FAO webmaster

[Guest]

Have you seen the post in off topic containing member email addresses and passwords?

[E_T_V]

The list only contains e-mail and an encrypted password (which is useless). However not good though.

[Jeff Turbo]

Have you seen the post in off topic containing member email addresses and passwords?

Yes we've all seen it. Unfortunately I personally don't have the know how to fix this

[Beaker]

Who is the webmaster?

It is a serious data protection leak.

If needs be I can do it - I would rather not but I have the know how to do so.

Upgrade licence for vbulletin is £136.71 if you decide to stick with it. My understanding is it is not the best on offer nowadays though.

[Beaker]

What is the news on this?

[Jeff Turbo]

Chris is working on it

[Uhtred]

The list only contains e-mail and an encrypted password (which is useless). However not good though.

despite being hashed and salted there were a handful which I saw were exposed on a forum, and that's not to say more weren't and just not posted.

Mandatory password reset should be in order once the hole is closed.

PS i notice this forum use the tapatalk plugin which increases the attack surface

[Mat_C]

"Hashed and salted"....Hmmm..you know your stuff?? URL please.

>>Mandatory password reset should be in order once the hole is closed.<<

Yes.

[Uhtred]

"Hashed and salted"....Hmmm..you know your stuff?? URL please.

>>Mandatory password reset should be in order once the hole is closed.<<

Yes.

https://insidepro.com/viewtopic.php?...ba2f679354e4a2

For example cbf25a5dfcd27656b9da96bf523bf09e:supertedaPu

It's a simple matter to then cross reference the hash with the original dump to get the email address.

After the colon you can see the exposed password and you will also notice the format includes 3 random letters at the end of the password, that's the 3 character random salt which vBulletin uses.

edit - excellent link if you're interested in knowing more about hashes/salts etc. It does mention there that 3 characters is a bit short for a good salt.

https://crackstation.net/hashing-security.htm#attacks

[Mat_C]

Thanks. Looks like people have been busy with their GPUs / BitCoin ASICs.

We've already gone through googling hashes and pswd resets on the other thread

P.S: I'm OK with the hashing/salting etc. SHA3

[Mat_C]

Seems people even use facebook to post hashes!?

https://www.facebook.com/aymankhalfa...16000458584972

As previously mentioned, In the highly unlikely event that you've re-used your forum password for FB, PayPal etc I would get changing quickly!

EDIT : To clarify, the above only applies if FB/PayPal accounts use the same e-mail as well.

[Beaker]

There needs to be an 'official' mass email via the forum software to notify everyone!

[Chris Y]

Here's what I've done so far:

Updated to vB 3.8.9 latest version - clean install of /forums directory.
Changed mySQL password
Deactivated the blog (unable to update it)
Got rid of photopost_gallery and photopost_classifieds - both vulnerable to attacks and out of date / not forwards compatible.

In particular, I found an exploit / backdoor script within photopost_gallery, from 10th July 2015.

[CaptainNick]

Hi Chris,

How do I delete my account and personal information from your databases entirely?
The Control Panel seems to offer no way to delete an account which is a poor show. :/

Thanks,

Nick

[Chris Y]

Update:

I've also got rid of Tapatalk, just in case it was the attack vector.

Password expiry has been enabled, which means anyone logging on now will be asked to change their password.

And everyone's registered email has been sent a notification of the compromised database.

To answer the question above - vBulletin doesn't provide a way for a user to delete their account so if anyone wants to be removed just reply here or send me a PM and I will delete them (no undo facility!).