Ubuntu Forum Security Breach 108
pinkstuff writes "There has been a major security breach of the Ubuntu Forums database. Every user's email address and salted password has been taken. From the forum home page: Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database. The passwords are not stored in plain text, they are stored as salted hashes. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP. Ubuntu One, Launchpad and other Ubuntu/Canonical services are NOT affected by the breach."
Dupe from 3 days ago (Score:4, Insightful)
Dupe of http://it.slashdot.org/story/13/07/21/0318243/ubuntuforumsorg-hacked [slashdot.org]
Posting anon so no karma whoring
Re: (Score:3)
Weird, it showed the checkbox as checked for me...
Re: (Score:3)
Re: (Score:2)
Yes it is.
I have tiered passwords - one I use for a lot of stuff I don't care about, one I use for stuff I care about a little bit more (Slashdot is included ;) ) and unique passwords for anything "high-security" - work account, bank/anything else involving money, etc. I happened to use the "weak" password for ubuntuforums and - by definition - I don't really care if any other accounts are compromised. To put it in perspective, that's the password I use on sites that don't even hash their passwords, so the
Re: (Score:2)
You used a weak password for the ubuntu forums and a stronger one for slashdot? You're pretty weird, dude.
Re: (Score:1)
You place higher value on your /. account credentials than $insert_whatever_else_here? Speaking as someone who's on his third or fourth /. account (but the first one with my actual name), I must say ...
Priorities [photobucket.com]. That is all.
Re: (Score:2)
Re: (Score:2)
Yeah I know... Flaky connection here, and I checked it after I clicked the preview button (by habit) and nothing happened so I clicked again. Maybe the first one (without the check) went through. I'm fine if people would rather downvote me... not short of karma
Re: (Score:1)
Re: (Score:1)
"Posting anon so no karma whoring" (Score:2)
slimjim8094: Failed. :P
Re: (Score:1)
Probably, my database dump is from late last year.
The forums are useful (Score:2, Offtopic)
Re: (Score:1)
During last days I have bumped to the "ubuntuforums.org is down for maintenance" message several times while googling some Linux stuff. I never realized before that I visit that site so often.
The Gentoo and Arch Linux forums much more useful if you are an experienced, competent Linux user and ran into an oddball problem. Those users really, really know their stuff.
Ubuntu forums are sadly full of noob types asking noob questions. Yes there is good info there but you'll have to wade through the "RTFM" type questions and sometimes your signal to noise ratio is very low. Of course if you actually ARE a newbie this is a plus and they are very good about steering you in the right direction in a
The hashes are salted (Score:3, Interesting)
The hashes are salted. Who cares about a breach with salted hashes?
Re: (Score:2, Interesting)
I also have to question the practicality of having different passwords for all one's accounts, especially on things as nonessential as forums. Between work and things that matter I already have to remember too many passwords.
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
And how does that work across multiple different and different kinds of devices exactly?
KeePass is ported to many different device types. For syncing its database between devices, you could use whatever file syncing service you prefer.
Re: (Score:2)
Re:The hashes are salted (Score:5, Interesting)
The hashes are salted. Who cares about a breach with salted hashes?
If they aren't sure of the extent of the compromise, reading salted hashes (assuming they were) might only be part of the problem. Could be they were intercepting passwords on the fly.
Re: (Score:2)
If you have a known username and password, is it possible to derive the salt?
Re:The hashes are salted (BUT NOT PROPERLY) (Score:5, Informative)
They use vBulletin.. the passwords are salted.. but it's just md5(salt+md5(password)). The salt is in the db, and it's just 2 md5 hashes -- NO stretching, PBKDF2, bcrypt, or anything else. It's literally one step up from plaintext. You can recover those passwords in very little time. You SHOULD assume the passwords are compromised.
http://www.vbulletin.org/forum/showthread.php?t=178091 [vbulletin.org]
Re: (Score:2)
Here is a 25 GPU cluster that can go after MD5 hashes. [arstechnica.com]
The cluster can try 180 billion combinations per second against the widely used MD5 algorithm
Realize that an 8 character password is only about 48 bits of entropy, so if you find a key that hashes to that 128-bit MD5 hash code then its almost certain that that is in fact the password and not just a random collision. I am appalled at the horrible password "protection" practice in use today. In the 1980's we knew better and didnt store the
Re: (Score:2)
It's literally one step up from plaintext. You can recover those passwords in very little time. You SHOULD assume the passwords are compromised.
