2 Million Users Exposed in Ubuntu Forum Breach

A data breach of Ubuntu forum database has exposed two million usernames, email addresses and IPs to hackers. The hack was confirmed by Ubuntu Linux developer, Canonical. The forum was shut down and all system and database passwords were reset as a precautionary measure.

The breach is reported to be an exploitation of a known SQl injection vulnerability in the Forumrunner add-on on the forum which wasn’t patched. A  part of the statement from Canonical reads, “The attacker had the ability to inject certain formatted SQL to the Forums database on the Forums database servers. This gave them the ability to read from any table but we believe they only ever read from the ‘user’ table,”

Infosecurity Magazine reports that Canonical has wiped and rebuilt the servers that were affected and patched it to the latest release and have also added a web application firewall to improve their security.


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s