Password hack of vBulletin.com fuels fears of in-the-wild 0-day attacks
Forums software maker vBulletin has been breached by hackers who got access to customer password data and other personal information, in a compromise that has heightened speculation there may be a critical vulnerability that threatens websites that run the widely used program.
"Very recently, our security team discovered sophisticated attacks on our network, involving the illegal access of forum user information, possibly including your password," vBulletin Technical Support Lead Wayne Luke wrote in a post published Friday evening. "Our investigation currently indicates that the attackers accessed customer IDs and encrypted passwords on our systems. We have taken the precaution of resetting your account password."
The warning came three days after user forums for MacRumors—itself a user of vBulletin—suffered a security breach that exposed cryptographically hashed passwords for more than 860,000 users. When describing the attack, MacRumors Editorial Director Arnold Kim said the compromise in many ways resembled the July hack of the Ubuntu user forums, which also ran on vBulletin.
The speculation that there's a critical vulnerability in vBulletin goes well beyond the compromise of three websites that use the program. On Thursday—more than 24 hours before vBulletin warned of the security breach on its site—members of the Inject0r hacking team published this Facebook post claiming they had hacked vBulletin.com.