Server Hacking Against vBulletin Users Escalates Following Emergency Patch

The company behind the popular vBulletin forum software may have patched a security hole discovered a few weeks ago, but that hasn’t prevented cybercriminals from going on a server hacking spree, according to researchers.

In a posting on its Security Response blog, experts at Symantec said server hacking attempts aimed at vBulletin users reached a high of 2,500 in a single day in hopes of exploiting a remote code execution vulnerability. Attackers are apparently downloading malicious shell scripts to steal system and network data on machines running 5.1.4 through 5.1.9 of vBulletin 5 Connect.

As SecurityWeek explained, these attempts are well worth cybercriminals’ efforts: The machines in question are often being used for high-traffic websites that can be either manipulated for distributed denial-of-service (DDoS) attacks or offered at a high price to the black market for other purposes. This could include sending out malware or stealing data from unsuspecting users.

The vBulletin security issue first came to light in early November, forcing the company to take its own site down for maintenance and issue an emergency patch. At the time, Ars Technica reported a data breach that exposed thousands of user IDs, which prompted a complete mandatory reset of all customer passwords.

An attacker using the name Coldzer0 claimed to have used the vulnerability to launch zero-day attacks against vBulletin users. As a result, Coldzer0’s posts on social media may have led others to pursue their own server hacking attempts. That said, vBulletin has not yet linked the zero-day attack to the vulnerability for which the patch was issued.

Ironically, vBulletin is a particularly popular forum tool for those in the security community, including the organizers of well-known industry gathering DEF CON. According to Silicon Angle, DEF CON had shut down its forums when the vulnerability first surfaced, and it’s unknown whether it is among those subjected to server hacking attempts.

In general, though, this is a classic situation in which attacks targeting places where many users gather is most likely to happen. Those that use the software and haven’t already applied the patch had better heed Symantec’s warnings as quickly as possible.

Shane Schick

Writer & Editor

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

When ransomware kills: Attacks on healthcare facilities

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

4 trends in software supply chain security

Topic updates