Breach Disclosure: Social Engineered

On June 24th, ZD Net published that the forum Social Engineered was breached on June 13th of this year. Social Engineered is a forum dedicated to discussions about social engineering. The breach affected the data of 89,000 users by exposing their email addresses, usernames, IP addresses and passwords stored as salted MD5 hashes. A solution has been implemented to prevent a repeat of the data breach by becoming a commercial forum, rather than remaining free and open-source.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert, ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

Social Engineered was running on a free open-source software that is used to create and maintain forums, called myBB. This software contained a bug where malicious Javascript could be sent to an administrator or published on a forum in order to gain full access to the targeted account. This vulnerability was patched by MyBB in version 1.8.21, on June 10th. The forum Administrator disclosed in a post on the platform that because of the vulnerability in MyBB, Social Engineered would be using Xenforo software rather than MyBB. Any users of this forum should immediately change their passwords, as it is likely that their account has been compromised.