Slashdot Mirror
Massive Number of GoDaddy WordPress Blogs Hacked
A nasty little exploit has hit a large number of GoDaddy-hosted WordPress blogs this weekend. The best part is that the exploit only executes when the traffic is referred by Google, making it the sort of thing that site maintainers won't easily notice. Clever and devious.
Their hosting services are pretty spotty, from what I've heard. On the other hand, they have commercials that really appeal to me.
The redirect leads you to the following URL: http://www2.burnvirusnow34.xorg.pl/
Goddamned Perl strikes again.
I find all of my own sites via Google you insensitive clod!
Google is also responsible for the hacking because they made themselves available to be referred.
But but when I registered for a hosting service on GoDaddy, their commercial lead me to believe that even stripping sexy models use GoDaddy so how could something like this happen to such a reputable and honest company?!
My work here is dung.
http://plif.courageunfettered.com/archive/wc134.gif
The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later. Apache/1.3.33 Server at blogcastfm.com Port 80
China is still punishing Google huh?
"If any question why we died, Tell them because our fathers lied."
better than my 403 "You don't have permission to access" error.
Click
./
I couldn't get on the article linked in the summary, but I found this in google which is probably the same thing. It's nearly 2 months old, but that's not reason enough for it not to be on
Well, I suppose it was only a matter of time before those nerds got their revenge.
"I hope you know how very lucky you are to know me, because I am so incredibly incredible."
I found this story mentioning a similar incident regarding WordPress blogs, but it happened two weeks ago, rather than this weekend. The original site is slashdotted, so I can't tell if this is really the same incident or not.
It's now 403'd.
Who needs viruses and chinese hackers to take down blog sites when you can just use slashdot?
Well you're asking for trouble running php4.
It baffles me why people still do it but it also baffles me why people still use Windows. Go figure?
http://www.wpsecuritylock.com/ninoplas-base64-wordpress-hacked-on-godaddy-case-study/
....
happen about a week ago, though I believe they indicated their FTP accounts had been hacked.
http://blog.networksolutions.com/2010/we-feel-your-pain-and-are-working-hard-to-fix-this/
It was annoying, but I just restored from the prior days backup and went on. I only had one FTP account and a strong password and mine got hit.
One of our departments decided to do their own thing and host a site on GoDaddy. Not sure if it was Wordpress or not, but the same thing happened to them. We reported it back on 3/11 and moved the site. Way to get in front of this thing GoDaddy! Oh, and it wasn't just Google. Referrers from Bing and Yahoo would redirect to the same link spam page.
They put in a new exploit that only executes when the traffic is referred by Slashdot.
I'm not coming from Google but the given link gives me 403 (Forbidden)!
Now you know why we all call it "NO DADDY" lame hosting by lamer people.
PPN
This may be referring to the same attack:
http://www.wpsecuritylock.com/cechriecom-com-script-wordpress-hacked-on-godaddy-case-study/
Clever and devious
Often no difference between these, is there.
What's ironic is the link is to a wordpress blog hosted on godaddy's shared hosting servers. I guarantee you that the slashdot effect drove the CPU through the roof and one of the linux admins over there turned the site off, therefore 403 forbidden.
The best part is that the exploit only executes when the traffic is referred by Google
I suppose if this was a hacking site, it would be considered the best part, but it's actually the worst part because it may go unnoticed. Who's side are you on?
I read Slashdot for the headlines, because the headlines, unlike the articles, are usually original and never duplicated
Not sure if this is the same thing, but "Reports from webmasters hosted by Godaddy, Network Solutions or VPS.net indicated that the attack was not web hoster specific." http://www.ghacks.net/2010/04/12/wordpress-hack-terrifies-webmasters/
"I'm not a quack, I'm a mad scientist! There's a difference." - Dr. Cockroach
Posting a story on Slashdot is almost as bad as having a botnet DoS a site anyway. No exploit needed, just exploits of the common geek.
Another version I removed from a friend's account last week was pointing to ninoplas.com. Strikingly similar result.
First google link for wordpress ninoplas has a reasonable cleanup process if you have ssh access.
We noticed another attack against a hosting provider recently, but it wasn't GoDaddy; it was ThePlanet, or at least someone who uses their IP block. A number of phishing sites suddenly appeared on our list, and we noticed they all mapped to the same server. Multiple domains on the same server were all hosting the same phishing attack.
Annoyingly, the domain registration for the server's main domain ("websitewelcome.com") was "private". That's actually part of HostGator's system; there's no reason it should have "private registration". It just makes it harder to find the responsible party.
