Canonical Under Siege: Ubuntu’s Web Services Face Major Attack

Canonical, the powerhouse behind Ubuntu, has recently revealed that its web infrastructure is experiencing a serious “sustained, cross-border attack.” This situation is impacting a variety of services associated with Ubuntu, including its official site, blog, and possibly its repositories. Users have taken to online forums to share their experiences, indicating that the issues have persisted for several hours, even though Canonical only made a statement about it not too long ago.

In their announcement, Canonical mentioned, “Our web infrastructure is under a sustained, cross-border attack and we are actively working to resolve the situation.” They promised to share updates through their official channels as soon as they can.

One major concern is that the security repository servers at security.ubuntu.com are either running slow or completely down for many users, and attempts to access the site have been unsuccessful. These repositories are crucial for Ubuntu users, as they provide essential security updates and patches.

Adding to the chaos, Canonical has disabled their server status page, which usually helps users track any issues. Instead, they have reiterated their statement about the attack.

This news follows the revelation of a new vulnerability dubbed “Copy Fail.” A cybersecurity firm, Theori, has indicated that this vulnerability allows a simple Python script to compromise setuid binaries across almost all Linux distributions released since 2017. However, it’s still unclear whether this vulnerability is connected to the ongoing attack. Canonical’s description of the situation suggests it might be more of a large-scale DDoS attack rather than a vulnerability exploit. If “Copy Fail” is involved, it could be in a more indirect way, perhaps as a means to halt updates that would patch the weakness.

In a twist, cybersecurity experts at Vercert Analyzer have reported that a hacktivist group known as ‘The Islamic Cyber Resistance in Iraq – 313 Team’ claimed responsibility for the attacks and has sent an extortion message to the Ubuntu team. As of now, we’re waiting for more definitive information from Canonical to understand the full scope of the situation.