Wordpress 2.1.1 Release Compromised by Cracker

GrumpySimon writes "The recent 2.1.1 release of the popular blog software Wordpress was compromised by a cracker who made it easier for to execute code remotely. This is interesting because the official release was quietly and subtly compromised, and has been in the wild for a few days now. There's no word on if any affected sites have been compromised, but anyone running Wordpress is urged to upgrade to 2.1.2 immediately, and admins can check their logs for access to 'theme.php' or 'feed.php', and query strings with 'ix=' or 'iz=' in them."

PHP and certificates

Makes me wonder if the PHP VM could do a hash of the application code and compare that with a certificate from the source of the application. I know that the injected code in this case would have been certified, but it would make it easier to identify sites which had not been upgraded.

Made it easier for ...

Zonk, what do they pay you for?

Key Details

From the article, and from some comparisons I did on the downloads:

• The attacker only altered the released files on the download server, not the Subversion repository. (TFA)
• Only the 2.1.1 release was altered. Older versions, such as 2.0, don't seem to have been affected. (TFA)
• If you downloaded 2.1.1 when it was first released, it's probably okay. If you grabbed it in the last four days, you're probably compromised. Upgrade NOW. (TFA, verified with diff)
• 2.1.2 also includes a fix for a cross-site scripting vulnerability [wordpress.org] discovered a few days ago, so it's worth updating anyway. (diff)

I still had the tar archive of 2.1.1 from when I grabbed it the day of the release, so I compared its contents to the 2.1.2 archive. The two files mentioned in the announcement, feed.php and theme.php, aren't any different, confirming that the initial release was unaffected. That's also where I saw the changes for that XSS bug.

Cracker

First time I read that headline, I wondered for a second why it was significant it was compromised by a white guy.

Also update your..

To stray on the side of caution, as we don't yet know the nature of the code that was changed, it may be wise for Wordpressers to also change your WP db passwords while updating wp-config.php to reflect the change. If your site was vulnerable with 2.1.1 installed who knows what was done and if what was seen. Perhaps it may be good to even update existing WP user passwords.

This is always a major concern for OSS projects

Sometimes I'm sure I'm the only person giving source the once-over before I build or install it. There's little chance of finding anything even if the source has been compromised but it helps me sleep better. Auditing install targets in Makefiles (for shell daemons) is a great hobby.

OSS releases should be GPG signed by now, unless the attacker can compromise the key we're then left with tampering in the repository.

Suggestion:GPG!

There is an efficient way to avoid such tempering, or at least to hope that those tricks will be quickly discovered by somebody: seal (sign) your published works, dammit!

• have a well-signed and published (on the keyservers) GnuPG (GPG) key
• do only transfer/store the private key on absolutely sure boxes, and only if it is strictly necessary
• keep a backup of the private key in an ultra safe place
• give a copy of the revocation certificate to a few very good friends
• publish the public key on a good keyserver

Then sign every archive published, let the file be mirrored everywhere... and the hell with the polluters! For now most users will not verify the signature but at least a few of them will do, and with time a growing number will join.

What about Wordpress mu?

How does this affect Wordpress mu (multiuser)? http://mu.wordpress.org/ [wordpress.org]

Doesn't matter, WP can't handle heavy loads.

As an ex-wordpress user, this just points out one among the many changes and improvements they need to make. Security is important, but if the fundamental framework itself is weak, nothing else is going to matter too much. Wordpress is crippled in that it simply can't take a digg or heavy slashdot hit. Check out any wordpress site that's been dugg to front page, chances are 99% it's going to be dead in minutes.

Re:Damn crazy crackahs.

Dem crackahs ALWAYS be gettin' all up in my WordPress yo. Fo'realz!

I thought the politically-correct term for "cracker" was "caucasian-american"?

Re:Damn crazy crackahs.

it's "hacker" now. Give up

Fukken seconded.

Re:Damn crazy crackahs.

ya know. if i was a smacka jacker cracka crack hacker, i'd be all up in the spam co's databases, emolating their servurz