45 Million Accounts Hacked At Some Of The Biggest Car Forums

[WoodiE]

I know we've got a lot of car guys on here and if you're a member of other 1:1 car forums you might want to make sure they are not owned by a company called Vertical Scope - as all of their forums have been hacked!

"Lack of HTTPS encryption and the use of vulnerable older versions of the vBulletin forum software were other weaknesses in VerticalScope sites"

http://jalopnik.com/45-million-accounts-hacked-at-some-of-the-biggest-car-f-1782030203

 

[cbaker65]

I know we've got a lot of car guys on here and if you're a member of other 1:1 car forums you might want to make sure they are not owned by a company called Vertical Scope - as all of their forums have been hacked!

"Lack of HTTPS encryption and the use of vulnerable older versions of the vBulletin forum software were other weaknesses in VerticalScope sites"

http://jalopnik.com/45-million-accounts-hacked-at-some-of-the-biggest-car-f-1782030203

I am on a 1.1 forum ,there was some funky stuff going on there yesterday ,the folks were complaining
about not being able to get into the gallery...

 

[BurningRain]

That's a fair amount of data.

Change your passwords if you're on any of the affected sites and use your passwords elsewhere on the Internet.

 

[wacmartin]

Oh CrapI these guys own rccanada! I just want on yesterday for the first time in over a year, and saw no mention of it at all.

 

[WoodiE]

That's a fair amount of data.

Change your passwords if you're on any of the affected sites and use your passwords elsewhere on the Internet.

I can't stress enough, people should be using a good password manager to store their passwords which will allow them to use much more secure and random passwords (much better than 12345678) and never re-use passwords.

Oh CrapI these guys own rccanada! I just want on yesterday for the first time in over a year, and saw no mention of it at all.

VS is doing an incredibly poor job informing their users what's going on. Not all of their sites have an announcement yet and those that do are simply being told passwords are being reset and are now being required to change every year. No mention of why they are doing this or the fact that all of their information has been leaked.

Here is a list of all their 1:1 car forums: http://www.verticalscope.com/automotive/site-list.html and a list of all their hobby forums: http://www.verticalscope.com/hobbies-collectibles/site-list.html - they have a lot more forums than just those two links as well!

 

[BurningRain]

I can't stress enough, people should be using a good password manager to store their passwords which will allow them to use much more secure and random passwords (much better than 12345678) and never re-use passwords

I quite agree, I work in the security industry so you're preaching to the converted

If anyone is interested then KeePass is great in conjunction with KeeFox plugin for FireFox.

 

[wacmartin]

I saw the post about the passwords, and not one other thing about this was mentioned! I've made a new post about this issue and not one reply yet. It's a crappy forum with dwindling posts and crappt mods, theres a reason I never go on anymore

 

[slowngreen]

I got an email around 4 am from one I'm a member of (havent been on it in years) saying my password was reset.

 

[WoodiE]

I got an email around 4 am from one I'm a member of (havent been on it in years) saying my password was reset.

If you use that password in other places, be sure to change those as well.

 

[ninnon]

Aren't we using SSL now?

 

[WoodiE]

Aren't we using SSL now?

Yes, since early this year. You should be able to verify this by looking at your address bar and seeing the locked padlock like so:

 

[NCNitro]

I am on JeepForum. I haven't been there in well over a year, but my password was specific to that site only.

 

[WoodiE]

There have been a confirmed 0-day exploit for vBulletin and possibly used against Mac Forums, WHT, and possibly SSC.

As a reminder it's best that you do NOT re-use passwords from site to site and certainly if you're a member of ANY other forums that use vBulletin software to make sure you're using secure passwords.

Best solution would be to use a password manager like KeePass or LastPass to store your passwords. Both will auto generate passwords for you as well to ensure you are using strong passwords and not "123456".

 

[WoodiE]

Looks like hackers have hit again! VerticalScope gets breached for a second time, Toyotanation.com, Jeepforum.com, and watchuseek.com and several other VS sites are hit again.

https://krebsonsecurity.com/2017/11/2nd-breach-at-verticalscope-impacts/