Hacked... Because of an Insecure Library

This morning, ZDNet’s Zack Whittaker reported a hacker has targeted the official forum for the mobile game Clash of Kings, stealing nearly 1.6 million accounts. According to the piece, the hacker exploited a known weakness in the forum’s software, an older version of vBulletin, which dates back to late 2013. The version in question is vulnerable to a number of serious security flaws, which can be exploited with tools found readily online.

Avoid the Hack - Keep ALL Software Up-to-Date

Unfortunately, getting hacked because you didn’t keep your software up-to-date is an all too common experience. In the operating system arena, most products have auto-update features – like Windows Update – that check your products and verify that you’re using the latest version. This is particularly important for security patches.

But in the application world, like vBulletin, there is no such infrastructure. Not even a notification infrastructure for vulnerabilities. So developers and operations teams are simply flying blind – nobody tells them that the application is now completely vulnerable. While at Aspect Security, we looked at this problem in depth, and published this whitepaper, called “The Unfortunate Reality of Insecure Libraries.” We explored the pervasive use of libraries with known vulnerabilities. The numbers, as you can see in the report are staggering. 

Open source projects don’t patch the same way products do. If you want to keep using an older version of an operating system, you can just apply the security patches for that version. But with open source, there are no such patches for older versions. You simply *must* move to the latest version of the project, regardless of whether it disrupts your entire codebase, requiring extensive recoding and retesting. Many development projects are stuck on the horns of a terrible dilemma – keep operating with vulnerabilities, or spend months rewriting applications for no real benefit.

We simply have to do a better job of enabling people who download and operate open source software to keep their software up-to-date. At a minimum, we need an infrastructure to notify users. But even better would be to enable libraries and applications to automatically update themselves when new critical vulnerabilities are discovered. There are some difficult technical challenges to overcome, but it simply has to happen or breaches will continue to occur.

~Jeff 
Jeff Williams | Co-founder and CTO
Contrast Security
888.371.1333 | @planetlevel @contrastsec