9 ms·

Ubuntu forums hacked

65 points by reinhardt 13y ago

1234ideclarea 13y ago
love war
keithpeter 13y ago
ubuntuforums.org timing out as of now but are we sure this is a malicious attack and not simply downtime? If it is an attack, it just means a time bandit for the admins I suppose...
- daw___ 13y ago
  Can't access the site either, but I've just found this post on Google+ https://plus.google.com/103751102959761372959/posts/We8fexT5qgz https://plus.google.com/103751102959761372959/posts/We8fexT5...
- _sabe_ 13y ago
  Could be a new kind of meta-ddos. Announce a site has been hacked on Reddit/HN, and the news about the hack becomes the hack. :D
- ceol 13y ago
  I didn't take a screenshot, but I can confirm there was a message. Viewing my browser history, it apparently linked to this page: http://ubuntuforums.org/signaturepics/Sput.html http://ubuntuforums.org/signaturepics/Sput.html The top was a splash image that linked to this twitter account: https://twitter.com/Sputn1k_ https://twitter.com/Sputn1k_ Below was some text (scraped from Chrome's history database): Shoutout to @rootinabox. None of this "y3w g0t haxd by albani4 c3bir 4rmy" stuff. Straight up, you dun goofed. It's as simple as that. @rootinabox linked to this page: http://wedtm.com/blog/2013/07/11/cubeworldforum-dot-org/ http://wedtm.com/blog/2013/07/11/cubeworldforum-dot-org/
  - citricsquid 13y ago
    A few weeks back cubeworldforum.org was hacked (the forum referenced in that blog post) due to an administrator having their password compromised. The hacker replaced the index with a page with music and what not. From @Sputn1k on twitter it looks like he's the guy that hacked cubeworldforum.org too[1], so the wedtm.com link that @rootinabox went to is probably him just copying HTML he used last time and forgetting to correct the href. [1] https://twitter.com/Sputn1k_/status/354362220727111681 https://twitter.com/Sputn1k_/status/354362220727111681
    - rdtsc 13y ago
      I see this response in reference to how he may have done it: --- @Sputn1k_ @CubeWorldForum It's a fairly easy "hack". You set your forum avatar to a remote site that actually serves up a meta redirect. ---
      - krapp 13y ago
        You set your forum avatar to a remote site that actually serves up a meta redirect. That's... interesting. Like a php-generated image containing a redirect header, or a referrer check set up in .htaccess? I didn't know images were hackable like that, beyond just sending an alternative image for nonexistent referrers? If anyone needed a good argument against blindly hotlinking to other sites' content I guess this would be it.
    - synchronise 13y ago
      God damnit, script kiddies like this really piss me off. I hope that Twitter has some sort of IP logging for logins so that they can at least start to attempt to catch this guy. He broke the law, and he should be charged as such.
      - aspensmonster 13y ago
        I've been amused more than anything at the number of script kiddies that take to twitter to brag about their activities. They're painting a big fat target on the backs of their heads, convinced that they will never slip up and leak packets. Granted, if they truly are careful they won't get caught --at least not because of their twitter bragging. It just seems like an absolutely pointless risk to be taking.
- popey 13y ago
  It was hacked, and Canonical IS cut it off from the outside to diagnose the issue.
  - Posibyte 13y ago
    Yes, aren't the forums run by a user named "Ubuntugeek" or something of the sort?
    - popey 13y ago
      No. The forums are run by a community team of admins. The underlying infrastructure is managed by Canonical IS.
- jlgaddis 13y ago
  Screenshot: http://i.imgur.com/15u3X7V.png http://i.imgur.com/15u3X7V.png HTML source: http://pastebin.com/raw.php?i=7JXk5s1F http://pastebin.com/raw.php?i=7JXk5s1F
  - eksith 13y ago
    That's awfully well laid out for a defacement page.
    - krapp 13y ago
      Elegant, minimalist, nice logo, nice typography. If I get owned, I want it to be by these guys.
      - keithpeter 13y ago
        Thanks to grandparent for posting. For a split second, I considered setting this as wallpaper on my laptop. Then I remembered how much work this kind of prank generates for the system administrators.
  - minor_nitwit 13y ago
    It's finally happened, the penguins are fed up with the Linux caricatures.
nnwa 13y ago
That'd be the admin panel on their vbulletin installation which has been publicly facing for more than a year.
amccloud 13y ago
