Forgot your password?
typodupeerror
Security IT

WordPress Hacked, Attackers Get Root Access 168

Posted by samzenpus
from the protect-ya-neck dept.
An anonymous reader writes "A hacker has gained access to WordPress.com servers and site source code was exposed including passwords/API keys for Twitter and Facebook accounts. From the official blog post: 'Automattic had a low-level (root) break-in to several of our servers, and potentially anything on those servers could have been revealed. We presume our source code was exposed and copied. While much of our code is Open Source, there are sensitive bits of our and our partner's code. Beyond that, however, it appears information disclosed was limited.'"
This discussion has been archived. No new comments can be posted.

WordPress Hacked, Attackers Get Root Access

Comments Filter:
  • the cloud (Score:5, Insightful)

    by stoolpigeon (454276) * <bittercode@gmail> on Wednesday April 13, 2011 @04:18PM (#35811760) Homepage Journal

    and that's why I don't want everything in the cloud.

    • by doconnor (134648)

      Why do you think keeping data on your own computers makes it more secure? Big break-ins make news, but that doesn't mean they are the most common.

      • Re:the cloud (Score:5, Insightful)

        by Zapotek (1032314) <tasos,laskos&gmail,com> on Wednesday April 13, 2011 @04:39PM (#35811992) Homepage
        Isn't it obvious? Because the impact of hacking a server containing data from thousands of users is FAR greater than hacking a single desktop.
        That's why the parent is right.
        • It doesn't follow that the impact on any one user is greater, though.

          • Re:the cloud (Score:4, Insightful)

            by icebraining (1313345) on Wednesday April 13, 2011 @05:00PM (#35812202) Homepage

            But it makes it far more probable.

            • by pasv (755179)
              Try reliably exploiting thousands of browsers on several different platforms and different environments to get at info. Or just send one well crafted email to a low-level employee of a company that controls the targeted information on a cloud and start a spear phishing campaign. Hrm.. Which is harder to do?
            • by jd (1658)

              Ah, that's a good question. In theory, central servers will have better security than Joe Average will know how to install. In practice, N times as many users will make the target f(N) times as inviting (where f() depends on who is doing the evaluating). This means that it is f(N) times as likely to be attacked by a human but equally likely to be attacked by zombies, worms and maybe the occasional vampire, since those won't care about N or f().

              If you are concerned about human crackers, then f(N) becomes the

          • by dhavleak (912889)
            The impact is the same -- your data is pwned. The incentive for an attacker to go after cloud storage is greater (many people's data vs. 1 person's data). Therefore, the odds of a targeted attack are vastly higher for a cloud service.
          • by sjames (1099)

            The rewards for hacking thousands of sites in one go are much greater that the rewards of hacking a single user site. For that reason, the big site will be the one facing the most attacks by the most sophisticated black hats..

        • So your solution to keeping websites from being hacked is to store the website at home on your desktop pc?

        • by geekmux (1040042)

          Isn't it obvious? Because the impact of hacking a server containing data from thousands of users is FAR greater than hacking a single desktop. That's why the parent is right.

          The collective computing (and bargaining) power of several thousand computers is FAR greater than a single server, hence the proliferation of botnets.

          This is why BOTH of you are right, and why the ONLY safe place for ANY of your personal information is wrapped nicely in strong crypto.

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        Oblig. http://xkcd.com/538/

        In short... It's more secure because nobody cares about his private data, and even if some hacker did care about his data specifically, whether or not it is on his own computer makes no difference.

        On a large system, such as WordPress, each individual user's data is of insignificant value, but the whole of it may have some value.

        It is easier to break 1 machine with 50,000 users than 50,000 machines with 1 user each.

        • by xystren (522982)

          It is easier to break 1 machine with 50,000 users than 50,000 machines with 1 user each.

          It is more efficient to break 1 machine with 50,000 users than 50,000 machines with 1 user each.

