Forum software vendor vBulletin breached - apparently by vBulletin hack

Filed Under: Data loss, Featured

According to its own website, vBulletin is "the world's leading community software," and many forums, message boards and social networking sites use it.

From time to time, vulnerabilities in vBulletin make the headlines because they catch out vBulletin customers who haven't patched in time (or who are unlucky enough to be the first victims of a new security hole).

For example, the Ubuntu Forums website was taken over back in July 2013, and popular Apple-related site Macrumors was breached just last week.

Both of those sites, it seems, were vBulletin users.

Another high-profile vBulletin user, of course, is vBulletin itself...

...and you can probably guess where this is going.

You wouldn't know anything was amiss from vBulletin's main page, but a visit to vBulletin's own forum reveals the sort of message that every forum operator hopes never to have to write:

Important Message Regarding Your Account

Often, what comes up when you click through to the message itself is the sort of platitude that call centres use when they claim "your call is important." (So important that it has just been placed in a lengthy queue rather than actually answered.)

And vBulletin fell into that verbiage trap:

We take your security and privacy very seriously.

A touch of customer-facing advice, if I may.

If you are about to apologise to your customers for having been bad at security, don't start off by praising yourself for being good at it.

Start off by apologising for having been bad at it.

Very recently, our security team discovered sophisticated attacks on our network, involving the illegal access of forum user information, possibly including your password.

You don't need to use the word sophisticated.

It's cold comfort to your customers, and all it really means is that you were less sophisticated than the crooks.

That doesn't bode well for any claims you may make about defending successfully the next time there's an attack.

Just say that you detected a breach, though sadly only after it had taken place.

Our investigation currently indicates that the attackers accessed customer IDs and encrypted passwords on our systems.

Avoid saying the passwords were encrypted if they were hashed.

The last company that admitted its stolen passwords were "encrypted" was Adobe, and that didn't end well. (The passwords were encrypted, rather than hashed, all with the same key, and in such as way that repeated passwords produced repeated ciphertext.)

Also, tell your customers how you hashed their passwords so they can form their own opinion about how likely it is that a cracker might recover those passwords by trial and error.

For example, the Ubuntu Forums hacker claimed that the stolen passwords in that breach were "encrypted [sic] with the default vBulletin hashing algorithm (md5(md5($pass).$salt)", which means just two single-block MD5 calculations for every password trial.

Modern password crackers costing no more than $20,000 can compute hundreds of billions of MD5s per second.

The breach notification ends like this:

Please choose a new password and do not use the same password you used with us previously. We also highly recommend that you chose [sic] a password that you are not using on any other sites.

That's good advice, and given that vBulletin has just apologised for poor security of its own, I can fully understand why the company wasn't more forceful here.

However, I'll be more forceful on vBulletin's behalf:

Do not chose a password that you are using on any other site. ONE ACCOUNT, ONE PASSWORD.

, , ,

You might like

One Response to Forum software vendor vBulletin breached - apparently by vBulletin hack

  1. Rory · 336 days ago

    I recieved that email but found it strange the way vbulletin contacted me, so i ignored it. Just aswell i did as god knows what would have happened to my vbulletin forum. My forum was hacked in july, along with thousands of others and i learned my lesson then, I do not click links sent to me by email and do a google search on everything. If in dought, throw it out.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Paul Ducklin is a passionate security proselytiser. (That's like an evangelist, but more so!) He lives and breathes computer security, and would be happy for you to do so, too. Paul won the inaugural AusCERT Director's Award for Individual Excellence in Computer Security in 2009. Follow him on Twitter: @duckblog