Linux Mint forum database compromised, all users urged to change passwords | Hacker News Reader

Linux Mint forum database compromised, all users urged to change passwords

blog.linuxmint.com

51 pointstemp9 comments

The bigger issue is that the installer .iso images for Linux Mint were backdoored this weekend: http://blog.linuxmint.com/?p=2994

There is no reason to store an encrypted password outside of proxying to another system. Where was the key to the stored password? This forum looks poorly designed from a security perspective.

Clem (the project leader), and his team have created a great distro, but they have made some worrying decisions in the past that have made me question the team.

The DNS Hijack by pre-installing OpenDNS on all installations is one of those cases: https://bugs.launchpad.net/linuxmint/+bug/1133777

I like the distro, too. Though, the patten you mention is very troubling. Thanks for pointing that out.

This is the distribution that turned off updates (security and otherwise) for some packages because something in their convoluted packaging process broke and they couldn't be bothered to find out why. Use at your own peril, I'd say.

Rather than jumping the gun, it'd be better to assume good faith/do a bit of research

> "An encrypted copy of your forums password"

Likely is just a non-technical wording for "Your salted and hashed passwords" (yes, I don't like it either... but keep in mind the audience)

I never used the linuxmint forums, but by looking on the google cache (since the forums are down)

http://webcache.googleusercontent.com/search?q=cache:IxvZKvC...

It's obvious that they're using phpbb. Just like wordpress, and other prominent software written in php it has probably several flaws (security or otherwise), so I'd still steer clear of it... but it's safe to assume that in 2016 a major open source project has learnt how to properly salt and hash their passwords...

In fact, they're using bcrypt:

https://github.com/phpbb/phpbb/tree/3.1.x/phpBB/phpbb/passwo...

I don't know if this is the default hashing algorithm, and if they're properly salting them... it's even possible that linuxmint forums are misconfigured and/or that they're using an old version that defaults on md5.

But even if you use Argon2 or Scrypt, it won't do you any good if you picked

"Password1!"

"onetwothreefourfivesix"

as a password... it _will_ be cracked! (and thus the suggestion of changing passwords that might have been reused on other services is a perfectly good suggestion)

There was no jumping the gun. LM is a technical forum, at least to the degree that the should know the difference between a cipher and a digest.

Regarding your other point, just because someone uses an algorithm doesn't mean that it is used with proper parameters, work factors, etc.

Do no make any assumptions about crypto, "probably using" is not good enough.

The key isn't just what software they were using for the forum, but what version of the software. Most sites that get hacked with these scripts are using woefully outdated versions that have various holes in them, usually because they don't want to have to replace/rewrite modifications or themes.

Based on the date, they might have been using a fairly old version of phpBB 3.

Wait there is a typo in the title. I think you misspelled computer .

Reply on news.ycombinator.com