ZoneAlarm, a security firm owned by Check Point that offers security solutions to PC users worldwide, recently suffered an unauthorised intrusion into one of its web domains that compromised names, email addresses, hashed passwords, and date of births of up to 4,500 users.
Upon contacting the security firm, The Hacker News learned that “attackers exploited a known critical RCE vulnerability (CVE-2019-16759) in the vBulletin forum software to compromise ZoneAlarm’s website and gain unauthorised access”.
It also learned that the firm was running an outdated 5.4.4 version of the vBulletin software that contained a zero-day vulnerability that was revealed by a hacker in September this year and which was exploited by hackers to hack into the Comodo forum website and access login information of 245,000 users
TEISS has covered the story here: https://www.teiss.co.uk/
This breach is not of Zone Alarm but rather of its forum which should serve as a reminder that no subdomain or public-facing asset should be considered low risk. Forums, in particular, are often not provided with the same level of security as main websites and therefore are often targeted by cyber criminals. While there may not be payment information on such forums, at the very least, they will have email addresses and passwords which criminals can use to try and access other accounts associated with that user in what is known as \’credential stuffing\’ attacks that rely on users reusing the same password across different accounts.
Passwords are also used in scam emails which are sent to users containing their password which claim that the users have been hacked and demands a payment in return for not sharing personal and embarrassing details.