Does Ubuntu Forum is still safe?

[samiux]

Hi all,

Do you remember that Ubuntu forum has been hacked in July this year? The admin(s) have said that they figured out the vulnerabilities and they have informed vBulletin.com about the finding. The vBulletin.com will fix the vulnerabilities. Do you remember?

However, admin(s) of Ubuntu forum are making a joke to us. Why?

The report at the INQUIRER :
http://www.theinquirer.net/inquirer/...ro-day-attacks

The facebook of the Inj3ct0r Team :
https://www.facebook.com/inj3ct0rs/p...11793255548704

I am doubt that the Ubuntu Forum is still safe even the SSO Login is implemented.

Samiux

[Elfy]

So Vbulletin's forum and another one have been hacked.

Nothing to do with us. We don't have anything to do with either of those sites - neither do Canonical.

If the information Canonical discovered was passed onto them - how is that anything to do with us?

However, admin(s) of Ubuntu forum are making a joke to us. Why?

Really?

How so?

If you have doubts about the safety of the site then the best thing to do would be post in the Resolution Centre where we can disable your account.

In the meantime this reads just like a troll post.

[samiux]

So Vbulletin's forum and another one have been hacked.

Nothing to do with us. We don't have anything to do with either of those sites - neither do Canonical.

If the information Canonical discovered was passed onto them - how is that anything to do with us?



Really?

How so?

If you have doubts about the safety of the site then the best thing to do would be post in the Resolution Centre where we can disable your account.

In the meantime this reads just like a troll post.

My doubt is your findings are right? Assume that your findings are right and vBulletin.com is informed, vBulletin.com should fix the vulnerabilities that you found.

However, their site is also hacked. Therefore, I think that your findings are not the right one.

May be my English is not good, so you misunderstood my meaning.

Samiux

[coffeecat]

Canonical sysadmins established a constructive and mutually useful dialogue with Vbulletin support staff as described here:

http://ubuntuforums.org/showthread.php?t=2164064

If you are suggesting that the behaviour of either Canonical or Vbulletin staff was less than professional, that is not an allegation that will win you any credibility.

Much has been done by both Canonical sysadmins and forum staff since the security breach, with the interests of the forum membership and the integrity of the forum as priorities, and much of it not publicised for obvious reasons. What happens on other forums is nothing to do with this forum or Canonical, but if lessons can be learnt from happenings on other vbulletin forums, we would wish to know about them.

[Habitual]

and facebook is what. credible?

[miguelpires]

Hi all,

Do you remember that Ubuntu forum has been hacked in July this year? The admin(s) have said that they figured out the vulnerabilities and they have informed vBulletin.com about the finding. The vBulletin.com will fix the vulnerabilities. Do you remember?

However, admin(s) of Ubuntu forum are making a joke to us. Why?

The report at the INQUIRER :
http://www.theinquirer.net/inquirer/...ro-day-attacks

The facebook of the Inj3ct0r Team :
https://www.facebook.com/inj3ct0rs/p...11793255548704

I am doubt that the Ubuntu Forum is still safe even the SSO Login is implemented.

Samiux

Samiux hi,

Have you find any vulnerabilitty in Ubuntu Forums? are the Inj3ct0r Team a trusted hacker team?

I normally read your "blog" soo if they are trusted, I think we all have a problem...

Regards
Miguel

[clearski]

I was wondering if there's any chance to use a secure protocol (https) for the entire session on ubuntuforums.org, not only for the login step?

I am not discussing the security of the ubuntuforums, but I personally have a preference for everything that is encrypted and I've got 14 hops until I reach the server. So, I was just wondering...

[bapoumba]

Moved to Forums Feedback & Help.

[samiux]

Samiux hi,

Have you find any vulnerabilitty in Ubuntu Forums? are the Inj3ct0r Team a trusted hacker team?

I normally read your "blog" soo if they are trusted, I think we all have a problem...

Regards
Miguel

Hi Miguel,

I will not test the Ubuntu Forums as I am not authorized to do so. I hope officials of Ubuntu Forums can assign Penetration Tester(s) to test the Ubuntu Forums in order to find out any potential vulnerabilities.

The Inj3ct0r Team stated that they responsible to the attacks. They are criminals. One of my friends' web site has been kidnapped by the team last month.

I am worrying that let's assume Ubuntu Forums admins find the vulnerabilities after the attack and they informed the vBulletin.com. The vBulletin.com fixed accordingly. The patch has been released but Macrumors.com did not fix the flaw(s) in time. So, the Macrumors.com is attacked in the same manner of Ubuntu Forums in July as it stated in facebook of Inj3ct0r Team. It is understandable.

However, the Inj3ct0r Team stated that vBulletin.com is attacked via an undocumented vulnerability. Therefore, I suspect that Ubuntu Forums may have the same vulnerability of vBulletin.com too.

The website(s) can be defensed if all the vulnerabilities have been discovered before the bad guy(s). Please refer to OWASP Top 10 2013 for details -- https://www.owasp.org/index.php/Cate...op_Ten_Project and their testing guide -- https://www.owasp.org/index.php/OWASP_Testing_Project

Samiux

[samiux]

I was wondering if there's any chance to use a secure protocol (https) for the entire session on ubuntuforums.org, not only for the login step?

I am not discussing the security of the ubuntuforums, but I personally have a preference for everything that is encrypted and I've got 14 hops until I reach the server. So, I was just wondering...

Hi clearski,

Even encrypted traffic (https) is in action, the bad guy(s) can hijack your cookie or session too unless your web application or web server is applied "HTTPONLY" secure flag.

Samiux