DEF CON forums down, possibly hacked

A hacking group has claimed to have breached the DEF CON forums using a zero-day vulnerability in proprietary internet message board software vBulletin.

The website was taken down as a pre-emptive measure after the vBulletin zero-day vulnerability emerged online for sale.

But hacker group selling the zero-day claimed in a tweet that it had already broken into the site and stolen a website backup.

Inj3ct0r Team closed http://t.co/PG2PW5QguP powered by Vbulletin. You are late, we made a backup sites that we care about you too. LOL

— inj3ct0r (@inj3ct0r) November 18, 2013

“Very recently, our security team discovered sophisticated attacks on our network, involving the illegal access of forum user information, possibly including your password,” vBulletin technical support lead Wayne Luke said.

“Our investigation currently indicates that the attackers accessed customer IDs and encrypted passwords on our systems. We have taken the precaution of resetting your account password.”

The crackers claimed they also breached more than 800,000 MacRumors Forums accounts.

“We got shell, database and root server," the group wrote on Facebook. 

"We found a critical vulnerability in vBulletin all versions 4.x.x and 5.x.x. We've got upload shell in vBulletin server, download database and got root. MacRumors.com was based on vBulletin CMS. We use [zero-day] exploit on vBulletin, got password moderator.”

The group may have sold the remote code execution vulnerability for $US7000 in Bitcoins or WebMoney with 15 Bitcoins transferred to the Inj3ct0r Team Bitcoin address on 15 November.

“We wanted to prove that nothing in this world is not safe,” Inj3ct0r Team posted on its Facebook page. “The network security is a myth.”

Copyright © SC Magazine, Australia