          Fixed it for ya. The number of users doesn't make it easier, it just makes the potential return on the effort more significant.

      • by Tetsujin (103070)

        Why do you think keeping data on your own computers makes it more secure? Big break-ins make news, but that doesn't mean they are the most common.

        The distinction here is if you maintain your own data on your own system, you're (probably) a small target. Aggregating a large number of small targets onto a single site makes that site a big target.

        • by jd (1658)

          Yes, for human attackers (who are the biggest threat in data theft for the time being, but expect zombies to get better at it). An automatic attack can't tell if a.b.c.d has one user or a million, it's just an IP address that the code will scan and attack if it has the script for it.

          Also, if the increase in security exceeds the increase in temptation, you're better off aggregating. Which means, however, that there's a practical limit to how far you should ever aggregate (since the practical limit on how sec

      • by dotfile (536191)
        I wouldn't say my machine is more secure than that of WordPress -- although, since theirs has been compromised and mine has not, I guess that's open for debate. One big difference is, I know what and where my vulnerabilities are, and I have my fingers in there daily so I'll know pretty quickly if and when someone breaks in. When hosting stuff on Other Peoples' Servers, you never really know for sure if they are secure, how secure they are, etc. Until you find out the hard way, of course.

        As for my act
        • by exomondo (1725132)

          I wouldn't say my machine is more secure than that of WordPress -- although, since theirs has been compromised and mine has not, I guess that's open for debate. One big difference is, I know what and where my vulnerabilities are, and I have my fingers in there daily so I'll know pretty quickly if and when someone breaks in. When hosting stuff on Other Peoples' Servers, you never really know for sure if they are secure, how secure they are, etc. Until you find out the hard way, of course.

          Not to mention they have a myriad of processes so going through and exploiting just one of those through social engineering will probably net you something. On my system no-one else needs access to it, whereas 'cloud' businesses are built on many people having access to the system so naturally that's an easier social engineering target.

      • by PopeRatzo (965947) *

        Why do you think keeping data on your own computers makes it more secure?

        Well, I can pull the ethernet plug out whenever I want, for one thing.

        Two of my busiest computers aren't even connected to the Internet except during rare occasions, during which most of my important storage is not exposed because I pulled those plugs, too.

        I trust myself more than I do a bunch of people I don't know, "in the cloud". And if I screw up, I know who to blame.

      • by Sloppy (14984)

        Why do you think keeping data on your own computers makes it more secure?

        Because SUCK is not a rigid requirement of my own computers, handed down by some PHB without regard for what the poor bastard engineer guys think about it. I don't have any conflicts where I need to put other parties' interests above the user (me).

        For example, I don't ever even think about going to extra trouble to make my computers less secure, in order to make them "CALEA compliant." I don't ever even think about implementing a de

    • by Touvan (868256)

      Or stored on anything connected to the net at all? Do you really think most people's personal computing equipment (including - maybe especially - their smart phones) is more secure than a cloud service?

      If I were betting on which, as a class of internet connected storage - cloud services, or personal hardware - is more secure, I'd bet on cloud services.

      • why rob banks? (Score:2, Insightful)

        by Anonymous Coward

        that's where the money is.

        say you are a black hat, you gonna go after amazon cloud services or ME as an individual at home.

        individuals are gonna get hit one at a time... the cloud is a really big juicy target

        security through fifty-leven different systems & methods for each record.. kinda security through obfuscation.
        my method will be different from my neighbor

        if we are both on amazon cloud-- you only gotta get in once.

        • by xMrFishx (1956084)

          security through fifty-leven different systems & methods for each record.. kinda security through obfuscation. my method will be different from my neighbor

          Though in the terms of most consumers all that means is your key is under the mat, his is in the plant pot. I keep mine in a hornet's nest but leave the back door open incase I can't get past the hornets.

      • But even if it is harder to break into a cloud service, the reward:effort ratio is much, MUCH higher for the cloud service.

