Slashdot Mirror
Attacks On WordPress Sites Intensify As Hackers Deface Over 1.5 Million Pages (bleepingcomputer.com)
An anonymous reader writes: "Attacks on WordPress sites using a vulnerability in the REST API, patched in WordPress version 4.7.2, have intensified over the past two days, as attackers have now defaced over 1.5 million pages, spread across 39,000 unique domains," reports BleepingComputer. "Initial attacks using the WordPress REST API flaw were reported on Monday by web security firm Sucuri, who said four groups of attackers defaced over 67,000 pages. The number grew to over 100,000 pages the next day, but according to a report from fellow web security firm WordFence, these numbers have skyrocketed today to over 1.5 million pages, as there are now 20 hacking groups involved in a defacement turf war." Making matters worse, over the weekend Google's Search Console service, formerly known as Google Webmaster, was sending out security alerts to people it shouldn't. Google attempted to send security alerts to all WordPress 4.7.0 and 4.7.1 website owners (vulnerable to the REST API flaw), but some emails reached WordPress 4.7.2 owners. Some of which misinterpreted the email and panicked, fearing their site might lose search engine ranking.
...software.
Another good idea, just another bad execution. im sure folks will place the middleman at fault.
That's what you get when you rely on a huge framework/CMS/whatever just to make a blog. You get vulnerabilities in features you'd never use.
I could harsh on PHP until the cows come home, but that would be annoying. So I'll just say that this sort of security problem shows that it's impractical to write anything secure in PHP. Why? Mainly because it adds a layer of complexity atop compiled binary, and it adds source code access once a hacker has got past a certain level, and... oh, it's just all kinds of insecure.
Just why did PHP become so popular, anyway? I really don't see the attraction. Now WordPress would be a wonderful thing, if only they'd ditch the PHP. It would be a little harder to customize and extend, but far from impossible. Worst case, we could supply a scripting language ONLY for custom extensions. Basically a macro language. Python's embeddable.
(No, I don't consider a widely used API to be a custom extension. That's part of the core.)
More opinion: in a production system, scripting languages and macros should be only for custom extensions, and never for core code. There should never be scripts BEHIND an API. If WordPress were written in a compiled language and run as a binary, it would be less easy to hack. But not C. Those damn pointer arithmetic exploits...
Couldn't resist.
I tried WordPress for a while, and I tried some PHP coding. I'm a tad bitter.
black njggers white njggers yellow njggers red njggers brown njggers EVERY BLOGGER IS A NlGGER
njggers ARE NlGGERS
When you produce nothing of value, reputation is everything.
I'm glad I saw this article. I went and patched my WordPress installation to 4.7.2.
Oh-o, script kiddies found a new tool to play with. Now they are trying to pretend that their tiny little hairless balls are bigger than they are in reality. You get no credit for using a known vulnerability just as your virtual paint spray, biaaatches.
Nope. They won't blame their precious 5$ web hosts. Instead, for some reason I still struggle to grasp, they will instead blame the web coders they didn't hire, who warned them not to use WordPress in the first place, as well as "all versions of PHP itself," regardless of host configuration.
It is absurd how much computing power is wasted on dynamically generating what is effectively static content, like blogs.
A simple blog should not require an SQL database and complex software stacks that are executed whenever someone visits the site.
Instead, consider using a static website generator like Pelican, or one of the many alternatives.
Write articles and blog posts in a simple, human-readable markup language such as Markdown or ReStructuredText.
Manage your documents in git. Run the generator to recreate the HTML and update Atom/RSS feeds.
The resulting website is blazing fast and can be hosted on dirt cheap servers.
More simplicity on the Internet please.
I subcontract with marketing companies so I work with some aspect of WordPress development on a daily basis. The standard groupthink from WordPress evangelists is that the security problems are behind us -- that WordPress core hasn't had a serious vulnerability in years, core has a review process, blame your out of date installations and inexperienced plugin developers.