Really? Can you explain how this is done? My understanding is that MD5 is a one way hash function. I know of no real way to reverse an MD5 hash. I know there are MD5 databases that can do a reverse lookup, but they are only limited to dictionaries the common strings they contain. Surely that is only really useful if your password was something stupid like a dictionary word, or some lame leetified word like "l0ve". How do you reverse an MD5 hash if it is not?
I am genuinely interested.
Re:The hashes are salted (BUT NOT PROPERLY) (Score:5, Interesting)
How do you reverse an MD5 hash if it is not?
You try all possible inputs at a rate of 180 billion combinations per second. [arstechnica.com]
For an 8 character alphanumeric with a few symbols, thats about 48 bits of entropy, which equates to 1564 seconds (26 minutes) to try every single possible input. Since you used a 128-bit hash on 48 bits of entropy, the odds are very very very good that only one single input will result in the stored MD5 hash.
Thus the attack knows precisely what the original password was in only 26 minutes, which fits the definition of "reversing" the hash in no more than 26 minutes.
Re: (Score:2)
You try all possible inputs at a rate of 180 billion combinations per second. [arstechnica.com] Thus the attack knows precisely what the original password was in only 26 minutes, which fits the definition of "reversing" the hash in no more than 26 minutes.
Ok. That is fast. Still - there are two md5 hashes with a salt added - so it would likely take 52 minutes - although I think you could call that a distinction without a difference.
Re: (Score:2)
Ok. That is fast. Still - there are two md5 hashes with a salt added - so it would likely take 52 minutes - although I think you could call that a distinction without a difference.
Dont forget that since the users account name isnt part of the salt (or so I presume, given the bad hashing practice already noted by others), then every accounts hash can be attacked simultaneously. Thats 26 or 52 minutes to crack the password of every single account.
Re: (Score:3)
the salt is random.. so each user's password would need to be cracked individually.
that doesn't make it 52min though..
You could speed this up by hashing the password you want to try, then hashing it with each user's salt. So instead of 2x hashes, you would have (# of users) + 1 md5 calcs for each password attempt.
And the average time would be 1/2 of the max time.
Also... most of those passwords are probably dictionary words.
Re: (Score:2)
That isn't very comforting without knowing the hacker's intentions. For all we know, maybe your password was the only one they wanted.
Re: (Score:2)
Then don't use 8 letter passwords. 11 random alphanumerics at 180e9 tries per second is 62^11/180e9/(60*60*24) = 3345 days
Not to mention that we are talking about a 25 GPU's rig. I'm quite certain that some botnet owners have access to a hundred thousand decent GPU's, and a million not-so-decent GPU's. Welcome to reality.
Re: (Score:2)
Well they can try and use the same username & password on other forums.
They can try and use the same password on your email address.
If they get into your email, then they can request password resets for online banking, paypal, etc.
This is why you don't use the same passwords on different systems.
If you have your own domain, then use different email addresses for each site filtering into a central inbox. This also makes it easier to track where spammers get your address from.
Re: (Score:3)
"Still - there are two md5 hashes with a salt added "
No, even that part was done improperly. Since they hashed the password, then added the salt, then hashed the result.. it's actually just (# of users) + 1 md5 hashes.
1) hash password
2) concat hash + salt
3) hash result
4) repeat 2 & 3 for each user
Re: (Score:2)
"The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users."
Storing a 128-bit hash of a typical password, due to their much lower entropy, is in fact storing it in a recoverable format.
Re: (Score:2)
I don't think that brute forcing to identify passwords is what's meant by "recoverable" here. Though, I suppose I'm with you in the idea that if it's easy enough it's virtually the same.
I'm not getting what (other) significance you're assigning to the idea of passwords being much lower entropy than their hashes. Is there something about the relative entropies that matters, or are you just again pointing to the ease of brute forcing something like passwords (which are going to be, in practice, only a small
Re: (Score:3)
MD5 is just not computationally intensive by todays standards. You can easily calculate several BILLION MD5 hashes per second on a modern GPU. It's fast enough that you can simply bruteforce it.. you can rent an EC2 cluster for a few dollars if you don't want to spend the money on the GPUs.
There's a reason why at a minimum stretching is used (this is when you hash a password + salt, then hash the hash typically a few 10000 times)... this is standard practice BTW if you're going to use hashes (or better, use
Re: (Score:2)
Btw, the article you linked says it's actually md5(md5(password)+salt).
