Ubuntu Forums are back up and a post mortem

>>> Hooks in vBulletin are arbitrary PHP code which can be made to run on every page load.

Terrible. Why even allow this. A terrible, horrible cludgy hack.

What I find most sobering about this is that it sounds like were it not for the defacement 6 days after the hack, no one would ever have been any the wiser.

I know that DB-level and web-server-level intrusion detection systems exist - can the HN community comment on what might have detected this particular attack (even if only after-the-fact?).

  >> They used this access to download the ‘user’ table which
  >> contained usernames, email addresses and salted and hashed
  >> (using md5) passwords for 1.82 million users.

Somewhere, oclHashcat makes room temperature rise.

I always suspected forums that don't have read-only or static mode would prove to be a bad choice as knowledge repository. Google queries returned a lot of ubuntuforums links for many ubuntu problems I encountered or random googling I did these past few days.

In the "What We've Done" section, there's no mention of changing the password hashing algorithm away from md5 to bcrypt or PBKDF2.

php, md5, xss. happy