Slashdot Mirror
WordPress Hacks Behind Surging Neutrino EK Traffic
msm1267 writes: More than 2,000 websites running WordPress have been compromised and are responsible for a surge this week in traffic from the Neutrino Exploit Kit. Attacks against sites running older versions of the content management system, 4.2 and earlier, were spotted by Zscaler. Those sites are backdoored and redirect a victim's browser through iframes to a landing page hosting the exploit kit where a Flash exploit awaits. The exploits generally target Internet Explorer, Zscaler said, and victims' computers are eventually infected with CryptoWall 3.0 ransomware. This analysis is in line with a similar report from the SANS Institute, which pointed the finger at a particular cybercrime group that had steered away from using the prolific Angler Exploit Kit and moved operations to Neutrino.
What else?
WordPress is a security problem
I know I'm going to catch flak for this.
WordPress and all of it's plugins and themes are a huge target for hackers and reliably available online.
The main problem is that users don't regularly update, or rather that they can't in many cases.
That is, assuming the plugins are updated for security holes at all.
I wouldn't be surprised if hackers had databases of the exact versions, plugins and themes of millions of WordPress installations.
Just wait for a new public disclosure, replicate the exploit and attack the matching sites in your database.
They could have hundreds of freshly hacked WP sites every week.
These sites may only stay hacked for a few days or weeks, but it's simple economics.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
... then Wordpress is a Menger Sponge.
Perl Programmer for hire
Most of the net users do not know how to protect themselves from those malicious attacks, and unfortunately TFA doesn't give out info to its readers on how to protect themselves either
So ...
Can anyone here please share with us in what way we can protect ourselves from being infected with those malwares/ransomwares?
Thanks !
Wordpress sucks.
"Those sites are backdoored and redirect a victim’s browser through iframes to a landing page hosting the exploit kit where a Flash exploit awaits."
..
But can only be successfully exploited on Microsoft windows
WordPress as a platform targets the easy-to-use market and thus has a lot of site admins who are not savvy IT people. The auto-update system built into WordPress addressed a large part of the security problem, namely people who don't actively update their software.
One glaring shortcoming to the WordPress development model is that they don't keep a set of stable releases. The WP core group wants you to stay on the most recent head version to be secure. In practice they have patched previous releases going all the way back to 3.8 but you definitely get the feeling that this is a half-hearted stop gap while they brow-beat you up to the head version.
Linux distros went through this growing pain 15 years ago with the introduction of enterprise distributions. It is about time that the WordPress foundation recognize that they are no longer a small time blog package. They need to introduce long term supported releases for the stability of their platform.
I've done a massive amount of deployments with various PHP based web-CMSes, mostly Joomla and Wordpress. And while they're all built on ancient hacks of incredibly crappy architecture and application models, the type that lets you stand back in awe and amazement vis-a-vis the utter shittyness of each of these webapp-hodgepodge behemoths, I like WordPress the best, because at least I don't feel dirty when building a quick hack with it *and* I actually *can* build a quick hack with it.. Unlike, for instance, Typo3, which is truely FUBARed.
WP is an entire hack in itself - sort of like an extension of the non-existant PHP philosophy it's built with.
However, as for the WP security record, I am honestly suprised how good it is. And before you start laughing, keep in mind that there are an estimated 50 million actively used installs of WordPress running on the web, with more than 80 million in total.
Yes there are security updated every odd month, yes the plugins are a mess and yes the people deveoping for and with WP and building extensions for it couldn't code a proper class if their life depended on it. And they should be prohibited by law to approach a keyboard. But they do get the job done and it's exactly for that very reason that I'm suprised how well the core team keeps up with stuffing the most prominent and dangerous holes, often before anybody else discovers them.
I'm quite certain this hole will be plugged in the next few days aswell.
Bottom line: ... My 2 cents.
Measured by it's install base, WordPress security actually is quite impressive. There is no other WebCMS with such a marketshare out there and I doubt any other product would be measurably safer.
We suffer more in our imagination than in reality. - Seneca
OK, so I've got a WordPress site, how can I test to see is this crud is on my site, even though I'm on 4.3?
The Wordpress hate here is hilarious. So much obvious anger. Get over yourselves. All of the hate for Wordpress can be compared to ruling in favor of same sex marriages. All of the right wing nut jobs are screaming about how it affects them and how it's so bad, as if someone were going to force them in to a same sex marriage. No one is forcing anyone to use Wordpress either - it's easy and opens operating a web site to a very large number of people. That is a wonderful thing, not a bad thing. If you don't like it, fine, no one cares. If you believe your site is some how more secure for not using it, or using some alternative, good for you, pat yourself on the back. The truth is, every piece of software ever written has potential for security holes, which may need to be patched. And even using "the most secure" software on the planet is only as secure as the people using it. Wordpress is no different. It definitely has its uses. Arguing about it is like arguing about religion.
geek n performer who performs morbid or disgusting acts, as biting off the head of a live chicken