{"id":6237,"date":"2013-08-02T19:05:03","date_gmt":"2013-08-03T02:05:03","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=6237"},"modified":"2019-04-20T16:24:37","modified_gmt":"2019-04-20T16:24:37","slug":"ubuntu-community-forum-hack-followup","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=6237","title":{"rendered":"Ubuntu community forum hack followup"},"content":{"rendered":"

\t\t\t\tOn July 14, 2013 an attacker obtained the moderator account of Ubuntu discussion forums which had global privileges.  The privileges allowed the attacker to post an announcement and then notify 3 forum admins “to take a look at” the announcement page to “see its error.”  The announcement page most likely had an XSS attack which sent cookies to anyone viewing it that announcement.  <\/span><\/p>\n\n\n\n\n

 <\/p>\n\n\n\n\n

Additionally, the attacker added a hook, PHP code which will run when the page is loaded, to the admin control panel in vBulletin.  The hook then launches on any unsuspecting control panel user and runs in the background string commands an attacker loads into them.  One string in the hook was a rootkit to grab the user database (table.) The table included 1.82M users’ logins, email addresses and passwords.<\/span><\/p>\n\n\n\n\n

 <\/p>\n\n\n\n\n

On July 30th, 2013, James Troup posted a followup on the hacking of Ubuntu’s discussion forums aka CANONICAL describing their reponse:<\/span><\/p>\n\n\n\n\n

Clean up<\/span><\/h3>\n\n\n\n\n