Forum security question

[DrJon]

There seems to be a very big hole in vbulletin that's being exploited in the wild (a lot), can I please check whether this site has had the suggested fixes?

http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/3991429-a-new-type-hack-method?p=3993335#post3993335

Thanks
John

[Robert Scott]

Re: Forum security question

I will send you a reply by e-mail later today. I don't think it is a good idea to discuss our forum security protocols on the forum.

[DrJon]

Re: Forum security question

No problem, although there is nothing here the bad guys aren't 100% aware of. (I ask as I'm getting e-mails from some of the bigger forums I'm on saying "err, sorry, we've been hacked, please change your password".)

The Notebook Review thread on them being hacked is particularly, err, enthusiastic:

http://forum.notebookreview.com/site-suggestions-help-announcements/731846-notebookreview-forum-user-notification-urgent-alert-security-breach-8.html

(I enjoyed it once I, more-or-less, got over them losing my login and password details and they confirmed their passwords were salted. Would have been even more fun if they hadn't lost them though...)

[Robert Scott]

Re: Forum security question

Hi DrJon,

I was going to send you an e-mail response, but have decided to post a reply instead.

As mentioned above, I am not going to discuss any measures we might have taken with regard to the security of this forum, except to say that we take note of advice issued by vBulletin (which provides the software that runs this forum). We also take other steps to protect the integrity of the forum.

That's it, really, except to remind everyone that security on the internet is a two-way operation. Do you use the same password for different sites? Not a good idea. Do you use the same e-mail address for online banking and forums? Not a good idea.

[DrJon]

Re: Forum security question

Okay, thanks for the reply. One of my hats at the last firm was internet security and it's always difficult to know how technical people running online sites are, so I thought I'd mention this, as some big names were getting done.

My feeling is Security through Obscurity is almost never a good idea, but it isn't my call here and I won't go on about it. I assume you would report if you found evidence you had been hacked rather than expect all users to have unique-here passwords and not mention it. (No, that isn't a question, as I said I'm done.)