Have a friend who had the same situation but on a different ISP. I believe both GoDaddy and this other ISP use cPanel for access and content control. And the issue only occurred when referred from Google. I perused his site's code but couldn't find anything that stood out. I'm not even sure how the virus is activated (people would visit his site from a Google redirect and their antivirus would cry foul).
regexp iframe
done
Actually, this source says that is only the LINUX servers that have been compromised so far.
After reading the article it said that some of the Wordpress Blogs hosted by GoDaddy were hacked, but that the issue/vulnerability wasn't on GoDaddy's side.
I took a look at the source of my files after logging into the admin area, as well as did a find on the directory of the files for the malicious code from the article and I can't seem to find the script anywhere nor am I experiencing any issues of any kind.
The article didn't mention what type of WP accounts were hacked either...which brings up a question in my mind...
I'm using WordPress 2.9.2. I have MySQL 5.x and PHP 5 on as well. Do we know if this is something that just hit PHP 4 users of WP?
The thing is, I only recently upgraded to PHP 5 because I am playing around with Drupal for another site of mine that will be hosted on the same server and I needed PHP 5, WP still runs on both PHP 4 and 5.
Ave Molech Setting
I have been dealing with a large number of Wordpress installs in the past 2 years and I am hear to tell you this is NOTHING new. This is a very common attack that is being used and its hard as shit to find. Sometimes they embed it in Javascript, sometimes its in PHP. Sometimes they encode the PHP or Javascript in base64. Sometimes they have it binary encoded inside image files. They go to great lengths to hide the code.
There is also a large number of free themes out there that come with this crap included. You can typically find it by looking at the footer include file. Look for a large base64 string. Most people ignore those because there are a number of developers who find it amusing to put that crap in their footers that if removed it will prevent the theme from working. Sure, I understand they want to prevent people from removing their credit but come on. Its leading to security issues across the board.
The only thing that I have found that helps limit these attacks is to only make the wp-content/uploads directory writable by the webserver. Everything else is owned by the user or root. To take things further, each install is placed inside a unique directory name that is chmod'd to 701 (its parent is also 701). If an attack manages to crack one install, they can't just attack another by going through the file system.
Not trying to trash Wordpress here, its just too popular and they have had a number of security mistakes in the past. Wordpress installs require a lot of maintenance to keep up to date. Wordpress makes it easy on attackers by listing the version number right in the damn HTML. Sure, they say that it doesn't matter because people can figure it out anyway. But hey, why not just leave your house unlocked at night. Attackers are just going to get in anyway.
until (succeed) try { again(); }
WTF is 3/11? I'll guess you mean last November, but honestly I'm not sure. Is there a different secret handshake I'm supposed to read into that?
Anyway, how is this GoDaddy's fault? So far it looks like dumb WordPress use -- is a budget host supposed to stay on top of updating the apps that clients place on their servers, and test them for strong passwords?
The assumption that GoDaddy is horrible and has horrible service is false. People make this assumption because they use sex to sell and they have low prices. People assume these two combination also mean poor service and complete incompetence. This could not be further from the truth. Ask ANY technically minded person who has given GoDaddy a chance and they will tell you about the value of their inexpensive services and domain names. I have personally used them for 3 years running to host my website http://www.shezphoto.com/ with wordpress. I use their shared hosting economy plan which is like $3 a month if you pay for a year and I have had to call technical support to fix a problem zero times. I did call them one time to figure out how to migrate my WP database to the new version of MySQL and they emailed me explicit directions and they worked perfectly. Yes I installed using the "One click install" but I also have since then kept my WP install up to date and I have strong passwords on my admin accounts and my ftp and databases as well. You will notice I was not hacked.
I also bought my domain name through them. I challenge all of you to find me a more reliable company who charges the same amount as GoDaddy for domain names. Plus GoDaddy isn't evil like Network Solutions is. NS will put a lock on a domain name you view through their website so you cannot then purchase it through another vendor for less. GoDaddy never does this. GoDaddy may try to up sell you but you can easily choose to ignore all of that and then you get a domain name for less then anywhere else that is purchased through a reputable and honest company.
Why people trash GoDaddy all the time without ever having used them is beyond me. It's just childish. It's like saying "Eww Girls" because you find out they don't have penises. It's ok Slashdot... you can get over your fear of the unknown.
The question is if GoDaddy is trustworthy.
If it's only redirecting when referring from a search engine, then there's a .htaccess file up there that's doing it. Seen it loads of times, usually uploaded because someone either has a shit password, or they've been gumblar'd or something. Plus Wordpress's default permissions are absolute shit.
Worse then even an internal breach on a host is the tons of poorly secured and maintained and abandoned blogs out there. My guess is there has to be millions of WP "Bloggers" out there who don't have a single clue about security and maintenance. They just install a WP and a Theme and start yapping about the family dog or give out horrible tech advice.