Security firm Avast has shut down its online user forum after it was breached by attackers over the weekend.
Avast CEO Vince Steckler publicly acknowledged the breach—in which usernames, email addresses and encrypted passwords were stolen—in a blog post on May 26. No financial systems or payment information for Avast users were impacted by the breach, however, he added.
“This issue only affects our community-support forum,” Steckler wrote. “Less than 0.2 percent of our 200 million users were affected.”
Avast has now taken its user forum completely offline, though Steckler advises users to change their passwords if they use the same password on multiple sites.
“We are now rebuilding the forum and moving it to a different software platform,” Steckler wrote. “This forum for many years has been hosted on a third-party software platform and how the attacker breached the forum is not yet known.”
Security vulnerabilities in online forum software are not a new phenomenon. Back in 2009, the popular open-source PHPbb.com forum was hacked. And the vBulletin online forum software has been repeatedly targeted over the years by attackers.
An Avast spokesperson told eWEEK that the company’s forum was running the open-source Simple Machines Forum (SMF) version 2.0.6.
“The latest version is SMF 2.0.7 but according to the SMF change log (and the announcements on the SMF web site) there were no security-related updates included in this version,” Avast stated. “The vulnerability was not known to us. It is not clear whether the attack was conducted via a 0-day vulnerability or a hole that was silently fixed in v2.0.7 but never announced.”
In terms of how Avast was able to detect the attack, the company noted that its forum went down as a result of the attack, which occurred on the morning of Saturday, May 24.
“We realize that it is serious to have these usernames stolen and regret the concern and inconvenience it causes you,” Steckler wrote. “However, this is an isolated third-party system and your sensitive data remains secure.”
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.