Forum Hacked - Password Harvesting Plugin Installed

[mawby]

I spotted a plugin installed on my site today which I didn't recognise. It was named "Database Optimization", had vBulletin as the product, and was hooked into login_verify_success. The plugin was only a few lines of code, but it sent an email containing the users username and password everytime they logged into the forum!

After some investigations we've found that this hack started sending emails on the 17th at 4am GMT. At this time our server was running 3.6.4, with all released security fixes installed. We upgraded to 3.6.7 yesterday after a required PHP upgrade was done. At this point the hack no longer sent the users password out, so I presume a fix has been made to prevent plugins gaining access to the users passwords now.

However, I'm making this post firstly to alert others to the possible problem, but also to ask if anyone else has suffered from this type of hacking and does anyone know how it was done so I can try and make sure it doesn't happen again?

We had the following plugins installed;

'Version check' for all hacks
Ban Thread User
CSS Signature Size Enforcer
Cyb - Sub-Forum Manager
Extra Thread Fields Lite
Farcaster's Event Attendance
Geek Auto-Link
HELLCATs Realtime Page Compressor
ibProArcade for vBulletin
IpInfo
iTrader
Moderation Auto-PM
Post Edit History
Private Debates
Show Birthday Icon in Postbit
vbAccessDenied
vBadvanced CMPS
vbBannerRotator by Frapegliko
vBDebug Mode
vBPicGallery
Vbulletin World Map Plotter
Welcome Headers
Yet Another Mass Private Message System