vBulletin Zero-Day Used to Hack Official vBulletin Website and Foxit Software

[Exterminator]

Content source

http://news.softpedia.com/news/vbulletin-zero-day-used-to-hack-official-vbulletin-website-and-foxit-software-495620.shtml

It appears that a zero-day vulnerability in the vBulletin forum package allowed an Egyptian hacker to breach the official vBulletin website and the forums of Foxit Software, which was using vBulletin for its forum section.

The hacker is Mohamed Osama who, as soon as he pulled off the attack, started bragging to @Cyber_War_News on Twitter.

Osama, who also goes by the nickname of Coldroot, went on so far to create a YouTube video of him while hacking vBulletin.com, posting photos on his Facebook profile, and even send images to @Cyber_War_News of the data he acquired in the hack. His YouTube and Facebook posts were eventually deleted.

Egyptian hacker Coldroot claims responsibility
Osama's LinkedIn profile reveals he's a Senior Programmer at Orbit Shield in Dubai, and ironically lists "Cracking" and "Ethical Hacking" as some of his skills.

According to visual evidence that @Cyber_War_News acquired, the hacker managed to break into vBulletin's infrastructure, upload a shell and exfiltrate the company's customer database.

A sample of the database that @Cyber_War_News received confirms that the data contained user IDs, names, email addresses, security questions, their answers, and password salts.

Despite the hacker claiming his intrusion went unnoticed, the breach was detected and discussed by the company towards the end of the past week. At one point, the vBulletin website was put offline for maintenance and continues to be down at the time of this article.

Before going offline, vBulletin's forum stats page listed around 345,000 users. We have contacted the company for a statement.

Foxit Software also hacked, with the same vBulletin exploit
But the bad news doesn't end here. According to the same @Cyber_War_News, after breaching the vBulletin.com website, Coldroot then moved on to the forums of Foxit Software, a company specialized in producing desktop applications.

Foxit was running vBulletin's forum package, and the hacker said he used the same zero-day bug to breach their database, stealing data for around 260,000 customer accounts. Foxit Software forum's statistics section lists over 535,000 accounts.

The hacker claims that the entire Foxit hack took him only two days.

 

[BillR5]

I think exterminator20 is understating the problem (or maybe just assuming we will draw the proper conclusion!): "vBulletin Solutions has reset the passwords for over 300,000 [maybe 345,000?] accounts on its website." Lost data included security questions, answers, and password salts. In addition, Foxit Software, which uses vBulletin's forum package, has had "around 260,000 customer accounts" breached (of 535,000, so maybe more?). "More than 100,000 community websites are using vBulletin, including some operated by Zynga, Electronic Arts, Sony Pictures, NASA, Valve Corporation and other well known companies and organizations," so they may be vulnerable the claimed zero day exploit. 100,000+ forums!

I'll go out on a limb and say that this has the potential to be the biggest _known_ breach after CyberVor's 1.2 billion compromised accounts (which was apparently a collection of breeches over time using a variety of techniques). [Edit: fixed grammar.]

 

[Secondmineboy]

I think exterminator20 is understating the problem (or maybe just assuming we will draw the proper conclusion): "VBulletin Solutions has reset the passwords for over 300,000 [maybe 345,000?] accounts on its website." Lost data included security questions, answers, and password salts. In addition, Foxit Software, which uses VBulletin's forum package has had "around 260,000 customer accounts" (of 535,000, so maybe more) breached. "More than 100,000 community websites are using vBulletin, including some operated by Zynga, Electronic Arts, Sony Pictures, NASA, Valve Corporation and other well known companies and organizations," so they may be vulnerable the claimed zero day exploit. 100,000+ forums! I'll go out on a limb and say that this has the potential to be the biggest _known_ breach after CyberVor's 1.2 billion compromised accounts (which was apparently a collection of breeches over time using a variety of techniques).

In some years you need to update your system minutes after the patch is out or you will get hacked..........
AVs will be pointless. Everyone is using Linux and no longer Windows. You will have a virus every week or so.
At some point you cant open a browser without getting infected.

^^I dont even want to think about such stuff

 

[BillR5]

ERROR - MacRumors was a 2013 breach. Oops. Back to ~480,000 accounts. (What an appropriate name given my own actions.)
Also, some reports have referred to the culprit as Coldroot while others have used ColdZer0.
-----
MacRumors, also a user of vBulletin, suffered a security breach of 860,000 password hashes. If all three breaches included (please, soundly hashed) passwords, then we are already pretty close to 1.5 million, probably including one of mine.

Silver lining? Over the weekend, Coldroot only claimed to have data on 479,895 users. Maybe my password wasn't leaked.

 

[BillR5]

In some years you need to update your system minutes after the patch is out or you will get hacked..........

Then, if not before! vBulletin published a couple of updates Monday. I suspect (guess) that patching, investigation, and fear/abundance-of-caution all contribute to the reported dozens of forums that are/were shutdown.

 

[Ink]

In some years you need to update your system minutes after the patch is out or you will get hacked..........
AVs will be pointless. Everyone is using Linux and no longer Windows. You will have a virus every week or so.
At some point you cant open a browser without getting infected.

That's an extreme viewpoint, and in my opinion unrealistic. More than likely, you will be "hacked" by human error (person behind the screen).

 

[Secondmineboy]

That's an extreme viewpoint, and in my opinion unrealistic. More than likely, you will be "hacked" by human error (person behind the screen).

Thats also an option