How did a user manage to post to a hidden thread?

[HansK]

A few days ago we found a post in one of the threads that has been set as "hidden", so is not visible to the public or to registered users, only admin's can see this thread.

Is there some known hack or security hole in vBulletin 3 that could be exploited?

We are in some litigation at the moment and this particular post relates to this, so finding out how it was achieved will prove that there is subversive activity on our forum. Only registered users have permission to post and this was posted by a standard, registered user.

Thanks

Hans

[Digital Jedi]

I guess it depends on how you "hid" it. Because that's not default vB functionality. Forums can have individual forum permissions, but threads can't. How, exactly, were you hiding such a thread? Was it in an admin only forum, or were you using some kind of modification?

[HansK]

It was hidden through the admin area as a thread that we decided not to use anymore. This was done before any actual posts were made to it, so the "sneaky" post is the only one there. The thread has been in existence for a long time, but never used.

[tbworld]

Originally Posted by Digital Jedi

I guess it depends on how you "hid" it. Because that's not default vB functionality. Forums can have individual forum permissions, but threads can't. How, exactly, were you hiding such a thread? Was it in an admin only forum, or were you using some kind of modification?

Exactly my thinking, but stated more elegantly by @Digital_Jedi

If you were using a hide hack, it may not have been completely hidden from the outside world.

[HansK]

No hack was used at all, the actual "forum" or topic was set to be for Admin only, so suddenly having a new thread in it, was rather surprising.

I apologise for any misinformation earlier, it is actually a "Forum" that was not visible to anyone but Admin, and not a "thread" as I stated earlier.

A new thread was started in the "forum" and I am not sure how that could have happened.

Thanks

[ForceHSS]

So you hid this section with forum permissions if so double check then check user make sure he is set to right group and has no extra groups added if he does check to make sure them groups dont have access to this section.

[HansK]

Thanks for the tip, I have checked all the forum permissions and the only group that can see this forum is Admin and Moderators. The user that posted a thread here, was neither of these and all the other groups are set to "No" for all options.

The post is still there and if I am logged in as a regular user or any other group, I get the message:

Invalid Thread specified. If you followed a valid link, please notify the administrator

This user has now been set to a "restricted" group with very few privileges as we suspect that he may have some hacking skills.

Thanks for any help with this so far.

Hans

[Digital Jedi]

Seems like a very unusual thing to do for a hacker, but I suppose, not impossible. I would also take a close look at my access logs in the Admin CP to see if anyone had a hand in allowing a registered user access, or if someone goofed adjusting forum permissions. Even if it was just for a moment.

[HansK]

Thanks for the feedback. My suspicion is that it is a hack, as the content is related to current litigation and also uses certain information relating to the law suit.

All those that do have the ability to make any changes, are fully aware of the situation and would never make any changes to this user's access, or settings.

Thanks for the information.

Hans

[Digital Jedi]

That they're aware of. But, if as you suspect, there was some hacking involved, it could be something as simple as hacking the password of an admin account. If one of your accounts is compromised, might be a good idea to double check admin logs. Maybe even to have admins change their passwords to something more secure.