Hackers use zero-day vulnerability to breach vBulletin support forum

[InfoSec News <alerts () infosecnews org>]

http://www.computerworld.com/s/article/9244109/Hackers_use_zero_day_vulnerability_to_breach_vBulletin_support_forum

By Lucian Constantin
IDG News Service
November 18, 2013

A group of hackers claim to have exploited an undocumented vulnerability 
in the vBulletin Internet forum software in order to break into the 
MacRumors.com and vBulletin.com forums.

On Friday, vBulletin Solutions, the company behind the vBulletin software, 
reset the passwords for all accounts on the vBulletin.com support forums 
after confirming that hackers broke into its systems and stole customer 
log-in credentials.

"Very recently, our security team discovered sophisticated attacks on our 
network, involving the illegal access of forum user information, possibly 
including your password," Wayne Luke, the technical support lead at 
vBulletin Solutions, said in a message posted on the forum. "Our 
investigation currently indicates that the attackers accessed customer IDs 
and encrypted passwords on our systems."

Luke advised users to choose a new password that they're not using on any 
other websites.

[...]



--
Dean Bushmiller teaches a great 5-Day CISM in Albany NY Dec. 2  6.
Call 327-937-9786 for details.