        Break into Joe Luser's home PC, and you get his porn collection, the e-mail addresses in his address book, and *maybe* the user names and passwords to get into his financial accounts. Repeat for a sufficiently large number of home PCs and you might have something of value...if you don't get caught first.

        Break into facebook/wordpress/$RANDOM_CLOUD_SERVICE and you get that informat
        • by Touvan (868256)

          > But even if it is harder to break into a cloud service, the reward:effort ratio is much, MUCH higher for the cloud service.

          That's a darn good point.

    • by iluvcapra (782887)
      "Keep webservers off the cloud!" is a strange rallying cry.
    • huh? wordpress is "cloud" ? From the site: "WordPress is web software you can use to create a beautiful website or blog"
      • by Anonymous Coward

        This isn't an exploit for Wordpress itself, it's the Wordpress.com site getting hacked. This headline seems to be more attention-grabbing than it should be.

      • Re:the cloud (Score:5, Informative)

        by lennier1 (264730) on Wednesday April 13, 2011 @04:38PM (#35811986)

        wordpress.COM is a hosting service service which offers Wordpress blog setups out-of-the-box.
        wordpress.ORG is where the software itself is published.

    • Re:the cloud (Score:5, Insightful)

      by zill (1690130) on Wednesday April 13, 2011 @04:37PM (#35811968)
      Care to point out how "the cloud" is involved in this case? Nowhere in the summary or TFA does it mention that the compromised servers were cloud-based.
      • Re:the cloud (Score:4, Insightful)

        by Anonymous Coward on Wednesday April 13, 2011 @04:47PM (#35812078)
        It does seem that "the cloud" simply means, to most people, "storage and apps on the web". With that common definition I'd have a hard time seeing how it wasn't cloud based. In fact, that's probably why they were hacked. The hackers were looking for that silver lining that every cloud has.
      • Care to point out how "the cloud" is involved in this case?

        Clearly the security admin's head was in the clouds ... I mean, where else could it have been? ;-)

    • by unity100 (970058)
      precisely.
    • by Darinbob (1142669)

      I know a place where no one's lost,
      I know a place where no one cries,
      Crying at all is not allowed,
      Not in my castle on a cloud.

  • Facebook? Twitter? (Score:5, Insightful)

    by Jeremiah Cornelius (137) on Wednesday April 13, 2011 @04:18PM (#35811764) Homepage Journal

    The Word Press devs promoting integration with Facebook is like handing Sweeney Todd the razor and saying "Shave away, whatever you like."

    It starts with FB managing the identities and next, the discussion threads, and slowly creeps throughout - until WP is a hollow frame on which to drape FB parts.

    Eviler than Google. And that's saying a lot.

    • by Anonymous Coward

      >> Eviler than Google. And that's saying a lot.

      Er.. Anything from Apple|Microsoft|Oracle|Sco might have made slightly more sense. But then, if you had taken your medicine today on time, we wouldn't have had this discussion. Just saying...

      • by Anonymous Coward

        Google owns you and you're too dumb to see it.

        • Re: (Score:2, Funny)

          by Anonymous Coward

          It doesn't matter how much you keep trying, Mr. Beck, Slashdot won't hire you after your gig at Fox News is done.

        • Re: (Score:3, Informative)

          by Dishevel (1105119)

          But they don't own me they though rent me with really cool shit.
          Even after they rented me they kept improving the shit they rented me with.
          They win too. The serve me up small text ads. Ones that kind of hang back and allow me to see the stuff I want to see.
          Because they rented me they also can do a better job of making those unobtrusive text ads sometimes useful.
          If they fuck us over then their flock runs away. Then their profits go down. They do not want to do that.
          What they want is to continue to serve me r

    • by Anonymous Coward

      Login: Half the sites I visit these days have a facebook login option to access that site's account. A subset of which no longer really -have- an account management of their own.

      Discussion threads: Almost every site that has discussions threads seems to use Disqus these days.

