It has nothing to do with stored passwords and everything to do with intercepting passwords as they are entered - if you'd had a trojan which was stealing username/password entry and siphoning it off to some third party website, that's a serious problem. Doesn't matter if your database stores passwords encrypted - if you have a keylogger trojan, that really isn't going to matter.Franck wrote:I don't believe any password was compromised. The server reported a potential trojan attack, and I dealt with it immediately, asking the server tech people to re-install the server software to be sure security wasn't compromised.
As Straycat pointed out, vbulletin is a very secure piece of software and all passwords are properly encrypted. So even if the server had been maliciously compromised, it would have no effect on your security. If anything, I believe hackers were trying to get control of the server to use it as a spam engine or something similar.
And no, I don't use the password I use here for any other login of value, because I consider VBulletin along with every other major forum system to be an incredibly high security risk, regardless of any "security PR" they care to pump out to the contrary.