Survey Finds Most WordPress Blogs Vulnerable 82
BlogSecurity writes "Security analyst David Kierznowski shocked bloggers yesterday with a survey showing that 49 out of the 50 WordPress blogs he checked seem to be running exploitable versions of the widely used software. He said, 'The main concern here is the lack of security awareness amongst bloggers with a non-technical background, and even those with a technical background.' Mr Kierznowski also uncovered recent vulnerabilities in WordPress plugins that ship by default with the software, adding: 'WordPress users developing plugins must be aware of the security functions that WordPress supports, and ensure that these functions are used in their code.'"
Blogs are vunerable? (Score:5, Funny)
Re:Blogs are vunerable? (Score:4, Funny)
at my previous job there had been a programmer who used the same password for *everything*, and I do mean everything... from the mysql logins (both "root" and regular webapp), web site logins, shell accounts and the ssh passwords needed to move data around!
I discovered he had a blog site, and guess what, his standard password worked on that too, both to login as him and as admin. Whilst tempted, I neither added nor deleted anything on his site, but I *did* go occasionally go through his blog posts and correct his spelling and grammar! He must have noticed because after many months of occasionally tweaking his content, the login finally stopped working. Yes, I'm talking about you, "smurphy" :-)
Re:Blogs are vunerable? (Score:2)
Thanks OSS! (Score:0, Flamebait)
Re:Thanks OSS! (Score:2, Funny)
Re:Thanks OSS! (Score:1)
And mods, my original post is not flamebait... but the truth. It's one of the reasons to use OSS. If it has security holes, you're free to find them yourself.
Re:Thanks OSS! (Score:2, Insightful)
Bloggers.... (Score:-1, Troll)
irony? (Score:1, Interesting)
Re:irony? (Score:2, Insightful)
Re:irony? (Score:0)
How do you fix it? (Score:3, Interesting)
Re:How do you fix it? (Score:5, Informative)
Block Spam injections [pathf.com]
Directory traversal attacks SecFilter "\.\./"
XSS attacks
SecFilter "<(.|\n)+>"
SecFilter "<[[:space:]]*script"
SQL injection attacks
SecFilter "delete[[:space:]]+from"
SecFilter "insert[[:space:]]+into"
SecFilter "select.+from"
Too many times there are clueless admins (not you per se). But this also tends to be one of the grips on the Ubuntu Document [infiltrated.net] people flame me for. If *semi* even experienced admins can't lock a machine down... Imagine when Ubuntu on Dell becomes the next hot thing. Flame as much as you'd like facts are facts
Re:How do you fix it? (Score:2, Informative)
Users should 'fix' wordpress by keeping upto date with the latest stable versions of PHP and wordpress; security is a process and not a product. Personally I wouldn't use wordpress, it may be one of the better written PHP web-apps but unfortunately that isn't saying much at all.
Re:How do you fix it? (Score:2)
Re:How do you fix it? (Score:0)
It's not a solution for a single end user running WP in a shared hosting environment or virtual machine, their solution is to upgrade. Plus mod security requires you know how the web app works before you can write the rules, at that point it's as easy to patch the software itself for a single install.
Your ubuntu article overstates itself, sandboxing grannies activities and protecting sudoers/wheel is a good idea. You wrote an alarmist article that is almost indistinguishable from FUD.
Re:How do you fix it? (Score:1, Redundant)
SecRule REQUEST_BODY "@validateByteRange 1-255" "log,deny,phase:2,t:none,msg:'ModSecurity ASCIIZ Evasion Attempt'"
Now back to a response... My point is that you responded to a request from an end user with the wrong solution. It's not a solution for a single end user running WP in a shared hosting environment or virtual machine
You must be kidding? I have about 15 other sites hosted on the same box and my rules affect no one but my own site.
Plus mod security requires you know how the web app works before you can write the rules at that point it's as easy to patch the software itself for a single install.
