Feeds

Ubuntu forums breached, 1.8m passwords pinched

Credentials were salted and hashed but resets recommended

The Power of One eBook: Top reasons to choose HP BladeSystem

Ubuntuforums.org, the Linux distribution's online community, has shut down for maintenance after a security breach.

It's not a pretty one: the site's operators say “Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database.”

The good news is that “The passwords are not stored in plain text, they are stored as salted hashes.”

The second piece of bad news is that a quick trip to the site through the wayback machine produces a page stating the site has 1,824,159 members, of whom 19,493 are classified as “active”. That's a lot of users who may not be visiting the site often enough to know of the breach. Little wonder then that the announcement on the site recommends “if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP.”

The site was taken down on Saturday evening, UK time, after being defaced earlier in the day. The defacement has been attributed to a twitter user @Sputn1k_, who's not exactly the Internet's best friend right now.

The site is still down at the time of writing, which could indicate the attack was severe or that Canonical, the company backing Ubuntu, hasn't been able to get a lot of engineers back on duty over the weekend.

Other Ubuntu services, namely Ubuntu One and Launchpad, aren't impacted by the breach. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.