So far they are handling this better than Apple.
spindritf 13y ago
It's an opportunity to finally kill it off and stop polluting google results.
- jebblue 13y ago
  It's an opportunity to kill what off?
  - arthurcolle 13y ago
    ubuntuforums.org, presumably.
  - rfnslyr 13y ago
    Ubuntu.
- aptwebapps 13y ago
  Personally, I've found a lot of useful stuff there in the past.
lvs 13y ago
aren't ubuntu forums based on http://moinmo.in http://moinmo.in?
- popey 13y ago
  No, our wiki is moin based. The forums are vbulletin.
  - lvs 13y ago
    Ah, thanks.
- krakensden 13y ago
  http://www.vbulletin.com/ http://www.vbulletin.com/, IIRC.
wldlyinaccurate 13y ago
vBulletin is (and always has been) terribly insecure. Only way to beef up security is to lock down admin panels, e.g. IP-restrict them.
- eksith 13y ago
  vB's biggest problem is that it's a horribly convoluted rat's nest. If you've ever seen the actual code, you can see why it's just not possible to lockdown everything since there's so much legacy code that would break as a result.
  - GuiA 13y ago
    To my knowledge, that's sadly true of any PHP based message board (phpBB, SMF, etc).
    - eksith 13y ago
      I think this is very much a cultural problem within the PHP community. phpBB in particular is notorious for its unsustainable code and I think I figured out the reasons. There are better ways of doing things (despite PHP's inherent warts) that some other projects have used quite successfully, and more importantly sustainably, but there's a very long history of doing things "because that's just the way it's always been done" and I don't see that changing anytime soon, I'm afraid. I mean if you look at some of the tutorials out there, a lot of it is just appalling in terms of maintainability, efficiency and security (and that includes some very popular frameworks). There are a lot of cases where short-term, and often short-sighted, convenience trumps long-term goals.
      - jordanthoms 13y ago
        I can remember setting up a osCommerce site years ago, and the _official_ way of installing 'extensions' was literally to follow instructions telling you to open XYZ file and add this code at this line number, etc.
    - krapp 13y ago
GuiA 13y ago
>The passwords are not stored in plain text. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP. Translation: the passwords were stored using dumb MD5/SHA1. Seriously, it's 2013, why can't 99% of the web get their act together when it comes to password hashing?
- lwf 13y ago
  Ubuntuforums used vBulletin, which as of 2006 used MD5 + salt: http://www.vbulletin.org/forum/showthread.php?t=178091 http://www.vbulletin.org/forum/showthread.php?t=178091 Not sure what vB is using today.
  - GuiA 13y ago
    Eep. Even salted, MD5 is never the greatest idea. http://security.stackexchange.com/questions/19906/is-md5-considered-insecure http://security.stackexchange.com/questions/19906/is-md5-con...
    - krapp 13y ago
      I know developers who will to this day insist that salted md5 is practically invulnerable and more than adequate as long as the salt is big enough.
      - ReidZB 13y ago
        That's quite unfortunate. The size of the salt doesn't really matter much, so long as it can't be pre-computed before the DB leak. Once the DB is leaked, the salt could be a hundred characters and it wouldn't help much more than a ten character one.
        Stratoscope 13y ago
        That is very interesting, but at this late hour I'm having trouble understanding how the DB leak affects the effective salt length. With apologies for asking, is there an ELIM (Explain Like It's Midnight) version? (I did read the security.stackexchange.com question linked in the GP - is the answer in there and I missed it?) Thanks!
elchief 13y ago
This is how much effort it takes to have a BCrypt (strong, slow, salted hash) database user system in Spring (not that they used Spring): <http auto-config='true'> <intercept-url pattern="/**" access="ROLE_USER" /> </http> <beans:bean class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" id="passwordEncoder" /> <authentication-manager> <authentication-provider> <jdbc-user-service data-source-ref="dataSource" /> <password-encoder ref="passwordEncoder" /> </authentication-provider> </authentication-manager> StackExchange's AskUbuntu.com is pretty good, as you can use OpenId, and if someone (illegally) hacks Google we are all fucked anways.
orblivion 13y ago
So are they going to email their user base to warn them to change their passwords? I thought I had an account at some point and I didn't get an email.

