Canonical takes Ubuntu forums offline in wake of password breach

Canonical, makers of the Ubuntu Linux distribution, recently announced that its Ubuntu help forums suffered a security breach over the weekend. Attackers were able to harvest an estimated 1.82 million user names, email addresses, and passwords from the site. Canonical says it isn’t sure how hackers were able to breach its systems and the company has taken the forums at Ubuntuforums.org offline as a precaution.

Canonical is warning anyone with an Ubuntu Forums account about the hack via email. The company is also advising users to change their security credentials on other sites, especially email, if they used the same password and username/email for other online services.

Ubuntu.com services such as Ubuntu One are not believed to be affected by the hack since they do not share the same login account as the Ubuntu forums.

Fans of the Ubuntu forums began reporting that the site had been defaced on Saturday. The hacker or group of hackers who breached the site posted an image of a penguin (the Linux mascot is a penguin) holding an AK-47.

The message underneath the image suggested the hackers were more interested in exposing a poorly secured site than anything else. “None of this ‘[you got hacked] by albani4 c3bir 4rmy’ stuff,” the message on Ubuntu’s forums site said. “Straight up, you dun goofed. It's as simple as that.”

It’s not clear if the hackers plan on exposing the database of user names and passwords online. Nevertheless, there is a definite possibility these account credentials could begin circulating around the less reputable areas of the Internet.

For now, the hack doesn't appear malicious, but users should take caution.
Canonical says forum user passwords were not stored in plain text and were hashed and salted. A hash uses a mathematical algorithm to convert plain text passwords into a series of numbers and letters. A specific hash will create the same string of letters and numbers each time for the same input (in this case a password). To make hashes more secure they are further obscured by “salting,” a process that inserts random bits into the hash making it harder to guess the original password.

Canonical had not returned our request for comment at this writing, so it’s not clear which hashing algorithm the company was using. However, a report from Ars Technica says Canonical was using the md5 hash. MD5 is a popular hashing algorithm that is often used by software companies as a security check to let users ensure downloaded executable files were not tampered with or corrupted. But md5 is not considered to be a secure choice for hashing passwords.

Reports of password breaches are always a good time to reevaluate your own online security practices. Always make sure you are using unique passwords for every site you visit online. For tips on generating your own passwords check out PCWorld’s “Learn to use strong passwords” or “Passwords: You're doing it wrong. Here's how to make them uncrackable.”

Use a password manager such as LastPass or Password Safe to store all your various passwords for different online sites. These programs can also create new passwords for you and can automatically fill out login forms for you.

Finally, activate two-factor authentication for any services that support this security measure such as Battle.net, Dropbox, Evernote, Facebook, Gmail, Twitter, and Outlook.com. Two-factor authentication requires you to enter a second, shorter temporary password that is usually generated by a smartphone application or small key fob.

Many services that offer two-factor authentication allow you to set trusted PCs so that you only have to enter your credentials once on new PCs or browsers.

Canonical has not said when Ubuntu forums will be back up. In the meantime, any Ubuntu user looking for support can check out sites such as Stack Exchange’s Ask Ubuntu or Ubuntu Discourse.

Canonical to crowdfund first batch of Ubuntu Edge phones

Canonical is taking its innovative smartphone design directly to potential customers. The company has launched a crowdfunding campaign to build the original batch of its planned Ubuntu Edge devices.

Canonical hopes to raise US$32 million within 30 days, to build 40,000 units. It will use the Indiegogo service and the Paypal electronic payment service, to collect the contributions.

"We'll use crowdfunding to see if there is a real market," said Mark Shuttleworth, Ubuntu founder, in a press conference. "Today there are very few people who decide what will go into the next generation of handsets. And they can't possible get it right all the time. With crowdfunding, we can connect the passionate forward-thinking types directly to manufacturers."

Contributors who pledge $600 on Tuesday, or $830 for the remaining 29 days, will get one of the devices, which are due to be shipped in May 2014. Canonical will not build the phones should the full $32 million not be donated, though handset manufacturers have indicated a willingness to build the phones on their own, should they receive sufficient interest from the phone carriers.

Like Microsoft did with its Windows RT tablets, Canonical is hoping to kickstart interest among device manufacturers for an innovative hardware design by introducing its own device. Unlike Microsoft, Canonical has no plans to stay in the hardware market after this test run of devices. The company plans to break even in this project, though obviously it will benefit by raising awareness of the Ubuntu Edge.

Ubuntu sees two potential users of Ubuntu Edge: early adopting consumers and the organizations that wish to use the product as a combined smartphone and a sort of thin-client device to power worker desktops.

The Ubuntu Edge is a unique smartphone design in that it would be the first that could be used as a smartphone as well as a full-fledged personal computer, when docked to a monitor with an HDMI cable and linked to an optional keyboard and mouse.

Canonical's idea is that the user can use the phone when out and about, but switch to a PC when docked, thereby consolidating two devices into a single one.

"If you only have to buy one set of RAM, CPU and storage and CPU for your phone, your tablet and your PC, there are enormous savings there in doing that," Shuttleworth said. "If developers only have to target one platform, there are enormous benefits for them."

"This will be the first phone you can connect to a screen and get a full PC experience," Shuttleworth said. The Ubuntu Edge would dual boot both the Ubuntu desktop OS and Android.

As a result of this potential dual usage, the phone design calls for more muscular componentry than is typically found in a phone. It will feature a quad-core processor, though Canonical has not decided on which chip company will provide the CPU. It will also come with 4GB of working memory, or RAM, which is twice what high-end smartphones now offer.

"By putting more RAM in, we think we can get comfortable performance" on the desktop, Shuttleworth said.

The Ubuntu Edge will contain 128GB of storage. The 4.5 inch, 280 x 720 pixel display will be made from a scratch-resistant sapphire crystal, and it will feature a novel silicon anode battery technology that promises longer charges.

The device will provide high-speed roaming with access to 4G-LTE broadband in both Europe and the U.S. It will also support dual-band 802.11n Wi-Fi, Bluetooth 4, and NFC (near field communication). It will have two cameras, an eight megapixel rear camera and a two megapixel front facing camera.