Canonical, the developer of the Ubuntu operating system, said Friday in a statement that two million user names, email addresses, and IP addresses associated with Ubuntu Forums were hijacked by an anonymous intruder.
The attacker was able to exploit a vulnerability καταφέρνοντας SQL injection σε ένα add-on που χρησιμοποιείται από τα μεγαλύτερα software vBulletin forum.
This gave the attacker access to the bases data forum, but according to the company managed to obtain limited user data.
The company statement highlights that there is no operating system code or data from application repositories, It also states that the attacker could not write data to the database or access shell, that he did not manage to gain access to any other service Canonical or Ubuntu.
After the violation, the servers were formatted, installed new operating, new security measures, new passwords and according to the company the forum software has been completely repaired.
The statement added that although the forums use Ubuntu's single sign-on service, the passwords are hashed and salted. The statement does not indicate which hash algorithm has been used as some algorithms that are still in use (like MD5) are outdated and can break quite easily.
It would be good to change them immediately codeyour login and enable two-factor authentication.