Your submission was sent successfully! Close

Thank you for signing up for our newsletter!
In these regular emails you will find the latest updates from Canonical and upcoming events where you can meet our team.Close

Thank you for contacting our team. We will be in touch shortly.Close

  1. Blog
  2. Article

Jane Silber
on 15 July 2016

Notice of Ubuntu Forums breach; user passwords not compromised


There has been a security breach on the Ubuntu Forums site. We take information security and user privacy very seriously, follow a strict set of security practices and this incident has triggered a thorough investigation. Corrective action has been taken, and full service of the Forums has been restored.  In the interest of transparency, we’d like to share the details of the breach and what steps have been taken. While user data such as email addresses was exposed, no passwords were compromised.  We apologise for the breach and ensuing inconvenience.

What happened

At 20:33 UTC on 14th July 2016, Canonical’s IS team were notified by a member of the Ubuntu Forums Council that someone was claiming to have a copy of the Forums database.

After some initial investigation, we were able to confirm there had been an exposure of data and shut down the Forums as a precautionary measure.  Deeper investigation revealed that there was a known SQL injection vulnerability in the Forumrunner add-on in the Forums which had not yet been patched.

What the attacker could access

The attacker had the ability to inject certain formatted SQL to the Forums database on the Forums database servers. This gave them the ability to read from any table but we believe they only ever read from the ‘user’ table.

They used this access to download portions of the ‘user’ table which contained usernames, email addresses and IPs for 2 million users. No active passwords were accessed; the passwords stored in this table were random strings as the Ubuntu Forums rely on Ubuntu Single Sign On for logins. The attacker did download these random strings (which were hashed and salted).

What the attacker could not access

We know the attacker was NOT able to gain access to any Ubuntu code repository or update mechanism.

We know the attacker was NOT able to gain access to valid user passwords.

We believe the attacker was NOT able to escalate past remote SQL read access to the Forums database on the Forums database servers.

We believe the attacker was NOT able to gain remote SQL write access to the Forums database.

We believe the attacker was NOT able to gain shell access on any of the Forums app or database servers.

We believe the attacker did NOT gain any access at all to the Forums front end servers.

We believe the attacker was NOT able to gain any access to any other Canonical or Ubuntu services.

What we’ve done

Cleanup

  • We backed up the servers running vBulletin, and then wiped them clean and rebuilt them from the ground up.
  • We brought vBulletin up to the latest patch level.
  • We reset all system and database passwords.

Hardening

  • We’ve installed ModSecurity, a Web Application Firewall, to help prevent similar attacks in the future.
  • We’ve improved our monitoring of vBulletin to ensure that security patches are applied promptly.

 

UPDATED 19 July 2016 to reinforce that user passwords were not compromised.

Related posts


Felipe Vanni
12 March 2024

Canonical’s showcase at HPE Tech Jam 2024

AI Article

Canonical, a leading advocate for open-source technology, is excited to announce its participation in the HPE Tech Jam 2024, set to take place in Atlanta and Vienna. This prestigious event will convene presales consultants and enterprise architects to delve into groundbreaking strategies powered by HPE’s edge-to-cloud workload solutions a ...


Aaron Whitehouse
24 November 2023

Ubuntu Explained: How to ensure security and stability in cloud instances—part 3

Cloud and server Article

Applying updates across a fleet of multiple Ubuntu instances is a balance of security and service uptime. We explore best practices to maximise stability. ...


Canonical
21 November 2023

Canonical announces the general availability of chiselled Ubuntu containers

Canonical announcements Article

Production-ready, secure-by-design, ultra-small containers with chiselled Ubuntu Canonical announced today the general availability of chiselled Ubuntu containers which come with Canonical’s security maintenance and support commitment. Chiselled Ubuntu containers are ultra-small OCI images that deliver only the application and its runtime ...