core
2019-01-25 10:34:58
Yep, it happened in July 2013, here's the postmortem: http://blog.wizzup.org/blog/villavu-breach
tl;dr: vBulletin has garbage security out of the box, and its devs are ignorant about it.
It was part of a megabreach of vBulletin. You can read some more about it here:
https://krebsonsecurity.com/2013/10/thousands-of-sites-hacked-via-vbulletin-hole/
All of the old passwords were deleted and we forced everyone to do a password reset via their emails. We're now running a patched version of vbulletin where I swapped out the md5(md5(password) + 3 character salt) mess with bcrypt using a long salt, better randomness for salt and password reset generation, and generated reset passwords are now much longer than the default 6 characters.
We've implemented most of Part 6 from Wizzup's post, as well as other improvements on the backend that are not mentioned.
Happy to answer any questions you have to the extent that I can. You check if you've been compromised here: https://haveibeenpwned.com/
tl;dr: vBulletin has garbage security out of the box, and its devs are ignorant about it.
It was part of a megabreach of vBulletin. You can read some more about it here:
https://krebsonsecurity.com/2013/10/thousands-of-sites-hacked-via-vbulletin-hole/
All of the old passwords were deleted and we forced everyone to do a password reset via their emails. We're now running a patched version of vbulletin where I swapped out the md5(md5(password) + 3 character salt) mess with bcrypt using a long salt, better randomness for salt and password reset generation, and generated reset passwords are now much longer than the default 6 characters.
We've implemented most of Part 6 from Wizzup's post, as well as other improvements on the backend that are not mentioned.
Happy to answer any questions you have to the extent that I can. You check if you've been compromised here: https://haveibeenpwned.com/