is there a user password breach in vbulletin 3.8x ?? (hacker alert)

[Suiram]

is there a user password breach in vbulletin 3.8x ??

one of the BIG sites i go to that uses vb 3.8.4 a few days ago had a "breach", long story short all users got an email (plus forum notice) to change their passwords. ok maybe an isolated incident. (even eva2000 is a mod there and long time user.)

today another forum using vb, specifically codemasters, sent a similar email.
then another site using vb told it's users the same thing. all use vb forums.

what is going on ?
has vb 3.8x been breached ??? should i force a password change for my users ? (small board), shut down for a few days ? anything ?

(had a quick look in announcements and this forum, and found nothing about this. if a post already exists merge or close....)

concerned user,

thanks

i attach the codemasters email since it's generic.

Codemasters Forum Security Update

Dear Codemasters forum member,

Codemasters Online take every step to ensure your accounts are as secure as possible. Unfortunately, it has come to our attention that in the last few days the Codemasters forums were subjected to a hacking attempt which may have compromised account security.

Please pay particular attention to emails you may receive that claim to be from Codemasters and remember that Codemasters will NEVER ask for your passwords or account details. Should you receive any suspicious looking emails, do NOT click any links in them. Please forward any of these emails to [email protected] so that we can deal with them immediately.

Although your CodeM password is not stored on the forums, to increase account security we urge you to immediately update your CodeM password by logging in at www.codemasters.com/codem.

Things you can do to protect your account and your identity
We would like to take this opportunity to share some tips and tricks with you to help you increase your own security. Taking responsibility for your own account security is important and not difficult to do, every precaution you take is one further defence against such attacks

Giving out personal details
Codemasters do not have access to your password and will never ask you for it, so never give it out to anyone.

Never share your account. The sharing of account details is strictly against our terms of service. We cannot be held responsible for anything that results from doing this.

If you suspect your account has been tampered with, you must notify Codemasters immediately

Suspicious e-mails
Some "phishing" scams use e-mail addresses that look very similar to ours but are not correct, for example [email protected]. As you can see, that e-mail address looks real however on closer inspection you can see codemasters is spelled incorrectly.

How to create secure passwords
When creating your passwords, try to use a combination of letters of mixed case and numbers and make the password of at least 8 characters in length. This will make it much more difficult for hackers to guess your password.

Generally if the password is in the dictionary, it will be discovered in a very short period of time.

This Password Strength Checker can give you a visual idea of how strong your password is http://www.microsoft.com/protect/fraud/passwords/checker.aspx

Finally, we would like to remind you of a useful thread in our forums offering additional advice and information that can help to protect your personal data.

[steven s]

That may have been in response to users using their password as their username.

[Suiram]

no, not at all.
look, it could be nothing. but so far, for me, three major forums that all use vb had some "security breach" and the outcome is that they all "strongly recommend" changing the forum passwords.
now what are the chances of a hacker (or team or whatever) hacking three different sites in different countries using different software (as in their server stuff, apache etc...) and security protocols and so on ? and i would guess codemasters should know what they are doing. (for that matter ocau as well. eva's a resident there. you know who eva is right ?) but if it's a vb issue (if), than hacking that is the common denominator even though the servers are probably vastly different and so on.


here's the 1st one. i just emoved some minor "personal" info.

Hi ,

** Apologies if you have recieved this email twice.
** If you have already recieved this email today, you can ignore this one, but please do not ignore the instructions in the previous email.

This is a follow-up email to the news message I posted a couple of days ago on OCAU:

http://www.overclockers.com.au/news.php?id=830170

We're still investigating what happened. However, it is very likely that your OCAU password has been compromised. Therefore please change your OCAU password as soon as possible.

Also, if you use the same password elsewhere, you should probably change those as well. However, please be aware that using the same password on multiple services is a bad idea.

If you have already changed your password since reading the news announcement, you do not need to change it again.

You may be suspicious that this is a "phishing" email, so I won't provide a direct link to the password change form. But here's a link to the main forums page, or you can enter it into your browser manually or choose a bookmark if you do normally.

http://forums.overclockers.com.au

To change your password, enter the forums, choose "UserCP" at top left and then "Edit Email & Password" from the left menu. Check your email is correct, then enter your new password twice and click "Save Changes". Updating your email is optional, but if you do update it, you should recieve an email from the system to confirm we can send to that address ok.

If you have any trouble changing your password or have any other questions, please contact me on @overclockers.com.au. But please be aware that there's not much I can publically say about the incident at the moment. Apologies for the inconvenience.

Thanks

[Trevor Hannant]

The fact that vB, and perhaps moreso that eva2000 have not been saying anything in this thread or generally suggests that this isn't an issue with compromised vB software. Based on that (possibly flawed) assumption, I'd suggest an issue with the hosting that's allowed hackers to gain access to the database itself.