Application Security //

Database Security

7/19/2016
10:15 AM
100%
0%

Ubuntu Forums Database Hacked

Canonical probe reveals user account details of 2 million stolen, passwords safe.

Ubuntu Forums’ database was recently discovered hacked after Canonical, the company behind Ubuntu, was alerted that someone claimed to have a copy of the Forums database. An investigation revealed that a security breach had exposed usernames, email, and IP addresses for 2 million users. Passwords, however, were not accessed. 

Canonical explained in a blog: "No active passwords were accessed; the passwords stored in this table were random strings as the Ubuntu Forums rely on Ubuntu Single Sign On for logins. The attacker did download these random strings (which were hashed and salted)."

The company further explained that the breach was due to a SQL injection vulnerability in the platform which powers the forum and which had not been patched.

“The attacker had the ability to inject certain formatted SQL to the Forums database on the Forums database servers…. This gave them the ability to read from any table, but we believe they only ever read from the ‘user’ table,” says Canonical.

The website was shut down as a precautionary measure and the server wiped clean and rebuilt.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PAKIKO
50%
50%
PAKIKO,
User Rank: Apprentice
11/16/2016 | 5:47:46 AM
security and protections
Database security it is responsible to ensure all access in the whole system with real protections.
LeviB623
50%
50%
LeviB623,
User Rank: Apprentice
10/14/2016 | 2:09:11 AM
How to database security ?
DataSunrise Data and Database Security, high-performance software solution for databases and data real-time protection in heterogeneous environments.
LeviB623
50%
50%
LeviB623,
User Rank: Apprentice
9/28/2016 | 6:01:17 AM
database security
data security services is a platform against malware and other attacks like Sql injection . You can buy online security for you large scale data from our website.DataSunrise Database Security,  real-time protection in heterogeneous environments.  Visit Here:-  https://www.datasunrise.com/
arafata636
100%
0%
arafata636,
User Rank: Apprentice
9/1/2016 | 9:15:04 AM
Re: Correct- but what about the authrized entities such as DBA.
Database Forensic (DBF) is a field of digital forensic investigation which deals with database contents and their metadata. It is considered as a significant field by which to identify, detect, acquire, analyse, and reconstruct database incidents and reveal an intruder's activities.  DBF has suffered from several issues which have resulted in it becoming a heterogeneous, confusing and unstructured domain. Examples of these issues include:  a variety of database systems infrastructure; the multidimensional nature of database systems; and domain knowledge effectively being scattered in all directions.  A variety of database systems infrastructures with multidimensional nature have enabled the DBF domain to be able to deal with specific incidents. Therefore, each database management system (DBMS) has a specific forensic investigation model/approach. Consequently, the issues of different concepts and terminologies in terms of forensic investigation process, as well as the scattering of domain knowledge in all directions have produced other challenges for DBF investigators and practitioners. This knowledge (such as models, processes, techniques, tools, frameworks, methods, activities, approaches, and algorithms) is neither organized nor structured, Further, it is universally dispersed such as in: the internet;  books, journals, conferences, online databases, book chapters, dissertations, reports, and organizations. Consequently, there is a lack of generic/standardized models by which to unify concepts and terminologies which may be used to reduce confusion and assist in organizing and structuring domain knowledge. This study discusses the DBF domain from several perspectives in order to highlight, extract, compare, merge and derive common concepts of domain, as well as to harmonize and reconcile concepts and definitions such as:  i) Database dimensions perspective; ii) Database ForensicTechnology perspective; and  iii) Database Forensic Investigation process perspective.
LeviB623
100%
0%
LeviB623,
User Rank: Apprentice
8/25/2016 | 1:24:39 AM
database security
A DBMS typically includes a database security and authorization subsystem that is responsible for ensuring the security portions of a database against unauthorized access.The security mechanism of a DBMS must include provisions for restricting access to the database as a whole. 
Devastating Cyberattack on Email Provider Destroys 18 Years of Data
Jai Vijayan, Freelance writer,  2/12/2019
Up to 100,000 Reported Affected in Landmark White Data Breach
Kelly Sheridan, Staff Editor, Dark Reading,  2/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8360
PUBLISHED: 2019-02-16
Themerig Find a Place CMS Directory 1.5 has SQL Injection via the find/assets/external/data_2.php cate parameter.
CVE-2019-8361
PUBLISHED: 2019-02-16
PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might, for example, be leveraged for HTML injection or URL redirection.
CVE-2019-8362
PUBLISHED: 2019-02-16
DedeCMS through V5.7SP2 allows arbitrary file upload in dede/album_edit.php or dede/album_add.php, as demonstrated by a dede/album_edit.php?dopost=save&formzip=1 request with a ZIP archive that contains a file such as "1.jpg.php" (because input validation only checks that .jpg, .png, o...
CVE-2019-8363
PUBLISHED: 2019-02-16
Verydows 2.0 has XSS via the index.php?c=main a parameter, as demonstrated by an a=index[XSS] value.
CVE-2019-8358
PUBLISHED: 2019-02-16
In Hiawatha before 10.8.4, a remote attacker is able to do directory traversal if AllowDotFiles is enabled.