vBulletin.com Forums Hacked

[Dakoom]

http://www.vbulletin.com/forum/
Hacked By Coldzer0

well... happy hackerween!

 

[Deimos]

Oh dear...

 

[highlander29]

Uh oh. At least it's VBulletin 5

 

[batpool52!]

*grabs popcorn and tomato soup*

 

[Deimos]

To the hacker...

 

[Danielx64]

Now putting that login box into an Iframe was a bad idea wasn't it?

 

[highlander29]

Any votes as to whether it started with:
A. Phishing, watering hole, drive by download, etc. - targeting someone with admin credentials or
B. Software vulnerability on the site
C. Both
D. Other

 

[Dakoom]

I think B!

 

[49er]

It never happened ..

 

[Danielx64]

Any votes as to whether it started with:
A. Phishing, watering hole, drive by download, etc. - targeting someone with admin credentials or
B. Software vulnerability on the site
C. Both
D. Other

I wouldn't be surprise if it was B.

 

[zappaDPJ]

Has anyone made a JIRA entry yet?

 

[Dakoom]

In the next days I'll upload my vB 3.8.9 forum to my server. Should I be worried?

 

[Deimos]

Has anyone made a JIRA entry yet?

And if so, have you all voted? We all know the most voted for items get priority!

 

[lol12345]

Interesting

 

[VICE]

The hacker must be well aware of the vulnerability for quite some time and are just waiting for the right time for the bang.

Any votes as to whether it started with:
A. Phishing, watering hole, drive by download, etc. - targeting someone with admin credentials or
B. Software vulnerability on the site
C. Both
D. Other

Most likely B.
A is somewhat impossible since they only have limited developers for the software (more controlled access).

Has anyone made a JIRA entry yet?

Can't do that without forum access, at least for ordinary user, AFAIK.

 

[ozzy47]

Well I am sure super Joe will blame it on some old thing that has been on the server since the vB2 days.

 

[Danielx64]

Well I am sure super Joe will blame it on some old thing that has been on the server since the vB2 days.

What about Paul M?

 

[ozzy47]

Paul has been quiet as of late. I think he is still on holiday.

 

[highlander29]

Most likely B.
A is somewhat impossible since they only have limited developers for the software (more controlled access).

Not to diminish the likelihood of B (e.g., SQLI etc.), but A is how a lot of breaches are starting these days at large companies. They introduce malware on a person's computer who has administrative or root access and then they have access to whatever that person has access to. It's a lot simpler than some other approaches. Is the code base for VB5 at all similar to VB4 or 3? I know it could be a plug-in or any other software but am just curious.

 

[Danielx64]

Maybe it was done via that ipv6 issue that was talked about in another topic.