The official Ubuntu forums were breached yesterday evening, and Canonical today has confirmed that everyone’s username, password and email address has been snagged. For those who share the same password between the Ubuntu forums and other services, or have a rather simple password, it’s strongly recommended that you change it wherever it’s being shared.
It’s important to note that Ubuntu One, Launchpad and other Canonical services are not affected; this is exclusive to the forums, which was running vBulletin. Given the nature of the breach, it seems likely that the the forum software was at fault, or some plugin that the forum used. Whether or not the forums were out-of-date is not clear at this point.
The breach was made obvious to anyone who tried to visit the Ubuntu forums last night, as this is what greeted you:
It doesn’t appear that the breach was designed to be malicious, but rather to poke fun at Canonical for running a server with exploitable software. The text at the bottom of the above image backs that up:
None of this “y3w g0t haxd by albani4 c3bir 4rmy” stuff. Straight up, you dun goofed. It’s as simple as that.
Just over the past couple of days, NASDAQ’s OMX forums were also breached, along with Apple’s developer portal. The importance of using different passwords for each service you use should be ultimately clear by now. With a plugin like LastPass, you can easily generate ultra-secure passwords and store them easily. That way, you won’t have to change a billion passwords each time a breach like this happens, and believe me, we’re not going to begin seeing less of this.