So let me put this in logical terms via way of analogy... You want someone to just point and click run an application without them knowing a shizzle about how it works and why... They just want it up and running... Then at the same time you expect them to be savvy enough to 1) monitor for updates, 2) install those updates... So how different is this from me stating... By the way, here is an even SLICKER method for making SURE no one is going to touch your machine. Heck I could have avoided using mod_security and used
Regardless of the software I throw up, its UP TO ME as a USER to make sure MY IMPLEMENTATION of software is secure enough for ME. No vendor, FOSS developer person on the planet will release a patch in quick enough time for me. Hence security being pre-emptive and proactive. So I could care less if product_foo has updated versions or not. And one would have to be an ass to wait for a vendor to release a patch if there is something they could do to protect themselves in the interim... So analogy... Your house is starting to burn... You have a fire extinguisher near you and you dial 911... Do you a) wait for 911 to get their or b) try to do something in the interim. I don't know about you but I'm trying to put that fire out before my house burns. Fire department can get here when they do.
Your ubuntu article overstates itself, sandboxing grannies activities and protecting sudoers/wheel is a good idea. You wrote an alarmist article that is almost indistinguishable from FUD.
You're free to prove me wrong... Show factual information. I gave facts and proof.
Re:How do you fix it? (Score:0)
You're taking what I said out of context. As the ASCIIZ vuln proved, your software could still be vulnerable unless you upgrade. The solution is to upgrade, not to apply another level of complexity. If the web app has common vulns, the developers have probably made other mistakes and you are unlikely to have rules to protect against those. If your 15 sites were all user maintained WP installs, of course mod_security rules would make sense.
You have to know how an app works to be able to author mod security rules. What are users to do, copy them from some random website? Copy them from some stranger on slashdot? Are we really expecting users to learn mod_rewrite and mod_security just to run a modern web app? I'd prefer to patch an app in any language rather than resort to mod_rewrite or it's brethren.
No you gave a script that required root and then ranted about how this proves unix is not ready for granny.
Re:How do you fix it? (Score:2)
What would do if a security flaw was found in your blog?
a) Update to the latest version.
b) Make a mod_security rule to block it.
If you choose a) then mod_security is redundant.
If you choose b) then your a idiot.
Re:How do you fix it? (Score:3, Insightful)
NeoThermic
Re:How do you fix it? (Score:1, Informative)
Instructions on upgrading WordPress. [wordpress.org]
This assumes you control where your site is hosted. If it's a WP install provided by your hosting provider, ask them if they're up to date, and if not nag them until they are.
(Now to see if posting AC cancels the mod points I'd already used here.. Ooh, a CAPTCHA!)
HTH, NickFitz.
Re:How do you fix it? (Score:2)
On the other hand, my wife needs to write some WordPress blogs for a client and neither she nor the client want to "play computer." They just want to add content. I was looking around for what would essentially business class WordPress hosting. They don't want bluehost or dreamhost at $7/mo and you get to run Fastastico, they just don't want to do that.
Can anyone recommend a good, high quality, WordPress hosting company that handles all the tech work and just lets her handle the content?
Note, she'll need to have it off her domain so the "blogger" solutions are not appropriate. Also note, they can't afford me so I'm not an option!
Thanks
Re:How do you fix it? (Score:1, Informative)
Hmm, perhaps Wordpress.com [wordpress.com]? I'm fairly certain that they offer hosting on your domain name now, not just at username.wordpress.com.
(Not a shill, just trying not to undo my moderations.)
Re:How do you fix it? (Score:2)
Comment removed (Score:1)
Re:How do you fix it? (Score:0)
Re:How do you fix it? (Score:1)
This means Dreamhost customers have to update their Wordpress installations manually.
