Saturday, February 27, 2021
  • Setup menu at Appearance » Menus and assign menu to Top Bar Navigation
Advertisement
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News
No Result
View All Result
NikolaNews
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News
No Result
View All Result
NikolaNews
No Result
View All Result
Home Internet Security

Anonymous researcher drops vBulletin zero-day impacting tens of thousands of sites

September 25, 2019
in Internet Security
Anonymous researcher drops vBulletin zero-day impacting tens of thousands of sites
586
SHARES
3.3k
VIEWS
Share on FacebookShare on Twitter

Image: ZDNet

An anonymous security researcher has published details about a zero-day in vBulletin, today’s most popular internet forum software.

Because of this individual’s actions, security experts are now concerned that the publication of details about this unpatched vulnerability could trigger a wave of forum hacks across the internet, with hackers taking over forum installations and stealing user information in bulk, as a result.

You might also like

Fastest VPN in 2021 | ZDNet

Berlin resident jailed for threatening to bomb NHS hospital unless Bitcoin ransom was paid

Chrome will soon try HTTPS first when you type an incomplete URL

Zero-day details

According to an analysis of the published code, the zero-day allows an attacker to execute shell commands on the server running a vBulletin installation. The attacker doesn’t need to have an account on the targeted forum.

In infosec lingo, this is what security experts call a “pre-authentication remote code execution” vulnerability, one of the worst types of security flaws that can impact a web-based platform.

ZDNet confirmed that this zero-day works as advertised with two different sources.

Unclear if sabotage or failed disclosure

Details about this zero-day have been published on Full Disclosure, a public access mailing list.

It is not uncommon for security researchers to release details about unpatched security flaws when vendors fail to patch a vulnerability that’s been privately reported.

However, at the time of writing, it is unclear if the anonymous researcher reported the vulnerability to the vBulletin team, or if the vBulletin team failed to address this issue in a timely manner, prompting the researcher to go public as a result.

MH Sub I, LLC, the company that commercializes the vBulletin forum software, has not returned a request for comment.

In addition, this could also be an act of intentional malice or sabotage, with the anonymous researcher dropping a zero-day just to hurt a company’s reputation and put its customers at risk.

The researcher published details about this zero-day from an anonymous email service, without revealing their actual email address, so ZDNet wasn’t able to reach out for additional details.

Tens of thousands of vulnerable forums

Despite being a commercial product, vBulletin is today’s most popular web forum software package, with a larger market share than open-source solutions like phpBB, XenForo, Simple Machines Forum, MyBB, and others.

According to W3Techs, around 0.1% of all internet sites run a vBulletin forum. The percentage looks small, but it actually impacts billions of internet users.

This is because, by their nature, forums are designed to collect user information about registered users. While billions of internet sites don’t store any info about users, a handful of online forums could very easily store data on most internet users. Therefore, a market share of 0.1% is actually pretty significant, when we factor in how many users could be registered on these forums.

Google dorks reveal that there are tens of thousands of vBulletin forums running across the internet, as self-hosted installations, or running on vBulletin’s hosting infrastructure. On its website, vBulletin lists some pretty big names as customers, such as Steam, EA, Zynga, NASA, Sony, BodyBuilding.com, the Houston Texans, and the Denver Broncos.

The only good news is that this zero-day only works against vBulletin 5.x forum versions. Forums running earlier versions are safe, if running up-to-date security patches.

If you’re not testing every single company on @Hacker0x01 and @Bugcrowd for this vBulletin 0day RCE, you’re missing out on free money.
*make sure its in scope tho

— uɐpʇou@ ✸ (@notdan) September 24, 2019

Zerodium, a company that buys exploits in web-based software to resell to law enforcement agencies, lists vBulletin remote code execution vulnerabilities in its exploit acquisition program.

This is because many dark web forums, such as those peddling criminal services, malware, or child abuse images, often run on vBulletin forums — and these types of exploits could grant law enforcement agencies access to these illegal forums.

According to the company’s price chart, this type of pre-auth RCE could have gotten the anonymous researcher up to $10,000 in cash rewards, if he only would have contacted the company instead of publishing the exploit online and putting everyone’s forum data at risk.


