Hacked through 3.8.6 flaw, anything else to check?

[Carsafety]

To the "friendly" hacker who made an Admin account to warn us about the flaw, thank you for doing no damage! As I was on vacation this week, it would otherwise have been until next week that I logged in to find the control panel notice about the patch update.

I have since patched to fix the flaw and verified that no other obvious accounts with admin level access exist. I've also changed admin passwords as a precaution. I've also submitted tickets to my service provider and vBulletin and have taken some other precautions they suggested in case other hackers also got access.

Any other suggestions on things to check that a clever hacker might have done within vBulletin to expose a hole for a future attack? I've checked the vBulletin moderator and control panel logs and found nothing obvious, so hopefully the warning post, report and PM were the extent of all actions taken via the security flaw. But, just to be safe, I'd love to hear any other suggestions to check as I'm certainly no expert in this type of thing. Thanks!

[Reeve of Shinra]

check for rogue plugins and products in the vb admincp.
check for rogue files on your server.

[Carsafety]

Thanks- seems to be clear unless someone was really clever.

[borbole]

Maybe there is a security issue with the server and not with the vb. Ask your host to check out the access logs to see what went down exactly.

[AWS]

Maybe there is a security issue with the server and not with the vb. Ask your host to check out the access logs to see what went down exactly.

Of course this had to be a server issue. No way vbulletin could be the cause.

[Abomination]

Thanks- seems to be clear unless someone was really clever.

In the admincp, check the 'suspect file versions'.

[borbole]

Of course this had to be a server issue. No way vbulletin could be the cause.

So according to you everything is vb ''s fault? Do you remember a few months back when goddady''s server got hacked causing a lot of forums/websites hosted there to be hacked? Or was it vb''s fault even there? I get that you hate vb but don''t blame it for eveything.

P.s. You are a very funny guy btw. Your irony/sarcasm is so hilarious and original.

[AWS]

I'm serious. No way this was vbulletins fault. No way someone could get the db username and password and insert a new admin account. There is absolutely no way this was anything but a server issue. After all mysql was also running on server and vbulletin can't control how it was configured.

Now stepping back to reality. This was more than likely caused because of the faq.php issue. Saying that, I do agree that was also a server config problem. However, if vbulletin was secure then the hacker could not have gotten the db connection info and therefore they wouldn't have been hacked.

Take off the rose colored and look at things related to vbulletin with an open mind.

[Carsafety]

I have no idea what was possible to do in the scope of the known security flaw. I do know the hacker specifically referenced the issue with 3.8.6 and suggested we upgrade immediately. In that there was a patch, there was certainly some sort of liability in the 5 or so days after I had upgraded. The forums haven't been hacked in the many years prior to that, for what it's worth.

[Carsafety]

Maybe there is a security issue with the server and not with the vb. Ask your host to check out the access logs to see what went down exactly.

I did that the next morning after I patched. They didn't indicate that they found anything else of a serious nature but I didn't get specifics, other than asking if they could verify if anyone had downloaded the database all or in part.

In the admincp, check the 'suspect file versions'.

Yup did that when Reeve said to check for rogue files. Nothing within vBulletin from what I could see and the service provider didn't note anything suspicious either. My internet access is currently limited to a spotty 2G cellphone tether...

[Abomination]

Also I would recommend to have a new database user with new password assigned to your database, be sure to make changes in the config.php, then delete the old database user. Whoever did the hacking still has the log in details for the database if I understand things correctly.

[BirdOPrey5]

I'm serious. No way this was vbulletins fault. No way someone could get the db username and password and insert a new admin account. There is absolutely no way this was anything but a server issue. After all mysql was also running on server and vbulletin can't control how it was configured.

With the MySQL database login info why couldn't they insert a new user in the admin usergroup, copy the settings from the existing admin, and go to town?

[Carsafety]

Also I would recommend to have a new database user with new password assigned to your database, be sure to make changes in the config.php, then delete the old database user. Whoever did the hacking still has the log in details for the database if I understand things correctly.

Yes that is one of the things vbulletin support suggested and I had the provider implement before I even posted here;-)

[AWS]

With the MySQL database login info why couldn't they insert a new user in the admin usergroup, copy the settings from the existing admin, and go to town?

I'm being facetious. That is more than likely exactly what happened.

[Floris]

I'm serious. No way this was vbulletins fault. No way someone could get the db username and password and insert a new admin account. There is absolutely no way this was anything but a server issue. After all mysql was also running on server and vbulletin can't control how it was configured.

Now stepping back to reality. This was more than likely caused because of the faq.php issue. Saying that, I do agree that was also a server config problem. However, if vbulletin was secure then the hacker could not have gotten the db connection info and therefore they wouldn't have been hacked.

Take off the rose colored and look at things related to vbulletin with an open mind.

Here's a way if you got hacked through the 3.8.6 exploit:

They exploit you. DONE

They have the database details, all of them.

And if your server has phpmyadmin on it, you are in.

If the mysql server allows remote connections, you are in.

You can then query vb to inject another user, even if you can't set the pass because you don't know the salt (which you CAN know)
Then you just set the user as it is with a valid email, and from the front-end query vb to reset the pass, and it will set one for you.

How is it not possible?