Vbulletin 4.2.0 Hacked?

[rockerzteam]

Looks like a vulnerability have been found in 4.2.0.... A few websites running it have been hacked and taken down by this group.

XXXXXX hacked by trading-network.to
best german underground forum <3
REGARDS bizznez

Anyone know of these unexplained attacks?

[Lynne]

Were they running 4.2.0PL2?

[rockerzteam]

They had all the updated patches installed waiting for a response from them.....

[Lynne]

Find out if they were running any modifications also. And, make sure they check their access_logs to see what actually happened.

[rockerzteam]

How ever they got in they were able to obtain a full database backup,users,passwords,and delete all files from there FTP.

[borbole]

How ever they got in they were able to obtain a full database backup,users,passwords,and delete all files from there FTP.

If they deleted all the files through Ftp then it looks like the point of entry is not vb itself but some other third party stuff.

[Lynne]

Yeah, they got in through the server if they were able to take a database backup, and download it, and delete files.

[rockerzteam]

Very strange. With the amount of security and difficulty they put into a generated password i find this scary for the rest of us.

[kh99]

How ever they got in they were able to obtain a full database backup,users,passwords,and delete all files from there FTP.

I'm curious, how do you know exactly what they were able to get? And when you say "from FTP", do you mean you know they did it via ftp?

[Lynne]

Very strange. With the amount of security and difficulty they put into a generated password i find this scary for the rest of us.
You really haven't told us enough for us to say it was a matter of someone hacking the password. If they are on a shared server, it could have been through another account. If their own computer was compromised, their password could have been grabbed that way. It's really impossible to tell exactly how this happen with the little information given.

[borbole]

Indeed, without more info it is hard to know what exactly happened. All one can do is to guess and speculate. But that Ftp thing leads me to believe that it might have been a gumblar type of attack. Anyway, the thing is that there is no reason for panic that there is a security issue with the latest version of vb. Because if it was, then more forums would have been hacked and news would have been all over the net.

[nhawk]

This is the exact reason I don't deal with shared hosting, and why on every server I manage FTP and SSH is either limited access by IP address or is not accessible on the public IP for the servers.