For those not in the know, the REST API is something new to wordpress. Developers could get early access thru a plugin, but the API now comes included with WP4.7. There is so much buzz and excitement, even among wordpress people who have no idea what REST really is, few people questioned it because this meant WordPress can now take over the world.
I for one questioned it. When I saw REST enabled in 4.7 without a control to disable it my literal reaction was "Are you FUCKING kidding me???" I have experience in security. I understand attack surfaces. I have seen what a fiasco xmlrpc.php attacks are to wordpress. And these idiots open REST APIs to the internet by default? Jesus fucking Christ, I really don't think Matt Mullenweg or any of the other idiots running the WordPress show have any ability to learn from history.
Sadly, there is no evidence of other CMS's surpassing WP in popularity. You should get used to WordPress continuing to be the sendmail of php apps.
And web agencies. You got a genuine recipe for disaster. But that's so much fun, all those cheap websites (my company included) which get defaced and hacked to death on a monthly basis, as it cannot be updated timely because they to need every single exotic and never updated plugins. I had to build a presentational website, 15 years ago, and you know what? I did use a static content generator, which I coded myself as it was dead simple! What's is stupid is that as many people told in replies, most of these sites actually needs zero dynamic content and would do as well with a static site generator. But hell, you got to pull the WordPress buzzword to please the corporate people, cause they need cheap flexibility, and buzzwords.
Stupidity is the root of all evil.
Wordpress is not the "first" open source failure, it's the rather the most naive open source project that was widely adopted for inappropriate uses (clueless, not security-minded people), hell most WP users don't know how to install Wordpress, they ask someone else, or their "webspace provider" to install it. Thus there are a shittonne of BAD Wordpress installs out there.
The sites I manage, I make a point of telling users that WORDPRESS IS THE PROBLEM, NOT THE SOLUTION. If they want to stop having such a slow site, stop using wordpress and consider something that was actually designed for their use case.
But I guess we're too far gone on this. PHP won the preferred server-sided scripting language war, and wordpress won the "easy to install general purpose CMS" war. Thus people don't even want to consider something more secure.
And no, Ruby or Python are not improvements. They are too hard to install and maintain, and the reason Perl lost it's place in web-site scripting was because it didn't scale. PHP does. But it doesn't scale enough. Nothing does. Unfortunately things that you would do with desktop software to improve performance (eg multithreading and caching) are liabilities with software that communicates with untrusted sources.
The site is already defaced as soon as WordPress is installed.
You've established that WP is not the solution. What do you suggest as a solution for less than tech savvy users who want to create good looking, fast, secure web sites?
My mom always said, "Jim, you're 1 in a million." Given the current population, there are 7000 of me. God help us all!
We all ridicule people who rely on security-through-obscurity. Incidents like this should make us take another look at that sentence: While we shouldn't rely on obscurity for protection, we shouldn't forget that it does help. Major platforms like WordPress are lucrative targets for hackers, who will spend a lot of energy searching for weaknesses they can exploit.
Using some lesser-known platform, or even rolling your own, makes you a less interesting target. Sure, you may (will!) have other vulnerabilities, but far fewer people will be hunting for them. This is a not-inconsiderable advantage.
Enjoy life! This is not a dress rehearsal.
Just to preempt this stupid comparison:
Yes, every language has their uses. You use the right tool for the right job, right? Not doing that is just making your life harder. (or you want a challenge for fun)
PHP is that sandwich you forgot to eat a few months back, sitting under Brainfuck, LOLCODE and Malbolge.
Good luck hammering a nail with a mouldy, dusty sandwich.
PHP is fucking disgusting. It's community is toxic and stupid, as are its developers. (that never even knew a basic difference between == and ===)
It needs to die already. There isn't a single language that is as abused as that is, next to C++, which is 2nd worst for horrific practice.
PHP was never good. It will never EVER be good.
Let it rot. Just clear it out of your damn toolbox first!
You CAN write OO code in C, even machine code, and as long as you code it up and know the C rules, you will succeed. However, a deliberately designed OOP language makes writing OO code EASIER.
