love it.
Click to expand...

TheKid7 · Jul 22, 2013

Gun-wielding penguin takes over Ubuntu Forums, waves AK-47 at Linux users everywhere:

http://nakedsecurity.sophos.com/201...forums-waves-ak-47-at-linux-users-everywhere/

merisi · Jul 23, 2013

Gutted to hear about the forum being hacked. I've learned a lot on the Ubuntu forums and really enjoyed posting their in the past.

TheKid7 · Jul 23, 2013

Ubuntu users, relax: the gun-toting penguin says s/he means no harm:

Ubuntu Linux users can relax.

Maybe.

Someone claiming to be behind the weekend's Ubuntu Forums gun-toting-penguin takeover means no harm, s/he said in a TwitLonger post.

The person, going by the name of “Sputn1k_”, says to stop fretting about the password cracking, already, though s/he is enjoying the "rage tweets".

The encryption used to secure the 1.8 million filched users' local usernames, passwords, and email addresses might not be top-notch, but it's good enough to slow the cracking enough to make it tedious, Sputn1k_ says.

Besides, Sputn1k_ muses, s/he just doesn't swing that way...........
Click to expand...

http://nakedsecurity.sophos.com/201...he-gun-toting-penguin-says-she-means-no-harm/

SirDrexl · Jul 31, 2013

So, they're back. Now they are linking the Ubuntu One (Single Sign On) account to the forum account.

Log in or Sign up

Security Breach On The Ubuntu Forums

hogndog Registered Member

shuverisan Registered Member

anon Registered Member

Baserk Registered Member

TheKid7 Registered Member

merisi Registered Member

TheKid7 Registered Member

SirDrexl Registered Member

Log in or Sign up

Security Breach On The Ubuntu Forums

hogndog Registered Member

shuverisan Registered Member

anon Registered Member

Baserk Registered Member

TheKid7 Registered Member

merisi Registered Member

TheKid7 Registered Member

SirDrexl Registered Member

Useful Searches