[Forum] 10 vBulletin Forums Hacked Last Night

[hacksden]

This hacker chose 10 forums to take down last night and was successful in doing so with all of them. The only thing the forums had in common is that they were all using vbulletin. This is obviously a security flaw in the software and it hasn't been fixed as of the 4.1.4 update (which I was running). My forum was one of the 10 victims of this attack and I believe this was achieved by cracking the stored MD5 hash for my admin password.

This is a serious issue which needs investigation. I'm more than willing to help any way possible but I stress the fact that vb developers must fix this before there are more attacks.

[Trevor Hannant]

What modifications are you running? Have you got proof frm logs that they hacked it via a default script?

[Ramsesx]

That's what google cache told:
4.1.3 vBSEO 3.6.0 RC 2
4.0.2 forum.seo.com
4.1.3 SEO by vBSEO
4.x
4.1.2 vBSEO 3.5.0 RC2
4.1.0
4.x
4.1.1
4.x
4.1.4

Some have vbseo but not all. There must be a strange securtiy issue.

[PondPikey]

Same problem...

[Ramsesx]

Same problem...

This link gives me a malware warning, don't recommend to click it.

[PondPikey]

Apologies, removed link.

Damn I am so angry at the moment. REMOVED vbulletin. Steaming pile of poo.

[Trevor Hannant]

Apologies, removed link.

Damn I am so angry at the moment. REMOVED vbulletin. Steaming pile of poo.

Yes, of course it is...

[borbole]

From that list almost all forums are running older version of vb. Anyway, I don''t think there is any known security issue found with the latest version of vb otherwise it would have been all over the net by now.

For those that were hacked, it would be best to submit a ticket at the vb customer area and at their hosts too so both options are investigated.

[Loco.M]

it's it ironic that most those sites are hacking sites themselves, or warez sites..

[Maurd]

I highly advise everyone NOT to click any of the links in Ramsesx's post (#3). The 'GlobalSecurity' link must contain a hidden iframe because after visiting that link three unknown processes where created on my system. It's using Java for the processes which leads me to believe it's probably a part of the blackhole exploit going around ever since the kit was released for free.

The browser was latest stable Chrome.

[Reeve of Shinra]

crazy stuff

[hacksden]

What modifications are you running? Have you got proof frm logs that they hacked it via a default script?

The mods we were running were:

[AJAX] Post Thank You Hack
DownloadsII
[YUI] VSQ - Spoiler
Yet Another Awards System
[Mod-Mall] Google +1 - Googles 'like' equivilent
[v.4.5] MARCO1 Advanced Quick Reply - Advanced Quick Edit - With Smiles!!
Lightweight Style Options for "Lightweight Style
Display Unread Posts and Reputation Comments
VB4 - Mobile Phone / iPhone / PDA Detection and Style Assignment
VSA-Advanced Forum Rules

I'll have to get back to you on the logs.

[meeja]

Advanced Forum Rules did have a security which was patched on May 18th - it's imperative that users mark plugins as installed on vbulletin.org so they know when an exploit is found and patched. If you don't upgrade to the latest patch, it's your fault, not vbulletin's.

[Trevor Hannant]

The mods we were running were:

[AJAX] Post Thank You Hack
DownloadsII
[YUI] VSQ - Spoiler
Yet Another Awards System
[Mod-Mall] Google +1 - Googles 'like' equivilent
[v.4.5] MARCO1 Advanced Quick Reply - Advanced Quick Edit - With Smiles!!
Lightweight Style Options for "Lightweight Style
Display Unread Posts and Reputation Comments
VB4 - Mobile Phone / iPhone / PDA Detection and Style Assignment
VSA-Advanced Forum Rules

I'll have to get back to you on the logs.

Are you running fully up to date versions of these, in particular the final one?

[Paul M]

[/URL]VSA-Advanced Forum Rules
[/B]

A big [nasty] security hole was found in that, fixed in mid-may, if you didnt have the latest version they could easily hack you.