Nokia Developer Forum (vBulletin) Hacked

[vijayninel]

A image put up by the hacker on the forum homepage, mocking Nokia's forum security.

Nokia's developer forum was hacked and defaced yesterday and the forum has been put offline now.

A static HTML page now appears on the forum URL and says that:

Originally Posted by Nokia

During our ongoing investigation of the incident we have discovered that a database table containing developer forum members' email addresses has been accessed, by exploiting a vulnerability in the bulletin board software that allowed an SQL Injection attack. Initially we believed that only a small number of these forum member records had been accessed, but further investigation has identified that the number is significantly larger.

The database table records includes members’ email addresses and, for fewer than 7% who chose to include them in their public profile, either birth dates, homepage URL or usernames for AIM, ICQ, MSN, Skype or Yahoo. However, they do not contain sensitive information such as passwords or credit card details and so we do not believe the security of forum members’ accounts is at risk. Other Nokia accounts are not affected.

We are not aware of any misuse of the accessed data, but we are communicating with affected forum members, though we believe the only potential impact to them may be unsolicited email. Nokia apologizes for this incident.

Though the initial vulnerability was addressed immediately, we have now taken the developer community website offline as a precautionary measure, while we conduct further investigations and security assessments. We hope to get the site back online as soon as possible and will post developments here in the meantime.

This event has made international headlines. I believe Nokia's forum used vBulletin as its forum software (please correct me if I'm wrong) although I am not sure of the version number and modifications to the forum. I wonder if any of you know more about this and how they got compromised.

[BirdOPrey5]

A search of the Google Cache does show they were using some flavor of vBulletin 4.x suite but not their exact version. Could very well be an old version never upgraded since it looks like they did a pretty custom theme- it would have been a pain to upgrade all the time. I'm just speculating form what I can see in the google cache.

[vijayninel]

Originally Posted by BirdOPrey5

A search of the Google Cache does show they were using some flavor of vBulletin 4.x suite but not their exact version. Could very well be an old version never upgraded since it looks like they did a pretty custom theme- it would have been a pain to upgrade all the time. I'm just speculating form what I can see in the google cache.

That was exactly my thought. Although this is speculation I think It was significantly customised and not updated with the latest vBulletin patches/versions due to administrative difficulties.

News is now coming that they have permanently lost some data due to improper backups. This fiasco is a huge loss of face for Nokia and this issue will probably figure at their board meeting.

[Badshah93]

when they got hacked officially ?
according to me, they are hacked from 18 - 19 August. (which my source tells)

And according to hacker they had latest patch vbulletin (which has redirect fix), but i don't think so because hacker generally lies to showoff.

Nokia is such a big company and not using any professional to manage their system is surprising. Even if there was vulnerability, it could be solved within few minutes when forum was hacked.

A admin (whenever he/she is login) should always check plugin manager to see if there is any extra plugin which is added.

[vijayninel]

Originally Posted by Sherif

when they got hacked officially ?
according to me, they are hacked from 18 - 19 August. (which my source tells)

I am not aware of the 18th. Press reports are that they were hacked the day before (28th August).

Edit: One report suggests that the forum was first hacked on the 22nd. http://www.theinquirer.net/inquirer/...eb-site-attack

[TheLastSuperman]

4.1.3 from the cached source code... hate to see this posted .

[BirdOPrey5]

Although Nokia claims it was the fault of the forum, we don't know that for sure. We also don't know if they could be calling it the fault of the forum when it could be the fault of a 3rd party add-on.

I don't see any reason to panic.

[vijayninel]

Two weeks back the same hacker (pr0tect0r) hacked http://www.defence.pk/forums/ which is currently on vBulletin 4.1.5

[TheLastSuperman]

I'm assuming it was lack of proper maintenance (which covers third-party add-ons imo) unless they present a new vulnerability or exploit to vBulletin that is. Of course we all know from the recent PSN network hacking and common sense tells us that the company does not want to own up to such as it would be detrimental, Sony did own up however recently I've read they knew about it to a certain extent and decided to protect one server over another but not trying to derail the thread simply related imo but more here if your interested .