Ubuntu forums breached - all passwords compromised

http://ubuntuforums.org/announce.html?t=534261

by boothead • 13 years ago

36 44 13 years ago

ubuntuforums.org

welder2• 13 years ago

So glad I use a random different password for EVERY account.

tommaxwell• 13 years ago

Not sure if sarcasm, or you're saying you use the same password on every site.

welder2• 13 years ago

It wasn't a joke. I create a 60+ character random password for every website. There are many tools available to help you manage your passwords.

I do have an ubuntuforums.org account and I DID use a random password so I WAS glad that I didn't have to rush to change all my passwords.

elchief2• 13 years ago

hopefully it's not {password}ubuntuforums.org and {password}google.com ...

tinco• 13 years ago

You know that's actually a lot (a very large lot) better than having the same password for multiple sites (like for example the common three password security levels strategy).

A bruteforcer might find a hash collision, but it's not likely to find the entire string {password}ubuntuforums.org unless it is actively looking for that string.

Granted ofcourse that all websites you do this on store their passwords securely.. if not then you are right, it is a terrible idea :P

favadi• 13 years ago

The best joke ever.

lcedp• 13 years ago

Well, salted hashed - not exactly "passwords compromised"?

harrytuttle2• 13 years ago

As good as.

$stored = md5(md5($password) + $salt);

That is the simple hash function.

sirmarksalot• 13 years ago

Confused here. Are you saying that ease of implementation makes it easy to reverse? Or are you agreeing with GP?

eksith• 13 years ago

That would have been standard 10 years ago, but these days, it's not very effective and, unfortunately, it's still a very common scheme. You're better off with:

  function rHash( $rounds, $data, $salt ) {
     $data = $data . $salt;
     while( $rounds > 0 ) {
        $data = hash( 'tiger160,4', $data );
        $rounds--;
     }
  }

And call $stored = rHash( ( registered month + year ), $password );

Or even the trusty old...

  $stored = crypt( $password, '$2y$14$' . $salt . '$' );

If you're on PHP > 5.4 ( some hosts are still on older versions ), you should check out password_hash() : http://php.net/manual/en/function.password-hash.php

Edit: Fixed some typos.

rob22• 13 years ago

its a forum.people simply asking their doubts. why they were hacking these sites.. I can't figure it out exactly..

jonnyscholes• 13 years ago

emails + password re-usage = profit

aram• 13 years ago

Email addresses + passwords + possibly other things as well.

Many people reuse the same email and password on other services/websites, so this is pretty valuable and sensitive information.

thejosh• 13 years ago

People use the same passwords for multiple things. If they have passwords for one site they can try it for multiple websites.

Sanddancer• 13 years ago

Assholes who just like kicking anthills, assholes who seek to get peoples' accounts for profit, and assholes who like kicking anthills for profit.

mukundmr• 13 years ago

I hope they used something sensible like bcrypt for encryption instead of MD5 which is too easy to crack these days.

RossM• 13 years ago

As far as I remember they were running vBulletin, which uses salted md5.

http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4...

kachnuv_ocasek• 13 years ago

It's not encryption, it's hashing. Also, I don't see how MD5 is easy to crack.

codygman• 13 years ago

Post an md5 hash of your password and you'll see ;)

lukashed• 13 years ago

The easiest and fastest way is to google it.

chmodd• 13 years ago

MD5 is so fast on GPUs, you can do some pretty ridiculous dictionary attacks in a matter of minutes (like trying every combination of words that has ever been written in a book or posted online - using google's n-gram corpus for example). Then you have plenty of time to try letter substitutions (3 for e), combinations such as word + number + word, etc. This doesn't apply of course, if your password is a long string of random characters.

pkolaczk• 13 years ago

Usually it is the password itself that is attacked, not the hashing algorithm. Many people use weak passwords and it is not that hard to use dictionary attacks against them.

riquito2• 13 years ago

Dictionary attacks against salted passwords hashed with something like bcrypt take way more time, weak password or not (and yet a weak password is by definition weak)

nnwa• 13 years ago

As I said when I previously commented. I find it pretty ironic that these kind of breaches could have been avoided by simply creating a whitelist for their admin panel. This isn't rocket science. The majority of breaches of these size that keep occurring are password reuse, or open admin panels (bruteforce attacks). Who needs a vulnerability when an attacker can simply look up the Administrators on databases they already have?

narsil• 13 years ago

Previous discussion here: https://news.ycombinator.com/item?id=6078588

jlebrech• 13 years ago

this is why I always use a memorable low-entropy password for forums and high-entropy from emails.

any unimportant site that demands a high security password (or low-entropy with silly rules) get put into my keypass.

blablabla123• 13 years ago

note to myself: don't use primary mail account for website registrations

sspiff• 13 years ago

I switched to using a few registration-specific emails after getting my own domain: spambox@example.com for really dodgy sites or sites I suspect will generate a bunch of crap periodical emails, and register@example.com for the sites I have a little more faith in.

It allows for much easier filtering of my email as well: I only get the emails I care for in my inbox.

ygra2• 13 years ago

I tend to use things like “sitename@example.com”. That way I can also see who gave my account details away when spam appears.

trvz• 13 years ago

"If they can't keep their forums secure, why should I even use their operating system?"

ygra2• 13 years ago

Because very likely very different people work on administering the fora and developing the operating system.

lukeman• 13 years ago

It would be nice if they'd allow you to test whether your email was in the data. As-is I'm left wondering if I ever had an account.

seewhat• 13 years ago

I believe Canonical sent warning emails to ubuntuforums.org account addresses.

Ubuntu forums breached - all passwords compromised

Related Stories