Slashdot Mirror
Wordpress 2.1.1 Release Compromised by Cracker
GrumpySimon writes "The recent 2.1.1 release of the popular blog software Wordpress was compromised by a cracker who made it easier for to execute code remotely. This is interesting because the official release was quietly and subtly compromised, and has been in the wild for a few days now. There's no word on if any affected sites have been compromised, but anyone running Wordpress is urged to upgrade to 2.1.2 immediately, and admins can check their logs for access to 'theme.php' or 'feed.php', and query strings with 'ix=' or 'iz=' in them."
Makes me wonder if the PHP VM could do a hash of the application code and compare that with a certificate from the source of the application. I know that the injected code in this case would have been certified, but it would make it easier to identify sites which had not been upgraded.
http://michaelsmith.id.au
Comment removed based on user account deletion
It's late at night. Nothing like a bottle of Mountain Dew and a flame war to keep the programmers awake. So, how about that PHP?
Oh please. Lay off the Zonk bashing. Read the summary and note that it was not written by Zonk.
Don't like the stories? Then take a drink from the FireHose and mod up the contributions that interest you.
Yes, my bad. I was moving stuff around & trying to make it coherent. I must have missed that. You may mock me mercilessly.
henry -- the human evolution news relay
From the article, and from some comparisons I did on the downloads:
I still had the tar archive of 2.1.1 from when I grabbed it the day of the release, so I compared its contents to the 2.1.2 archive. The two files mentioned in the announcement, feed.php and theme.php, aren't any different, confirming that the initial release was unaffected. That's also where I saw the changes for that XSS bug.
Dem crackahs ALWAYS be gettin' all up in my WordPress yo. Fo'realz!
I thought the politically-correct term for "cracker" was "caucasian-american"?
The theory of relativity doesn't work right in Arkansas.
Have a really simple index.php, which can then verify the source of the rest of the app (include files, etc)?
But really, I don't think this accomplishes a hell of a lot. It wouldn't help you know which ones haven't been updated, for one thing...
Don't thank God, thank a doctor!
For what? Posting idiotic dupes, screeds of Australian non-stories, or links to adblogs such as Roland Piquep- oh, I get it...
No biggie. I think most of us can tell what word was meant to be in here.
First time I read that headline, I wondered for a second why it was significant it was compromised by a white guy.
To stray on the side of caution, as we don't yet know the nature of the code that was changed, it may be wise for Wordpressers to also change your WP db passwords while updating wp-config.php to reflect the change. If your site was vulnerable with 2.1.1 installed who knows what was done and if what was seen. Perhaps it may be good to even update existing WP user passwords.
What about this arrangement: let us all agree here to call hackers crackers from now on, and don't tell the media. This should fix things and create a clear divide again. Now excuse me while I'm off cracking some new code.
ya know. if i was a smacka jacker cracka crack hacker, i'd be all up in the spam co's databases, emolating their servurz
ThemeBot - Find and share web design templates
Sometimes I'm sure I'm the only person giving source the once-over before I build or install it. There's little chance of finding anything even if the source has been compromised but it helps me sleep better. Auditing install targets in Makefiles (for shell daemons) is a great hobby.
OSS releases should be GPG signed by now, unless the attacker can compromise the key we're then left with tampering in the repository.
If it is a job for the app, then everyone will implement it themselves, and no one will do it right.
- have a well-signed and published (on the keyservers) GnuPG (GPG) key
- do only transfer/store the private key on absolutely sure boxes, and only if it is strictly necessary
- keep a backup of the private key in an ultra safe place
- give a copy of the revocation certificate to a few very good friends
- publish the public key on a good keyserver
Then sign every archive published, let the file be mirrored everywhere... and the hell with the polluters! For now most users will not verify the signature but at least a few of them will do, and with time a growing number will join.How does this affect Wordpress mu (multiuser)? http://mu.wordpress.org/
Yeah, that's what crackers have been trying to convince us of all along.
I would settle for 'wannabee' or 'kiddie' though, and recently I added 'spammer' to that list.
It's not the first time media has hijacked a word. Very useful.
The reason one has editors, normally, is to catch such mistakes and fix them before the thing is published. Of course, Slashdot "editors" do not do any actual "editing".
It makes Slashdot "more real", according to Taco!
A very, very naughty boy who does wicked, wicked things to other peoples' computers, and brags about it on websites with black backgrounds and green text. Used to mean programmer, but doesn't any more. The old meaning is still used by old programmers living in the past, and by new programmers wishing to associate themselves with both programmers and naughty boys simultaneously. Nobody who calls themselves a "hacker" or refers to their activities as "hacking" is worth any of your time or money, no matter whether their surname is "Stallman" or "Mitnick".
A word invented by programmers who liked calling themselves hackers, didn't want to lose the term to the naughty boys, and thought that if they just pulled a new word out of their arse, people would gladly learn it and use it. Finally took its last breath when black Americans began to use it as a counterpart to the derogatory word "nigger". Nobody (nobody) calls themselves a "cracker" or refers to their activities as "cracking".
Clever except that "hacking" predates software coding as a trade and calling certain folks "Crackers" predates both.
Nicely formatted tho'.
I don't read ACs: If a post isn't worth so much as a nom de plume to its author then I wont bother either.
That will happen anyway.
If you put it in the app, there's at least a chance it'll be done right by some library that everyone ends up using. If you put it in the interpreter, the interpreter gets crufty for everyone, including people who don't care about source code signing, and people who might have a legitimate reason for implementing it a little differently.
Or, let me make this very simple: If we were talking about C, would you be in favor of including it in the operating system? Or the C compiler?
Don't thank God, thank a doctor!
You forgot "virgin". =)
As an ex-wordpress user, this just points out one among the many changes and improvements they need to make. Security is important, but if the fundamental framework itself is weak, nothing else is going to matter too much. Wordpress is crippled in that it simply can't take a digg or heavy slashdot hit. Check out any wordpress site that's been dugg to front page, chances are 99% it's going to be dead in minutes.