Re: (Score:2)
You're right.. the hash is appended to the password hash (not prepended). Carelessness on my part.. good catch.
Re: (Score:2)
Would you prefer that they kept silent? I wouldn't. Personally, I prefer an appropriate amount of transparency to silence and bullshit.
Re: (Score:2)
What do website admins think of "Here is a 25 GPU cluster that can go after MD5 hashes" arstechnica.com efforts?
Power and CPU time per user is the expensive over many users over years with new encryption?
Lack of easy software upgrades? ie would users have to re join as "new" encryption is added?
Good encryption is expensive per site? Needs hardware upgrades or next gen cpu?
Re: (Score:2)
What is holding all the sites back from better password as mentioned the md5(salt+md5(password))?
What do website admins think of "Here is a 25 GPU cluster that can go after MD5 hashes" arstechnica.com efforts?
Power and CPU time per user is the expensive over many users over years with new encryption?
Not generally, no. While strong encryption is considered an expensive operation, for a typical system, authentication is something that is relatively rarely done and the computing expense is a tiny part of the overall.
The trick is to make the hashing algorithm inexpensive enough that it isn't a burden on the authenticating system, but expensive enough that it's impractical to attack the hashes, now and a for a reasonable time going forward. As more computing power becomes available, that balance point sh
Re: (Score:3)
You don't even need a password change. You just store in the database what password verifier scheme was used (and a pair of MD5s with a salt of unknown size is a damn weak one) and then when the user logs in, you derive the password verifier using the scheme stored in the DB for their account. If it matches, then you log them in (of course) but you *also* computer a new password verifier using the new, better scheme - say, PBKDF2 with 50000 iterations - and then store that new verifier, and the new scheme y
Re: (Score:2)
Goddamn (Score:2)
Dupe.
samzenpus, you fucking suck sometimes. Hope you're not getting paid for this.
Dupe or another breach? (Score:3)
Bad timing for Canonical (Score:3)
This will probably hurt their campaign to bring Ubuntu to mobile [engadget.com].
Their kickstarter at Indiegogo [indiegogo.com] already seems to be slowing down.
Not quite fair to link a forum breach to Ubuntu, but public perception is what matters.
Forced sign-in (Score:2)
Great. ...), I bet they have way more information than they needed to have.
With their policy of needing to sign-in in order to download anything (script, picture,
And this information is now compromised....
Salting the hash is not enough (Score:2)
I hope the iterated with a sufficiently high count in addition. But as they do not say that, I am doubtful. Any competently done set-up would at the very least use PBKDF2 or scrypt with an iteration count > 100'000.
Why do people keep getting this very basic stuff wrong?
Ummmm.... (Score:2)
It's not news, even for nerds, when it is reported a week after everybody else reported it.
Dupe story (Score:4, Insightful)
Re: (Score:1)
the story should be that the ubuntu forums *are still offline* - going on five days now.
Re: (Score:3)
Re: (Score:2)
Script kiddies don't hack.
Re:Don't worry.... (Score:5, Informative)
The Ubuntu forums run on vBulletin, a proprietary solution. Nothing open-source about it.
Re: (Score:1)
The source was available to them right? So they could have audited it for security problems. So why didn't they detect the problems? Not enough resources allocated? Not enough talent? Same problem goes for OSS.
Skilled eyes are magnitudes better at spotting security bugs. How many skilled eyes are really looking at open source stuff AND working to get it fixed compared to the number of skilled eyes who are looking at it and keeping the exploits for their benefit.
The security of OSS is overrated. There are li
vBulletin proprietary and Open Source (Score:1)
vBulletin is written in plain/visible PHP. It is open source. I have worked in places using it in the past and modified the source to fix issues or add functionality (though directly editing the source is not usually a good solution, it's better to use one of the built in hooks).
That said, one should distinguish between OSS and FOSS. vBulletin is not FOSS. You do pay licensing for it, and it's not free to distribute. Various modules can also be encoded/encrypted, as many third-parties that create vBulletin
Re: (Score:3)
What happened is that you apparently dont know the difference between operating system vulnerabilities, and someone gaining unauthorized access to a forum.
Re: (Score:2)
Beyond simply the operating system, you've got vulnerabilities in things like
http://technet.microsoft.com/en-us/security/bulletin/ms13-040 [microsoft.com]
http://www.cvedetails.com/vulnerability-list/vendor_id- [cvedetails.com]
Re: (Score:1)
He hurt their feelings.
Re: (Score:2)