vBulletin Solutions, Inc. has issued an urgent reset of the passwords for its over 300,000 accounts following a breach by hackers that exposed the IDs of hundreds of thousands of users.

The hacker who claimed responsibility for the hack used a zero-day vulnerability to access the site, with mixed reports claiming that at least for a brief period the main page for the company was defaced.

According to The Register, vBulletin.com was taken down for maintenance in the immediate aftermath of the attack, which took place on Saturday, October 31st.

vBulletin confirmed the attack and the password reset with a post to its main user forum, writing:

We take your security and privacy very seriously. Very recently, our security team discovered a sophisticated attack on our network. Our investigation indicates that the attacker may have accessed customer IDs and encrypted passwords on our systems. We have taken the precaution of resetting your account password. We apologize for any inconvenience this has caused but felt that it was necessary to help protect your account.

The zero-day exploit also affects users of vBulletin’s software used by some 100,000 community forums, resulting in the company issuing an urgent patch it recommends all users should install immediately to guard themselves against attack.

Expert view

SiliconANGLE spoke to Rapid7, Inc.’s Tod Beardsley, who explained how the attack occurred, and what its implications were.

“It looks like the vBulletin attack was due to an SQL injection bug in vBulletin’s forum software,” Beardsley said. “A patch has been released and while it appears to resolve the issue that led to the vBulletin Solutions compromise, the company has not yet issued a statement that ties the attack and the patch together.”

“Hopefully, vBulletin Solutions’ response to the incident will provide more detail for their customers, sooner rather than later.”

“Organizations that rely on vBulletin to power their community forums should apply this patch immediately. vBulletin is a popular target, since compromising a forum site can provide an effective platform for a watering hole attack.”

“In a watering hole attack, customers of a particular company, or users that share a common interest, can be effectively targeted via the trusted, but now compromised, website…vBulletin itself is a popular community and forum platform, so an unpatched bug in the platform can expose those downstream users to serious risk.”

If you’re running vBulletin, you can obtain the security patches here.

Image credit: giarose/Flickr/CC by 2.0