> series: anatomy_of_a_breach —— part: 055 —— target: ubuntu_forums —— accounts: 1,820,000 —— method: sql_injection<span class="cursor-blink">_</span>_
In July 2013, Canonical disclosed that the Ubuntu Forums — ubuntuforums.org — had been compromised through a known SQL injection vulnerability in the vBulletin forum software. The attackers extracted approximately 1.82 million usernames, email addresses, and hashed passwords. The site was taken offline while the breach was investigated and remediated.
The irony was not lost on the security community: a platform serving Ubuntu — one of the most security-conscious operating system communities — had been compromised through SQL injection, the most fundamental web application vulnerability. The vBulletin installation had not been patched to address the known vulnerability. The breach demonstrated that even technically sophisticated communities are vulnerable when the infrastructure that supports them is not maintained with the same rigour as the software they produce.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe vulnerability exploited was a known SQL injection flaw in vBulletin that had been patched by the vendor. The Ubuntu Forums installation had not applied the patch. This is the same pattern we have documented repeatedly throughout this series: known vulnerability, available patch, patch not applied, breach follows. Cyber Essentials Danzell mandates that critical patches are applied within 14 days — a control that would have prevented this breach entirely.
The Ubuntu Forums breach teaches a simple lesson that has appeared in every year of this series: known vulnerabilities in web applications must be patched promptly, and web applications must be security tested regularly. Cyber Essentials mandates patching. Our web application testing identifies the SQL injections that patching alone may not address. SOC in a Box monitors for the exploitation attempts that target known vulnerabilities. And UK Cyber Defence provides incident response when a web application breach occurs.
Our <a href="/penetration-testing/web-application">web application testing</a> finds the SQL injections. <a href="/vulnerability-scanning">Vulnerability scanning</a> identifies unpatched platforms. <a href="/cyber-essentials">Cyber Essentials</a> mandates 14-day critical patching.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call