65 points by reinhardt 13y ago

love war

ubuntuforums.org timing out as of now but are we sure this is a malicious attack and not simply downtime? If it is an attack, it just means a time bandit for the admins I suppose...

daw___ 13y ago
Can't access the site either, but I've just found this post on Google+ https://plus.google.com/103751102959761372959/posts/We8fexT5qgz https://plus.google.com/103751102959761372959/posts/We8fexT5...
_sabe_ 13y ago
Could be a new kind of meta-ddos. Announce a site has been hacked on Reddit/HN, and the news about the hack becomes the hack. :D
ceol 13y ago
I didn't take a screenshot, but I can confirm there was a message. Viewing my browser history, it apparently linked to this page: http://ubuntuforums.org/signaturepics/Sput.html http://ubuntuforums.org/signaturepics/Sput.html The top was a splash image that linked to this twitter account: https://twitter.com/Sputn1k_ https://twitter.com/Sputn1k_ Below was some text (scraped from Chrome's history database): Shoutout to @rootinabox. None of this "y3w g0t haxd by albani4 c3bir 4rmy" stuff. Straight up, you dun goofed. It's as simple as that. @rootinabox linked to this page: http://wedtm.com/blog/2013/07/11/cubeworldforum-dot-org/ http://wedtm.com/blog/2013/07/11/cubeworldforum-dot-org/
- citricsquid 13y ago
  A few weeks back cubeworldforum.org was hacked (the forum referenced in that blog post) due to an administrator having their password compromised. The hacker replaced the index with a page with music and what not. From @Sputn1k on twitter it looks like he's the guy that hacked cubeworldforum.org too[1], so the wedtm.com link that @rootinabox went to is probably him just copying HTML he used last time and forgetting to correct the href. [1] https://twitter.com/Sputn1k_/status/354362220727111681 https://twitter.com/Sputn1k_/status/354362220727111681
  - rdtsc 13y ago
    I see this response in reference to how he may have done it: --- @Sputn1k_ @CubeWorldForum It's a fairly easy "hack". You set your forum avatar to a remote site that actually serves up a meta redirect. ---
    - krapp 13y ago
      You set your forum avatar to a remote site that actually serves up a meta redirect. That's... interesting. Like a php-generated image containing a redirect header, or a referrer check set up in .htaccess? I didn't know images were hackable like that, beyond just sending an alternative image for nonexistent referrers? If anyone needed a good argument against blindly hotlinking to other sites' content I guess this would be it.
  - synchronise 13y ago
    God damnit, script kiddies like this really piss me off. I hope that Twitter has some sort of IP logging for logins so that they can at least start to attempt to catch this guy. He broke the law, and he should be charged as such.
    - aspensmonster 13y ago
      I've been amused more than anything at the number of script kiddies that take to twitter to brag about their activities. They're painting a big fat target on the backs of their heads, convinced that they will never slip up and leak packets. Granted, if they truly are careful they won't get caught --at least not because of their twitter bragging. It just seems like an absolutely pointless risk to be taking.
popey 13y ago
It was hacked, and Canonical IS cut it off from the outside to diagnose the issue.
- Posibyte 13y ago
  Yes, aren't the forums run by a user named "Ubuntugeek" or something of the sort?
  - popey 13y ago
    No. The forums are run by a community team of admins. The underlying infrastructure is managed by Canonical IS.
jlgaddis 13y ago
Screenshot: http://i.imgur.com/15u3X7V.png http://i.imgur.com/15u3X7V.png HTML source: http://pastebin.com/raw.php?i=7JXk5s1F http://pastebin.com/raw.php?i=7JXk5s1F
- eksith 13y ago
  That's awfully well laid out for a defacement page.
  - krapp 13y ago
    Elegant, minimalist, nice logo, nice typography. If I get owned, I want it to be by these guys.
    - keithpeter 13y ago
      Thanks to grandparent for posting. For a split second, I considered setting this as wallpaper on my laptop. Then I remembered how much work this kind of prank generates for the system administrators.
- minor_nitwit 13y ago
  It's finally happened, the penguins are fed up with the Linux caricatures.

nnwa 13y ago

That'd be the admin panel on their vbulletin installation which has been publicly facing for more than a year.

