Server Hacking Against vBulletin Users Escalates Following Emergency Patch

The company behind the popular vBulletin forum software may have patched a security hole discovered a few weeks ago, but that hasn’t prevented cybercriminals from going on a server hacking spree, according to researchers.

In a posting on its Security Response blog, experts at Symantec said server hacking attempts aimed at vBulletin users reached a high of 2,500 in a single day in hopes of exploiting a remote code execution vulnerability. Attackers are apparently downloading malicious shell scripts to steal system and network data on machines running 5.1.4 through 5.1.9 of vBulletin 5 Connect.

As SecurityWeek explained, these attempts are well worth cybercriminals’ efforts: The machines in question are often being used for high-traffic websites that can be either manipulated for distributed denial-of-service (DDoS) attacks or offered at a high price to the black market for other purposes. This could include sending out malware or stealing data from unsuspecting users.

The vBulletin security issue first came to light in early November, forcing the company to take its own site down for maintenance and issue an emergency patch. At the time, Ars Technica reported a data breach that exposed thousands of user IDs, which prompted a complete mandatory reset of all customer passwords.

An attacker using the name Coldzer0 claimed to have used the vulnerability to launch zero-day attacks against vBulletin users. As a result, Coldzer0’s posts on social media may have led others to pursue their own server hacking attempts. That said, vBulletin has not yet linked the zero-day attack to the vulnerability for which the patch was issued.

Ironically, vBulletin is a particularly popular forum tool for those in the security community, including the organizers of well-known industry gathering DEF CON. According to Silicon Angle, DEF CON had shut down its forums when the vulnerability first surfaced, and it’s unknown whether it is among those subjected to server hacking attempts.

In general, though, this is a classic situation in which attacks targeting places where many users gather is most likely to happen. Those that use the software and haven’t already applied the patch had better heed Symantec’s warnings as quickly as possible.

Shane Schick

Writer & Editor

The major hardware flaw in Apple M-series chips

3 min read - The “need for speed” is having a negative impact on many Mac users right now. The Apple M-series chips, which are designed to deliver more consistent and faster performance than the Intel processors used in the past, have a vulnerability that can expose cryptographic keys, leading an attacker to reveal encrypted data. This critical security flaw, known as GoFetch, exploits a vulnerability found in the M-chips data memory-dependent prefetcher (DMP). DMP’s benefits and vulnerabilities DMP predicts memory addresses that the…

NIST’s role in the global tech race against AI

4 min read - Last year, the United States Secretary of Commerce announced that the National Institute of Standards and Technology (NIST) has been put in charge of launching a new public working group on artificial intelligence (AI) that will build on the success of the NIST AI Risk Management Framework to address this rapidly advancing technology.However, recent budget cuts at NIST, along with a lack of strategy implementation, have called into question the agency’s ability to lead this critical effort. Ultimately, the success…

Researchers develop malicious AI ‘worm’ targeting generative AI systems

2 min read - Researchers have created a new, never-seen-before kind of malware they call the "Morris II" worm, which uses popular AI services to spread itself, infect new systems and steal data. The name references the original Morris computer worm that wreaked havoc on the internet in 1988.The worm demonstrates the potential dangers of AI security threats and creates a new urgency around securing AI models.New worm utilizes adversarial self-replicating promptThe researchers from Cornell Tech, the Israel Institute of Technology and Intuit, used what’s…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

More from

The major hardware flaw in Apple M-series chips

NIST’s role in the global tech race against AI

Researchers develop malicious AI ‘worm’ targeting generative AI systems

Topic updates