      Avatars / Profile pictures: Thanks to the use of Disqus, that'll be Gravatar, but even sites that still have their own commenting system seem to be jumping to Gravatar; including WordPress.com .

      I'm not sure who knows more about people

      • by hedwards (940851)

        I refuse to sign up for sites like that. I played around with OpenID for a bit, but stopped pretty quickly. A single point of failure is really not a good thing.

      • The gravatar one is the one that irritates me the most. Ohloh.net uses it, and they don't even let you point to an avatar on your own web server. I can sort of understand them not wanting to have to host everyone's avatar (although, given that they're 10KB or so each... not really), but a service forcing you to use a third-party service to make some features work seems really stupid to me.
        • Re: (Score:3, Insightful)

          by Anonymous Coward

          Gravatar is particularly bad because it is uniquely* identifying to your e-mail address.
          (* as far as MD5 is unique for the purposes)

          If you were ever silly enough to use your e-mail address on some random blog to make an anonymous post - falsely trusting that the site wouldn't make this public - and that site decides to add Gravatar -without- making sure it only adds this for non-Anonymous posts... bam. exposed.

          In addition, of course, Gravatar knows who you are, at least by e-mail address (not sure what othe

      • Facebookâ(TM)s New Realtime Analytics System: HBase to Process 20 Billion Events Per Day

        Via: High Scalability: [highscalability.com]

        The need for such a high powered analytics system is driven by Facebook's brilliant plan for world wide web domination via the viral propagation of social plugins, all tying the non-Facebook web back into Facebook and the Facebook web back into the non-Facebook web. Basically anything that people can do is captured and fed back through Facebook and anything done on Facebook can be displayed on

    • Remember why Facebook offers such integration: to Facebook, you are not a customer; you're the product. A product generating data to be sold to marketeers. That is the real purpose of their offering of integration, Facebook currency, Like buttons, and soon to come: what is called the social layer on the WWW. It's all meant to generate valuable data, and it'll get worse and more pervasive as FB moves from the Grow and Consolidate phases to the Cash-in phase. And that is why I am staying well clear of Facebo
  • If obtaining API keys was the target, then we are gonna have a fresh wave of spam. Shyte.

  • by hxnwix (652290) on Wednesday April 13, 2011 @04:25PM (#35811838) Journal

    They stole everything, but, "beyond that, however, it appears information disclosed was limited."

  • So low level break-ins are automatic now?

    'Automatic had a low-level (root) break-in to several of our servers'

  • Many (most?) companies try to lie about the severity of the hack. Looks to me like they are saying it like it is. I like that.
  • by Anonymous Coward

    I was seeing some unusual activity on my blog hosted there. I opened a ticket and they thanked me for the info but never got back to me. Just emailed them regarding the ticket to see if they were related. Good thing I immediately went and changed my password for them. I guess I better change it again just to be safe. Mine is definitely not in the dictionary or guessable so I'm not to worried unless they can decrypt the password file. I would hope they encrypt their password file... I'll probably als

    • by v1 (525388) on Wednesday April 13, 2011 @04:42PM (#35812034) Homepage Journal

      I guess I better change it again just to be safe. Mine is definitely not in the dictionary or guessable so I'm not to worried unless they can decrypt the password file. I would hope they encrypt their password file..

      If they raided the entire fridge, even if it was encrypted, they'd have the keys and thus all the passwords on a silver platter.

      I think what you meant to say is you hope the passwords were hashed .

      • by joost (87285)

        Yes, the passwords on wordpress.com are hashed:

        Matt

        April 13th, 2011 at 5:27 pm

        WordPress passwords are hashed and salted using phpass.

        http://en.blog.wordpress.com/2011/04/13/security/#comment-124231 [wordpress.com]

      • by hedwards (940851)

        Personally, I like my hash salted. But that's just me.