And, to you, this fact would be "blaming the tools, not the programmer" for not knowing how to write an OO program in a procedural language...
Or that claim of yours is dogmatic tripe used in place of reasoning.
Sometimes your code should be used for the purpose for which it was written for. And PHP was a cobbled simple script put together to make writing your own dynamic web pages easy. Using it in a server environment is like using BASIC (the old school type) to write your server code, or even just DOS commands, rather than PowerShell. One was designed for the task, one was designed for a different use.
PHP wasn't written for massive server webpages and the required security, they were written to be easy to write.
But it doesn't scale enough. Nothing does.
I don't know buddy. I've never had problems with ASP or ColdFusion. Tens of thousands of users at a time, and they work just fine.
Since WordPress runs more than a fourth of the entire web (110+ Million Websites), 1.5 Million infected sites isn't all that much. Yes, WP is a mess and could use a redo, but then most legacy systems could, so what gives? WP is popular, is exposed via port 80 all over the planet and thus is a big fat jucy target. I'm glad Automattic (WordPress Corp.) is alive and well and doesn't try to be anything else than the herald of WordPress and it's (small) business arm and does it's dues by keeping up with patches and fixes.
We suffer more in our imagination than in reality. - Seneca
Funny how the URL says 15 million and the article says 1.5 million.
https://it.slashdot.org/story/...
Has Slashdot been defaced too?
Compare
Build & deployment time ...
Features / options
Developer base
Designer base
Design customization
Features / coding customization
Scalability
Portability
Server ubiquity
Ease of set up
Ease of administration
Etc
And ..... cost/return for all of the above
The reason I hate WordPress is PHP.
LAMP rules. Get over it. Yes, PHP is awkward (said it myself) and I don't particularly like it that much either. But show me another web PL that does what PHP / LAMP does.
Hello World in PHP is "Hello World." There. Done. Upload a bunch of PHP files on to a LAMP setup, type in the URL in the browser and watch magic happen. No compiling, no appserver to babysit 24/7, no race conditions. Pure simple stupid procedural turing complete web template logic with some nifty utility functions bolted on left right and center, with no order or discipline what-so-ever. But they all work.
LAMP rules, it get's the job done and right now it's also putting money in my pocket. Yes, there are a lot of n00bs and non-programmers doing stuff in PHP and the projects using it have little to no idea how to organise web-dev, let alone a clean model or dev pipeline. And it's really ugly and bizar. But it get's the job done, one hack at a time.
PHP is the language that get's shit done on the web, plain and simple. It's the P in LAMP.
That's why PHP has WordPress, Joomla, Typo3, EZ Publish, Drupal and such and Java has nothing of that magnitude. Go figure.
My 2 cents.
We suffer more in our imagination than in reality. - Seneca
So I have five separate personal WordPress sites for testing/hacking/tinkering and casually look after one for a friend. Every single one of mine updated on the day the patch for this problem was fixed.
I got email notifications from each of my sites notifying me they were updated before I heard about the problem. I read the WP blog post about it and thought "shit, that would have been a huge problem if my sites hadn't auto-updated!" and forgot about it completely.
(Incidentally, the next night I had a much, much higher than normal number of brute force login attempts. Not sure if related.)
I'd be very interested to find out why these 1.5m sites did not automatically update. I wonder if they're being manually updated or what the deal is. But if auto-patching worked as it was supposed to this vulnerability would have been mitigated much more quickly.
...teehee ill be god of chaos and you can allllll cry for fucking around
>> but some emails reached WordPress 4.7.2 owners. Some of which misinterpreted the email and panicked, fearing their site might lose search engine ranking.
Google: "Splendid! Our evil plan is working exactly as we wanted." [insert maniacal laugh]
Don't rely on /readme.html to show you the exact version any more for a recent WP install. They seem to have knocked off the third field, so versions 4.7, 4.7.1 and 4.7.2 all now say "4.7", which might scare someone into thinking they're still on the vulnerable 4.7.
