Ubuntu forums breached - all passwords compromised

[welder]

So glad I use a random different password for EVERY account.

[tommaxwell]

Not sure if sarcasm, or you're saying you use the same password on every site.

[elchief]

hopefully it's not {password}ubuntuforums.org and {password}google.com ...

[favadi]

The best joke ever.

[lcedp]

Well, salted hashed - not exactly "passwords compromised"?

[harrytuttle]

As good as.

$stored = md5(md5($password) + $salt);

That is the simple hash function.

[nnwa]

As I said when I previously commented. I find it pretty ironic that these kind of breaches could have been avoided by simply creating a whitelist for their admin panel. This isn't rocket science. The majority of breaches of these size that keep occurring are password reuse, or open admin panels (bruteforce attacks). Who needs a vulnerability when an attacker can simply look up the Administrators on databases they already have?

[lukeman]

It would be nice if they'd allow you to test whether your email was in the data. As-is I'm left wondering if I ever had an account.

[seewhat]

I believe Canonical sent warning emails to ubuntuforums.org account addresses.

[narsil]

Previous discussion here: https://news.ycombinator.com/item?id=6078588

[rob22]

its a forum.people simply asking their doubts. why they were hacking these sites.. I can't figure it out exactly..

[aram]

Email addresses + passwords + possibly other things as well.

Many people reuse the same email and password on other services/websites, so this is pretty valuable and sensitive information.

[Sanddancer]

Assholes who just like kicking anthills, assholes who seek to get peoples' accounts for profit, and assholes who like kicking anthills for profit.

[thejosh]

People use the same passwords for multiple things. If they have passwords for one site they can try it for multiple websites.

[jonnyscholes]

emails + password re-usage = profit

[mukundmr]

I hope they used something sensible like bcrypt for encryption instead of MD5 which is too easy to crack these days.

[RossM]

As far as I remember they were running vBulletin, which uses salted md5.

http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4...

[pkolaczk]

Usually it is the password itself that is attacked, not the hashing algorithm. Many people use weak passwords and it is not that hard to use dictionary attacks against them.

[kachnuv_ocasek]

It's not encryption, it's hashing. Also, I don't see how MD5 is easy to crack.

[jlebrech]

this is why I always use a memorable low-entropy password for forums and high-entropy from emails.

any unimportant site that demands a high security password (or low-entropy with silly rules) get put into my keypass.

[blablabla123]

note to myself: don't use primary mail account for website registrations

[sspiff]

I switched to using a few registration-specific emails after getting my own domain: [email protected] for really dodgy sites or sites I suspect will generate a bunch of crap periodical emails, and [email protected] for the sites I have a little more faith in.

It allows for much easier filtering of my email as well: I only get the emails I care for in my inbox.

[trvz]

"If they can't keep their forums secure, why should I even use their operating system?"

[ygra]

Because very likely very different people work on administering the fora and developing the operating system.