  • Where did the anonymous reader get information regarding the hacker's access to "passwords/API keys for Twitter and Facebook accounts"? On a related note, it appears that the anonymous reader cannot properly copy and paste; It is Automattic and not Automatic.

  • Surprise!! Another CGI system is breached. Yes, I am one of those guys that thinks php is stupid!

    Along with the whole idea of CGI based native call methods built as plugins directly into a web server.

    Why don't you just give everyone the root password on your webserver and save them the effort and you the embarrassment?

    At least that way you can say I knowingly did it instead of admitting you run CGI crud in the 21st century.

    A century where VM technology makes such drivel totally unrequired.

    So use virtual

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      The only way today I would run a website is with a web server on the outside with no hard disk, and a java virtual machine executing the URL references on a completely separate networked machine using the apache tomcat plugin.

      Wow! You could serve TENS OF USERS with that rig!

    • by lennier (44736)

      Got Geometrodynamics? Awe, too hard to figure out? Too bad.

      John Wheeler cries! Then giggles. Then cries some more.

    • by Ash-Fox (726320)

      So use virtual machines, and do not tie executable code to the native environment accepting the connections or call interfaces from direct URL's.

      That didn't stop someone exploiting my tomcat powered website, downloading copies of the databases.

    • Just use jail/chroot and don't run your web server as root. Problem solved.
  • Sure glad now I used a "shitty unimportant level" password for my wordpress.com account. Whoever it is, is welcome to keep it.

  • by phearless (2040630) on Wednesday April 13, 2011 @06:54PM (#35813194)
    If large, well-funded companies, even those that specialize in security (!), or whose business depends upon keeping their proprietary info safe, cannot keep their servers secure, what chance does a Mom and Pop operation like mine have?

    This year I spent 4 weeks studying the OS X Server Security Config (400 pp.), and implementing those recommendations. I've looked at best practice guides for all the underlying FOSS tools I use. I monitor logs.

    But it's seems never enough to keep out a determined, skilled hacker. Do I despair? Give up? What lessons can I take from this?
    • You don't hear about the companies that do keep their servers secure, do you?

      Lesson: don't do business with wordpress.com.

      • by jovius (974690)

        You don't hear about the companies that do keep their servers secure, do you?

        There are also reasons why the most secure organisations do not publicise breaches.

    • by Mazzie (672533)

      What lessons can I take from this?

      If you jump off the roof of your house, you will hit the ground. If you have a really expensive house with like 5 stories, or a penthouse on 5th avenue, it may take you longer to hit the ground, but eventually.... splat.

    • by hedronist (233240)
      Take-aways from this:
      • 1. If it's on the Net then, sooner or later, it will be compromised. This is Rowell's Corollary to Fudd's First Law of Opposition. FFLoO is: If you push something hard enough it will fall over.
      • 2. Have a complete, offsite (off-server) backup ... and test it.
      • 3. Hashing passwords only works up to a point. Use a password system that yields a different one for each system.
      • 4. Don't keep any important information (e.g. credit card numbers) on the server if you can possibly avoid it
    • by psydeshow (154300)

      Do you store financial, personally identifiable, or other must-be-kept-private information?

      If yes, hire a pro to audit your setup and cover your ass. You can call said pro when you do get hacked to help with cleanup. If no, stay small, don't piss off your users, and stay on top of those logs.

      Oh, and in either case, make sure you have current, offline backups that can be used to recover from an incident.

    • by Mista2 (1093071)

      Be carefull, be small, and stay under the radar. Never put client data whenere it can be openly accessed on your server, encrypt everything. Most attacks will actually come from your own staff, and most likely someone with authorised access anyway. What makes these sites jucy is the passwords they may contain for other sites, and email addresses for spam or identity theft. Keep your clients so anonympus, even you dont know who they are. Except if you live in France, then you have to keep everything anyone e

  • Does anyone know how they got hacked? When I ran Wordpress it was like trying to plug a dike with bubble gum.

"Tell the truth and run." -- Yugoslav proverb

Working...