Notice of security breach on Ubuntu Forums

  They used this access to download portions of the ‘user’ table which contained 
  usernames, email addresses and IPs for 2 million users. No active passwords were 
  accessed; the passwords stored in this table were random strings as the Ubuntu Forums 
  rely on Ubuntu Single Sign On for logins. The attacker did download these random 
  strings (which were hashed and salted).

Is that a session token they are talking about? What part of the OpenID protocol would involve saving a so-called "password" in the users table which is really just a "random string", but which was also hashed and salted?

Ubuntuforums does use Ubuntu One for SSO, there should be no "passwords" at all in the table, so I'm not quite sure what to make of that paragraph. Typically session tokens are not salted and hashed, although you can actually do that do avoid having to revoke them after a breach.

Re: Notice of security breach on Ubuntu Forums

#5

Post by creeble » Fri, Jul 15, 2016, 4:35 PM UTC

jrowley wrote: post #2

I like the direct communication style of this document.

Indeed, if only all such disclosures were so transparent.

I suppose transparency ends up being in reverse proportion to perceived liability, or some approximation thereof. This seems rather minor.

Re: Notice of security breach on Ubuntu Forums

#6

Post by AlphaGeekZulu » Fri, Jul 15, 2016, 4:37 PM UTC

Although they obviously failed in their security efforts, I think, they did a good job in communicating the incident. No beating around the bush.

Re: Notice of security breach on Ubuntu Forums

#7

Post by hueving » Fri, Jul 15, 2016, 4:42 PM UTC

zaroth wrote: post #4

They used this access to download portions of the ‘user’ table which contained usernames, email addresses and IPs for 2 million users. No active passwords were accessed; the passwords stored in this table were random strings as the Ubuntu Forums rely on Ubuntu Single Sign On for logins. The attacker did download these random strings (which were hashed and salted). Is that a session token they are talking about? What…

It's likely leftover schema from when a password was used instead of the SSO. I've seen this when a system transitioned to SSO that is based on another forum technology that also supports password. Just filled the regular password fields with garbage basically.

Re: Notice of security breach on Ubuntu Forums

#8

Post by awill » Fri, Jul 15, 2016, 4:55 PM UTC

ProxCoques wrote: post #3

Not another one? Didn't they get p0wned a few years ago?

yep. http://www.theregister.co.uk/2013/07/21/ubuntu_forums_breach...

Re: Notice of security breach on Ubuntu Forums

#9

Post by guessmyname » Fri, Jul 15, 2016, 6:14 PM UTC

> Hardening

> We’ve installed ModSecurity, a Web Application Firewall, to help prevent > similar attacks in the future.

> We’ve improved our monitoring of vBulletin to ensure that security patches are applied promptly.

What? They _just_ added a firewall in their forum? What were they thinking all these years then? Either none of their engineers thought about adding an extra layer of security to this website during all these years, or the chain of command in this company is so strict that any suggestion from their engineers is dismissed until a security breach is detected. What a shame, first Linux Mint, and now these guys.

Re: Notice of security breach on Ubuntu Forums

#10

Post by vmp » Fri, Jul 15, 2016, 6:39 PM UTC

ProxCoques wrote: post #3

Not another one? Didn't they get p0wned a few years ago?

Indeed, my first thought was "again?!"