Over a million developers have joined DZone.

Hacked... Because of an Insecure Library

DZone's Guide to

Hacked... Because of an Insecure Library

Keep your software up to date, or you'll be exposing your customer base to security risks.

· Performance Zone ·
Free Resource

Sensu is an open source monitoring event pipeline. Try it today.


This morning, ZDNet’s Zack Whittaker reported a hacker has targeted the official forum for the mobile game Clash of Kings, stealing nearly 1.6 million accounts. According to the piece, the hacker exploited a known weakness in the forum’s software, an older version of vBulletin, which dates back to late 2013. The version in question is vulnerable to a number of serious security flaws, which can be exploited with tools found readily online.

Avoid the Hack - Keep ALL Software Up-to-Date

Unfortunately, getting hacked because you didn’t keep your software up-to-date is an all too common experience. In the operating system arena, most products have auto-update features – like Windows Update – that check your products and verify that you’re using the latest version. This is particularly important for security patches.

But in the application world, like vBulletin, there is no such infrastructure — not even a notification infrastructure for vulnerabilities. So developers and operations teams are simply flying blind; nobody tells them that the application is now completely vulnerable.

Open source projects don’t patch the same way products do. If you want to keep using an older version of an operating system, you can just apply the security patches for that version. But with open source, there are no such patches for older versions. You simply must move to the latest version of the project, regardless of whether it disrupts your entire codebase, requiring extensive recoding and retesting. Many development projects are stuck on the horns of a terrible dilemma – keep operating with vulnerabilities, or spend months rewriting applications for no real benefit.

We simply have to do a better job of enabling people who download and operate open source software to keep their software up-to-date. At a minimum, we need an infrastructure to notify users. But even better would be to enable libraries and applications to automatically update themselves when new critical vulnerabilities are discovered. There are some difficult technical challenges to overcome, but it simply has to happen or breaches will continue to occur.

Sensu: workflow automation for monitoring. Learn more—download the whitepaper.


Published at DZone with permission of

Opinions expressed by DZone contributors are their own.

{{ parent.title || parent.header.title}}

{{ parent.tldr }}

{{ parent.urlSource.name }}