Ubuntu vBulletin Based Forums Hacked & Defaced

GnuTux · **Posted:** Sun Jul 21, 2013 12:44 am **(#1)**

ZDNet wrote:

Ubuntu forums hacked; 1.82M logins, email addresses stolen

Canonical, the company behind the Ubuntu operating system, has suffered a massive data breach on its forums. All usernames, passwords, and email addresses were stolen. link

I do know that several other vBulletin forums were hacked prior to this. I wonder if they knew their vBulletin installation was vulnerable and did nothing about it?

I'm seeing talk of several other vBulletin based boards migrating to another platform, one of which is Fedora Forums.

Odinbc · **Posted:** Sun Jul 21, 2013 2:34 am **(#2)**

Crazy stuiff, it should be interesting when more info gets out.

ofnuts · **Joined:** Oct 25, 2010 **Posts:** 4812

Still not up, but I suspect the admins aren't going to lose their weekend on that.

I'm an active member, but not too worried, because I use a completely trivial password (ie, not the one I have on my mailbox) and even my mail id there is an alias on my true one (and therefore can't be used to log on).

lylejk · **Joined:** Sep 24, 2010 **Posts:** 12851

I thought I saw this on Slashdot before hitting the sack (just woke; may try to steal another hour before I have to go back to work; lol). Sad; very sad. Hopefully GIMPChat will never see this, but I do know GIMPTalk had it's fair share of problems (short of saying they were hacked that is).

Mike · **Joined:** Aug 27, 2010 **Posts:** 491

Most of the instances of vBulletin being hacked are a result of weak administrator passwords.
It's fairly bulletproof against SQL injection.
Now, some of the modifications people use are huge security issues.
vBSEO is one thousands of sites are using and no one is actively repairing that product.
There are quite a few others. Not everyone who writes code is a coder.

GnuTux · **Posted:** Mon Jul 22, 2013 6:53 am **(#6)**

I read where there might be some kind of issue with a front facing admin panel in the version of VB they were using. Several VB sites were hacked using an admin panel exploit just before the Ubuntu site was compromised. Not sure if the Ubuntu sites was hacked using that specific exploit, but in any event, there are always exploits. It's just a matter of how well known they are.

http://www.cvedetails.com/vulnerability ... letin.html

Mike · **Joined:** Aug 27, 2010 **Posts:** 491

I'm definitely interested in how they got hacked. They were running version 4.2.1 which supposedly patched all of the vulnerabilities listed in the link you provided. I have several clients who use that software so I'd rather they not have the same problems. I have backed all of their databases up just in case. Still, restoring a database isn't always as simple as it should be. I'm sure you're fully aware of that.

GnuTux · **Posted:** Wed Jul 31, 2013 7:11 pm **(#8)**

Mike wrote:

I'm definitely interested in how they got hacked.

Looks like one of the moderator accounts was compromised, then used to compromise the account of an administrator. No word on how the moderator's account was initially compromised but judging from what transpired, the hacker was no rookie.

Canonical wrote:

At 16:58 UTC on 14 July 2013, the attacker was able to log in to a moderator account owned by a member of the Ubuntu Community.

This moderator account had permissions to post announcements to the Forums. Announcements in vBulletin, the Forums software, may be allowed to contain unfiltered HTML and do so by default.

The attacker posted an announcement and then sent private messages to three Forum administrators (also members of the Ubuntu community) claiming that there was a server error on the announcement page and asking the Forum administrators to take a look.

One of the Forum administrators quickly looked at the announcement page, saw nothing wrong and replied to the private message from the attacker saying so. 31 seconds after the Forum administrator looked at the announcement page (and before the administrator even had time to reply to the private message), the attacker logged in as that Forum administrator.

Based on the above and conversations with the vBulletin support staff, we believe the attacker added an XSS attack in the announcement they posted which sent the cookies of any visitor to the page to the attacker. Read more...