amccloud 13y ago

So far they are handling this better than Apple.

spindritf 13y ago

It's an opportunity to finally kill it off and stop polluting google results.

jebblue 13y ago
It's an opportunity to kill what off?
- arthurcolle 13y ago
  ubuntuforums.org, presumably.
- rfnslyr 13y ago
  Ubuntu.
aptwebapps 13y ago
Personally, I've found a lot of useful stuff there in the past.

lvs 13y ago

aren't ubuntu forums based on http://moinmo.in http://moinmo.in?

popey 13y ago
No, our wiki is moin based. The forums are vbulletin.
- lvs 13y ago
  Ah, thanks.
krakensden 13y ago
http://www.vbulletin.com/ http://www.vbulletin.com/, IIRC.

wldlyinaccurate 13y ago

vBulletin is (and always has been) terribly insecure. Only way to beef up security is to lock down admin panels, e.g. IP-restrict them.

eksith 13y ago
vB's biggest problem is that it's a horribly convoluted rat's nest. If you've ever seen the actual code, you can see why it's just not possible to lockdown everything since there's so much legacy code that would break as a result.
- GuiA 13y ago
  To my knowledge, that's sadly true of any PHP based message board (phpBB, SMF, etc).
  - eksith 13y ago
    I think this is very much a cultural problem within the PHP community. phpBB in particular is notorious for its unsustainable code and I think I figured out the reasons. There are better ways of doing things (despite PHP's inherent warts) that some other projects have used quite successfully, and more importantly sustainably, but there's a very long history of doing things "because that's just the way it's always been done" and I don't see that changing anytime soon, I'm afraid. I mean if you look at some of the tutorials out there, a lot of it is just appalling in terms of maintainability, efficiency and security (and that includes some very popular frameworks). There are a lot of cases where short-term, and often short-sighted, convenience trumps long-term goals.
    - jordanthoms 13y ago
      I can remember setting up a osCommerce site years ago, and the _official_ way of installing 'extensions' was literally to follow instructions telling you to open XYZ file and add this code at this line number, etc.
  - krapp 13y ago

GuiA 13y ago

>The passwords are not stored in plain text. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP. Translation: the passwords were stored using dumb MD5/SHA1. Seriously, it's 2013, why can't 99% of the web get their act together when it comes to password hashing?

lwf 13y ago
Ubuntuforums used vBulletin, which as of 2006 used MD5 + salt: http://www.vbulletin.org/forum/showthread.php?t=178091 http://www.vbulletin.org/forum/showthread.php?t=178091 Not sure what vB is using today.
- GuiA 13y ago
  Eep. Even salted, MD5 is never the greatest idea. http://security.stackexchange.com/questions/19906/is-md5-considered-insecure http://security.stackexchange.com/questions/19906/is-md5-con...
  - krapp 13y ago
    I know developers who will to this day insist that salted md5 is practically invulnerable and more than adequate as long as the salt is big enough.
    - ReidZB 13y ago
      That's quite unfortunate. The size of the salt doesn't really matter much, so long as it can't be pre-computed before the DB leak. Once the DB is leaked, the salt could be a hundred characters and it wouldn't help much more than a ten character one.
      - Stratoscope 13y ago
        That is very interesting, but at this late hour I'm having trouble understanding how the DB leak affects the effective salt length. With apologies for asking, is there an ELIM (Explain Like It's Midnight) version? (I did read the security.stackexchange.com question linked in the GP - is the answer in there and I missed it?) Thanks!

elchief 13y ago

This is how much effort it takes to have a BCrypt (strong, slow, salted hash) database user system in Spring (not that they used Spring): <http auto-config='true'> <intercept-url pattern="/**" access="ROLE_USER" /> </http> <beans:bean class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder" id="passwordEncoder" /> <authentication-manager> <authentication-provider> <jdbc-user-service data-source-ref="dataSource" /> <password-encoder ref="passwordEncoder" /> </authentication-provider> </authentication-manager> StackExchange's AskUbuntu.com is pretty good, as you can use OpenId, and if someone (illegally) hacks Google we are all fucked anways.

orblivion 13y ago

So are they going to email their user base to warn them to change their passwords? I thought I had an account at some point and I didn't get an email.