Ubuntu forums (vB4.2.0) hacked, 1,824,159 accounts compromised

[AusPhotography]

See: http://www.theregister.co.uk/2013/07...words_pinched/

Ubuntuforums.org, the Linux distribution's online community, has shut down for maintenance after a security breach. It's not a pretty one: the site's operators say “Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database.”
The good news is that “The passwords are not stored in plain text, they are stored as salted hashes.”

The second piece of bad news is that a quick trip to the site through the wayback machine produces a page stating the site has 1,824,159 members, of whom 19,493 are classified as “active”. That's a lot of users who may not be visiting the site often enough to know of the breach. Little wonder then that the announcement on the site recommends “if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP.”
The site was taken down on Saturday evening, UK time, after being defaced earlier in the day. The defacement has been attributed to a twitter user @Sputn1k_, who's not exactly the Internet's best friend right now.

Change your passwords now.

Kym

[Mopar1973Man]

Dang... Great I'm a member over there too. (sigh) Time to change passwords again...

[rudedog1968]

I hope people are not using the same password and username for all site...

Any word on how the site was compromised? Was it via vB or by another means?

[LockedOnLaw]

Boom goes the dynamite ...

[Wayne Luke]

While an important issue, this isn't really a relevant topic for this forum. If requested we'll give full support the Ubuntu Forum team. There are thousands of ways a site can be compromised. Until we hear from them we cannot assume it was the vBulletin software at fault.