Of course, you can log into your WP admin interface and find the exact version there, plus it's also present as the $wp_version variable in /wp-includes/version.php if you have access to the Web tree filestore.
WP auto-updating does have its risks of course - we've seen WP 4.7 introduce this big vulnerability for example (though I believe you can hold back these "major" updates and do them manually). Plus a lot of admins would prefer a scheduled time/day to update - it seems that by default auto-updating is fairly random w.r.t to its scheduling. Plus you'd want to update dev/UAT first before live in case there is breakage. Also, as far I know, WP auto-updating by default doesn't backup the Web tree/DB first and has no easy way to roll back a failed auto-update because of that (so off to tape backups you go whilst the site can often be down).
Still, WP updating whether its manual, scripted or automatic is still a million light years ahead of Umbraco's updating (which usually can't be upgraded between major releases, so many Umbraco sites get stuck on a particular major release for a very long time, even after support has ended).
I'd be very interested to find out why these 1.5m sites did not automatically update.
They're probably professional sites that businesses depend on for a revenue stream. Believe it or not, some businesses do depend on WordPress as their CMS. Those businesses have probably learned to disable the auto-updates.
I'm not against using WordPress, certainly not like some other posters here. But I am against allowing WordPress auto-updates. Before any updates are deployed, you need test whether the new version renders your site the same way as before.
WordPress has a history of changing core functionality in a way that breaks major features, and they've been known to introduce entirely new attack surfaces without the ability to turn them off. That last one, by the way, led to a situation which may seem familiar.
Do NOT allow your site to be updated at the whims of the WordPress development team. Their track record does not inspire confidence.
In my experience, the answer is "custom code and plugins". If you're running a bog standard Wordpress install with Akismet, FormNinja, Gallery, and a handful of the other top-20 plugins, auto-update is just fine and won't bother you at all. If you have a lot of custom layout code, or specialized plugins that are mission critical but not regularly updated, updating Wordpress can break them, thus breaking the website. Yes, it's stupid. Yes, this situation should not be the case. However, you asked thy people don't enable auto-update. That would, in fact, be why.
As an aside, shameless plug for the super awesome Shield Plugin. It's free, and when properly configured, can prevent nearly all of the major forms of automated attack. I've also used iQ Block Country to nix traffic from most of the usual purveyors of such attacks. Not a dev or an investor, just a super happy user of both.
Now, to go one further, Slashdot seems to be back-and-forth regarding mandatory auto-updating. Wordpress has a flaw, and the response is, "why isn't auto-update just how the thing works?". Microsoft implements this with Windows 10, and the response is, "How dare they tell me when I have to update!". Which is it?
A developer's peers will generally know whether they provide good value or not. When preparing to do a performance review of a developer, ask for feedback about that developer from other developers on the team (and other co-workers they interact with on other teams).
Any web software or web developer who seriously uses the phrase “REST API” possesses by definition an understanding of how the web is meant to work that is 100% complete and 100% wrong. And security is 10,000% more difficult to learn and implement correctly than HTTP is, so why anyone still trusts either one to such know-it-all idiots is entirely beyond me.
Value conversion isn't necessarily the same as validation. If you want validation, then use validation operations. Use the right tool for the job.
Table-ized A.I.
So far, the vulnerable sites under these new attacks are those running WordPress plugins such as Insert PHP and Exec-PHP, which allow visitors to customize posts by inserting PHP-based code directly into them.
thanks to ZEUSHACKERS01@OUTLOOK.COM . My lawyer and I knew nothing about hacking Facebook password or phone hacks. But we needed proofs in court. We liked the way ZEUSHACKERS01@OUTLOOK.COM counselled with us about the process and the way they responded to our needs. In just few hours, we had photos, private messages, names and the password. We are very pleased with their assistance. We have already won our case!They also offer services like hacking mobile devices like your partner's texts and calls,whatsapp hacks, clear criminal records, website hacks, instagram hacks,facebook hacks,recover passwords, emails, iCloud hacks, upgrading school grades and lots of hacking services