I was hanging out at the Ubuntu community and found out that Ubuntu had been attacked by attackers — usernames, email addresses, and encrypted passwords were all taken.

Visiting any page on http://ubuntuforums.org redirects you straight to http://ubuntuforums.org/announce.html,只有一个公告,表示正在维护中,大致内容如下:

Ubuntu Forums is down for maintenance

There has been a security breach on the Ubuntu Forums. The Canonical IS team is working hard as we speak to restore normal operations. This page will be updated with progress reports.

What we know

• Unfortunately the attackers have gotten every user's local username, password, and email address from the Ubuntu Forums database.
• The passwords are not stored in plain text, they are stored as salted hashes. However, if you were using the same password as your Ubuntu Forums one on another service (such as email), you are strongly encouraged to change the password on the other service ASAP.
• Ubuntu One, Launchpad and other Ubuntu/Canonical services are NOT affected by the breach.

Progress report

• 2013-07-20 2011UTC: Reports of defacement
• 2013-07-20 2015UTC: Site taken down, this splash page put in place while investigation continues.
• 2013-07-21: we believe the root cause of the breach has been identified. We are currently reinstalling the forums software from scratch. No data (posts, private messages etc.) will be lost as part of this process.
• 2013-07-22: work on reinstalling the forums continues.

......

Although the Ubuntu community apologized, we can see from the notice that the passwords were stored as salted hashes, so there's really no need to worry too much.

If you often walk by the river, you're bound to get your shoes wet. Getting attacked is perfectly normal, and having an attack succeed is also perfectly normal — what impregnable fortress in the world can withstand every attack? The point is, there are at least two things to keep in mind. First, preventive measures must be in place; keep all patches and such updated to the latest versions. Although we can't fully defend against attacks, if we're well-prepared, we can at least give users a proper explanation even if we do get compromised. Second, we need to plan for the possibility that an attack will succeed. Turning passwords into salted hashes is a must — every time something like this happens, I'm reminded of the "conscience" of the CSDN attackers.

BTW, the biggest issue these past few days has been Apache Struts2. Wow, to prove that this vulnerability "really exists," Apache actually wrote sample attack code and produced an official hands-on attack tutorial. Could Ubuntu also be using the Struts2 framework? Judging from the address bar, it doesn't seem so...