Hackers claim they used zero-day vulnerability to breach vBulletin support forum

The hackers say they hacked the forum of vBulletin user MacRumors.com using the same exploit, which is now up for sale

A group of hackers claim to have exploited an undocumented vulnerability in the vBulletin Internet forum software in order to break into the MacRumors.com and vBulletin.com forums.

On Friday, vBulletin Solutions, the company behind the vBulletin software, reset the passwords for all accounts on the vBulletin.com support forums after confirming that hackers broke into its systems and stole customer log-in credentials.

"Very recently, our security team discovered sophisticated attacks on our network, involving the illegal access of forum user information, possibly including your password," Wayne Luke, the technical support lead at vBulletin Solutions, said in a message posted on the forum. "Our investigation currently indicates that the attackers accessed customer IDs and encrypted passwords on our systems."

Luke advised users to choose a new password that they're not using on any other websites.

The announcement came a day after a group of hackers calling themselves the Inj3ct0r Team announced in a post on Facebook that they compromised the vBulletin.com and MacRumors.com forums.

Inj3ct0r Team claims to have found and exploited a previously unknown -- zero-day -- remote code execution vulnerability affecting all versions of vBulletin 4 and 5 and which allowed them to upload a Web shell on the vBulletin.com server, gain root access to it and download the site's database.

VBulletin Solutions did not immediately respond to a request for comment regarding the claims of a zero-day vulnerability existing in vBulletin.

The hackers said they exploited the same vulnerability to obtain the password of a moderator on the MacRumors.com forum, which uses the vBulletin software, allowing them to obtain the log-in credentials for that forum's 860,000 users.

The MacRumors.com administrators announced Tuesday that the site had been compromised and warned their users that "while the passwords are 'hashed' (which is a one-way conversion from your actual password to a scrambled version), given computing power these days, if your password isn't very complex, they could brute force figure it out by trying lots of combinations."

Inj3ct0r Team put the new vBulletin exploit up for sale on its website for the equivalent of US$7,000 payable through WebMoney or Bitcoin. Ironically, the hackers say on their website that "we don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegally other users or websites that you don't have right to access will be banned and your account including your data will be destroyed."

Some website administrators have already reacted to the news. The community forums for the DefCon hacking conference have been temporarily shut down, with administrators informing users that "we have disabled the forums until there is resolution on a possible vulnerability."

According to vBulletin Solutions, over 100,000 community websites are running on vBulletin, including some operated by Zynga, Electronic Arts, Sony Pictures, NASA, Valve Corporation and other well known companies.

UbuntuForums.org, a community website for the Ubuntu Linux distribution with over 1.8 million registered accounts, is also using vBulletin and was hacked back in July. The MacRumors administrators described the recent compromise of their forum as similar to the UbuntuForums.org hack.

Join the CSO newsletter!

Error: Please check your email address.

Tags intrusiononline safetysecuritydata breachvBulletin SolutionsExploits / vulnerabilitiesprivacy

More about FacebookLinuxNASASonyUbuntuZynga

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place