Credit: Zdnet

Previous Post

ShotSpotter’s Latest U.S. Patent Enables Major Advancement in Machine Learning Accuracy for Its Gunshot Detection Technology Nasdaq:SSTI

Next Post

Machine Learning May Be Faster for Cardiac MRI Scan Analysis

Related Posts

Fastest VPN in 2021 | ZDNet
Internet Security

Fastest VPN in 2021 | ZDNet

February 27, 2021
Berlin resident jailed for threatening to bomb NHS hospital unless Bitcoin ransom was paid
Internet Security

Berlin resident jailed for threatening to bomb NHS hospital unless Bitcoin ransom was paid

February 27, 2021
Chrome will soon try HTTPS first when you type an incomplete URL
Internet Security

Chrome will soon try HTTPS first when you type an incomplete URL

February 27, 2021
Go malware is now common, having been adopted by both APTs and e-crime groups
Internet Security

Go malware is now common, having been adopted by both APTs and e-crime groups

February 27, 2021
Why your diversity and inclusion efforts should include neurodiverse workers
Internet Security

Why your diversity and inclusion efforts should include neurodiverse workers

February 26, 2021
Next Post
Machine Learning May Be Faster for Cardiac MRI Scan Analysis

Machine Learning May Be Faster for Cardiac MRI Scan Analysis

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recommended

Plasticity in Deep Learning: Dynamic Adaptations for AI Self-Driving Cars

Plasticity in Deep Learning: Dynamic Adaptations for AI Self-Driving Cars

January 6, 2019
Microsoft, Google Use Artificial Intelligence to Fight Hackers

Microsoft, Google Use Artificial Intelligence to Fight Hackers

January 6, 2019

Categories

  • Artificial Intelligence
  • Big Data
  • Blockchain
  • Crypto News
  • Data Science
  • Digital Marketing
  • Internet Privacy
  • Internet Security
  • Learn to Code
  • Machine Learning
  • Marketing Technology
  • Neural Networks
  • Technology Companies

Don't miss it

Fastest VPN in 2021 | ZDNet
Internet Security

Fastest VPN in 2021 | ZDNet

February 27, 2021
Increasing Adoption of Informatics will Promote Growth of Data Analytics Outsourcing Market
Data Science

Increasing Adoption of Informatics will Promote Growth of Data Analytics Outsourcing Market

February 27, 2021
MindMed Closes Acquisition of HealthMode, a Leading Machine Learning Digital Medicine Company
Machine Learning

MindMed Closes Acquisition of HealthMode, a Leading Machine Learning Digital Medicine Company

February 27, 2021
How AI Can Be Used in Agriculture Sector for Higher Productivity? | by ANOLYTICS
Neural Networks

How AI Can Be Used in Agriculture Sector for Higher Productivity? | by ANOLYTICS

February 27, 2021
Berlin resident jailed for threatening to bomb NHS hospital unless Bitcoin ransom was paid
Internet Security

Berlin resident jailed for threatening to bomb NHS hospital unless Bitcoin ransom was paid

February 27, 2021
The Ethereum Virtual Machine (EVM)
Data Science

The Ethereum Virtual Machine (EVM)

February 27, 2021
NikolaNews

NikolaNews.com is an online News Portal which aims to share news about blockchain, AI, Big Data, and Data Privacy and more!

What’s New Here?

  • Fastest VPN in 2021 | ZDNet February 27, 2021
  • Increasing Adoption of Informatics will Promote Growth of Data Analytics Outsourcing Market February 27, 2021
  • MindMed Closes Acquisition of HealthMode, a Leading Machine Learning Digital Medicine Company February 27, 2021
  • How AI Can Be Used in Agriculture Sector for Higher Productivity? | by ANOLYTICS February 27, 2021

Subscribe to get more!

© 2019 NikolaNews.com - Global Tech Updates

No Result
View All Result
  • AI Development
    • Artificial Intelligence
    • Machine Learning
    • Neural Networks
    • Learn to Code
  • Data
    • Blockchain
    • Big Data
    • Data Science
  • IT Security
    • Internet Privacy
    • Internet Security
  • Marketing
    • Digital Marketing
    • Marketing Technology
  • Technology Companies
  • Crypto News

© 2019 NikolaNews.com - Global Tech Updates