來自歐洲的駭客組織Inj3ct0r Team上周五（11/15）透過Facebook表示，他們利用vBulletin最新版本的漏洞攻陷了Macrumors.com與vBulletin.com，而且自vBulletin伺服器下載了資料庫，vBulletin則證實被入侵、客戶資料外洩，因而呼籲用戶更新密碼。
vBulletin是由Internet Brands所開發的內容管理系統，一般被歸類為論壇管理系統。vBulletin是以PHP撰寫並使用MySQL資料庫，最新的版本是今年9月24日釋出的vBulletin 5.0.5版。
根據Inj3ct0r的說法，他們是透過vBulletin的零時差漏洞進行攻擊，這是個重大漏洞，使他們得以存取介面、資料庫，與根伺服器，而且影響vBulletin 4.x.x與5.x.x的所有版本。被駭的知名網站Macrumors.com剛好是採用vBulletin的內容管理系統，他們竊取了86萬名的用戶資訊，包含用戶名稱、電子郵件與加密的密碼。Macrumers也發表了道歉聲明。
vBulletin在同一天發表聲明，表示該站的安全團隊發現針對該站網路的複雜攻擊，有駭客非法入侵使用者資料庫，初步調查顯示駭客存取了客戶的名稱與加密的密碼，因此呼籲用戶重新設定密碼。
Inj3ct0r Team hacked vBulletin.com and Macrumors.com
Inj3ct0r Team hacked the big CMS vendor vBulletin.com
We got shell , database and root server. We wanted to prove that nothing in this world is not safe.
We found a critical vulnerability in vBulletin all versions 4.x.x and 5.х.x
We've got upload shell in vBulletin server, download database and got root.
All those wishing to buy a vulnerability and patch your forum :http://1337day.com/exploit/description/21518
proof image shell + database vBulletin.com:
http://1337day.com/img/exploits/4477f884c0f35e468c6a79d12a1ff663_1301380320.jpg
http://1337day.com/img/exploits/1b89aedb1ea392229094a73d12073b44_347699806.jpg
Macrumors.com was based on vBulletin CMS. We use 0day exploit on vBulletin, got password moderator. 860000 hacked too.
The network security is a myth
Yesterday, the MacRumors Forums were targeted and hacked in a similar manner to the Ubuntu forums in July. We sincerely apologize for the intrusion, and are still investigating the attack with the help of a 3rd party security researcher. We believe that at least some user information was obtained during the attack.
In situations like this, it's best to assume that your MacRumors Forum username, email address and (hashed) password is now known. While the passwords are "hashed" (which is a one-way conversion from your actual password to a scrambled version), given computing power these days, if your password isn't very complex, they could brute force figure it out by trying lots of combinations.
What this means for you, if you have a MacRumors Forums account, is the following:
1. Change your password on our forums. If you have any problems, please contact us.
2. If you used the same password on any other site, change it there also.
There are several guides online for how to choose a good password. Also, you should generally keep separate passwords for every service, for situations just like this. To help manage distinct passwords for every website, you can use a password manager such asLastpass or 1Password.
Canonical provided a post-mortem of the Ubuntu forums attack on their blog. Our case is quite similar, with a moderator account being logged into by the hacker who then was able to escalate their privileges with the goals of stealing user login credentials.
We are still working to get the forums fully functional and more secure. Again, we are very sorry for the breach.
Why did I not get an email sooner?
According to our email service, sending such a large burst of email in one day to all of our users will result in many of those emails getting automatically blocked. As such, we are sending emails out over time to ensure they reach your inbox.
Important Message Regarding Your Account
We take your security and privacy very seriously. Very recently, our security team discovered sophisticated attacks on our network, involving the illegal access of forum user information, possibly including your password. Our investigation currently indicates that the attackers accessed customer IDs and encrypted passwords on our systems. We have taken the precaution of resetting your account password. We apologize for any inconvenience this has caused but felt that it was necessary to help protect you and your account.
To regain access to your account:
- Visit the vBulletin forums at http://www.vbulletin.com/forum/settings/account
- Enter in your existing password followed by your new password, twice for confirmation.
- Save this page at the bottom.
If you have any additional questions or concerns, please feel free to contact our support team at http://www.vbulletin.com/go/techsupport or support@vbulletin.com
Sincerely,
Wayne Luke,
vBulletin Lead Technical Support.
vBulletin（有時簡稱為vB，vBB）是一個商業論壇程式。由Internet Brands及vBulletin Solutions開發及銷售，它使用PHP指令碼語言編寫，並以MySQL為資料庫。
版本
vBulletin 目前主要分成三種版本：
- SUITE版：包含討論區、內容管理系統（CMS）及部落格等三大產品，售價285美元。
- FORUM版：僅有討論區，售價195美元。
- MOBILE版：產生供行動裝置瀏覽的網頁程式，需有上述兩版本之一搭配使用，售價199美元。
以上金額為永久使用權，並提供一年內版本更新。
哇哈哈～誰叫MacRumors網站要使用又貴又老舊的vBulletin程式來架網站！
不過phpBB雖然免費，但同樣也是極為老舊，這兩個都已經完全跟不上時代！
