Planet Calypso: PlanetCalypsoForum data breach

Just received this in my mailbox:

You've been pwned!
You signed up for notifications when your account was pwned in a data breach and unfortunately, it's happened. Here's what's known about the breach:


Email found: <my email>
Breach: Planet Calypso
Date of breach: 1 Jul 2019
Number of accounts: 62,261
Compromised data: Email addresses, IP addresses, Passwords, Usernames
Description: In approximately July 2019, the forums for the Planet Calypso game suffered a data breach. The breach of the vBulletin based forum exposed email and IP addresses, usernames and passwords stored as salted MD5 hashes.


Why did we not hear about this until now? And why did MindArk themselves not inform us of this? I guess their extensive logs failed them... Must be this Gotenborg excellence once again.

FUMA.


More:

https://raidforums.com/Thread-planetcalypsoforum-com-july-2019-vB-64k-Users-Gaming-Forum

http://www.planetcalypsoforum.com/forums/showthread.php?313803-Planet-Calypso-forum-Data-Breach

 

But users reuse their passwords, and thus their accounts might be compromised in other ways. Jesus fucking Christ. Perhaps from an MA perspective there's nothing to worry about, but that's the dumbest possible thing I ever read.

 

People on PCF are wondering what exactly happened, as MindArk is choosing to not say anything, other than "nothing to worry about".

While of course I'm not certain, the most likely explanation is a weakness in the vBulletin software. A quick search for vBulletin exploits (which most likely is what was used. Most "hacks" are typically done by script kiddies firing off an exploit scanner that simply tests sites against a database of known exploits) reveals at least 13 of them reported last year:

Edit Date Name Status
2019-10-13 VBulletin 5.0 < 5.5.4 updateAvatar Authenticated Remote Code Execution Published
2019-09-27 VBulletin 5.x 0-Day Pre-Auth Remote Command Execution Published
2019-09-25 VBulletin 5.x Pre-Auth Remote Code Execution Published
2019-08-25 VBulletin Reflected XSS via Click here Published
2019-03-04 VBulletin 4.2.5 Ajax Threads 1.1.3 Lite Open Redirection Published
2019-03-04 VBulletin 4.2.5 Thread Post Bookmarking 1.2.0 Open Redirection Published
2019-03-04 VBulletin 4.2.5 vBSuper_PM 1.2.3 Lite Open Redirection Published
2019-03-04 VBulletin 4.x Seo by vBSeo 3.3.2 Open Redirection Published
2019-03-04 VBulletin 4.2.5 Member Map 1.1.2 Lite Open Redirection Published
2019-02-28 VBulletin 4.x.x DragonByte SEO v2.0.31 Pro Open Redirection Published
2019-02-26 VBulletin 4.2.0 ChangUonDyU Chatbox Plugins 3.6.0 Cross Site Scripting Published

Source: https://www.exploitalert.com/search-results.html?search=vbulletin

Another list shows the following exploits:


# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
CVE-2019-17271 89 Sql 2019-10-08 2019-10-09
4.0
None Remote Low Single system Partial None None
vBulletin 5.5.4 allows SQL Injection via the ajax/api/hook/getHookList or ajax/api/widget/getWidgetList where parameter.
CVE-2019-17132 20 2019-10-04 2019-10-11
6.8
None Remote Medium Not required Partial Partial Partial
vBulletin through 5.5.4 mishandles custom avatars.
CVE-2019-17131 1021 2019-10-04 2019-10-11
4.3
None Remote Medium Not required None Partial None
vBulletin before 5.5.4 allows clickjacking.
CVE-2019-17130 552 2019-10-04 2019-10-10
6.4
None Remote Low Not required Partial Partial None
vBulletin through 5.5.4 mishandles external URLs within the /core/vb/vurl.php file and the /core/vb/vurl directories.
CVE-2019-16759 20 Exec Code 2019-09-24 2019-09-25
7.5
None Remote Low Not required Partial Partial Partial
vBulletin 5.x through 5.5.4 allows remote command execution via the widgetConfig code parameter in an ajax/render/widget_php routestring request.


Source: https://www.cvedetails.com/vulnerability-list/vendor_id-8142/Vbulletin.html

The second list is specific for vB version 5, where PCF runs on vB 4.2.2 (Right-click any page, then select "View Source", and you'll see a line:

<meta name="generator" content="vBulletin 4.2.2" />)

vBulletin 4 has been discontinued (end of life) since late 2017. That mostly means that no new features will be developed for it, but security patches for it would typically still be rolled out to patch newly discovered exploits. Of course, it's up to the forum administrator to actually install those patches.

Forum software is quite complex, and typically relies on external libraries to implement specific functionality, like a standard open-source text editor window, or an AJAX library to provide slicker interfaces. Often, issues are discovered in libraries like those, because due to being open source, they are widely used, and thus provide a great attack surface for potential hackers. After all, if you manage to find a loophole in such a library, you would be able to target any standard software package using it.

Sometimes, it's also possible that an exploit is discovered in the source code of the software itself. Take for instance the following exploit found in vB 5:

https://www.secpod.com/blog/vbulletin-remote-code-execution-vulnerability-cve-2019-16759/

It uses a function called "evalCode", which apparently basically executes whatever code you parse to it. It essentially sidesteps whatever security is built into PHP, and allows an attacker to execute operations against the underlying operating system (Linux). Why vBulletin would include such a function is beyond me, as it's obviously a risk.

I'm just happy we migrated to Xenforo all these years ago. And I hope MindArk informed their Planet Partner Toulan of the breach. After all, MindArk was kind enough to recommend Toulan to use the same forum service provider they use, and thus Toulan runs the exact same software, and most likely is also vulnerable to the same exploit.

(Again, not saying this is how it happened, but it's a likely explanation. The alternative is a direct hack against the forum server(s) itself).

But you have nothing to worry about, guys. Someone at MindArk said so. Now please go back and [strikethrough]dump more quarters into their slot machine[/strikethrough] invest more money into Entropia Universe, the most secure MMO in the world.

 

I saw your post. 711's response in that thread reads as if they *just* found out about the breach. Yet, on their own forum, this was posted:



I would assume that this would have been noticed by MA. If not directly, most likely people in that thread submitted a support ticket notifying them. I'm still annoyed I had to find out through the mail that was sent to me, rather than hearing directly from MindArk.

 

That's not entirely true. 711, a MindArk employee, added a certificate, and password expiration dates.