Forest Global Training Partners

Cyber Risks · Krebs on Security

Thousands of Sites Hacked Via vBulletin Hole

Summary: Attackers compromised more than 35,000 vBulletin-powered sites by exploiting a weakness that vBulletin maker Jelsoft Internet Brands warned about in late August: failing to remove the "/install" and "/core/install" directories on 4.x and 5.x versions. Imperva said the sites were hit by one of two publicly released exploit tools that add administrator accounts, one named "Th3H4ck" used in a mass defacement campaign and one named "supportvb" that operates with more stealth.

Bottom line: Imperva's Amichai Shulman said the attackers appear to use a botnet to scrape Google for vulnerable forums and inject code, because a single machine gets CAPTCHA-blocked after five or six pages of results. Among the compromised sites was a support forum for the National Runaway Safeline, and many of the defaced sites were also hosting malware.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related