A trivial matter to most of us here, but for those that have become accustomed to using Fantastico's 'Your Wordpress Installation is out of date! Click here to upgrade' it's a good deal more time-consuming.
self-updating (Score:3, Insightful)
Re:self-updating (Score:3, Insightful)
Re:self-updating (Score:0)
My choices are therefore to remain vulnerable through no fault of my own, or find another place to transfer my site who will support everything (including several MySQL databases as well as the blog), but not charge me more than I can afford.
Oh noes! (Score:2)
Re:Oh noes! (Score:0)
Time for web applications to grow up (Score:5, Insightful)
I think it's about time web applications like WordPress included an update service. Put update notifications into an Atom feed pointing to tarballs incorporating an update script, patches, etc, and label them as security/minor/major. Have the system periodically retrieve them, automatically apply the security updates, and prompt the admin next time he logs in to apply the others.
The only difficulty is that the developers need to have proper release management. No more bundling security fixes into whatever the latest development version is. No more releasing updates that fiddle with styles at the same time as fixing serious bugs. I don't think that's feasible for many web applications, but it's certainly achievable for bigger projects like Wordpress.
I can't think of any web application that does this already off the top of my head. Does anybody know of any projects doing this?
Re:Time for web applications to grow up (Score:2)
The closest thing I can think of is that there is a module for drupal that will check for updates and inform you. Last I checked it would give you download links, but that's as close as it got to installing them. I wrote a module installer at one point (I think there is one, but I actually did an integration job) but then a better release monitor was released, and so I abandoned my code.
I actually did hack up Drupal to do module updates, though, and I'm not much of a programmer. So it's not that hard a job. It might have been done already, but I haven't checked.
Re:Time for web applications to grow up (Score:3, Insightful)
Re:Time for web applications to grow up (Score:2)
Re:Time for web applications to grow up (Score:1)
What should I do when I see a post containing gross factual inaccuracies moderated as "informative"?
There really ought to be other downward moderations, but while there isn't a "just plain wrong", one _has_ to use "overrated". One might posit that for every type of moderation there ought to be an equal and opposite one.
Informative <-> Wrong
Interesting <-> Tedious
Insightful <-> Well duh!
Funny <-> 3 Stooges
Re:Time for web applications to grow up (Score:2)
That's a great question. I don't have a good answer. Perhaps I will change my sig a touch. Something to the effect of that the fact that it does not go to metamoderation provides only for abuse.
I agree wholeheartedly. Perhaps the answer would be to overhaul moderation slightly such that you could simply spend your modpoint to cancel an earlier mod. The cancellations would appear in metamoderation marked as such.
Re:Time for web applications to grow up (Score:0)
Web applications run when someone out there on the internet hits the website. Should every invocation of the web application check for updates and apply them before the user gets their webpage? If two people hit an unpatched website, should it download and install the updates twice, or should the update system have some form of mutually exclusive locking, forcing the second user to wait a few extra seconds while the first user's request updates the system? Finally, webapps are typically run by the webserver as whatever user the webserver runs as, meaning that if a webapp wants to update itself, it has to be writable by the webserver, which is a recipe for disaster.
Web application packaging needs a lot of work, but automating it from the webapp itself isn't the answer.
Re:Time for web applications to grow up (Score:4, Insightful)
Re:Time for web applications to grow up (Score:1)
Re:Time for web applications to grow up (Score:3, Insightful)
It depends on what you mean. Wordpress already tells you when a new version is available. What it doesn't do is automatically install it for you. In the case of PHP apps, this is a good thing. (At least, as far as running a PHP app in the first place can be considered a "good thing".)
Wordpress installations rarely run the vanilla software. Usually the look has been customized by modifying templates and/or plugins have been added to provide new functionality. In order to do either of these tasks, you have to modify the PHP code. Wordpress provides an easy-to-use interface to do this, but it doesn't help anything if you upgrade your system. Your look and customizations will go "poof!" the moment you untar that new version. Thus upgrading is a rather painful process that requires that users backup and reapply all their modifications. That's why no one ever upgrades PHP apps if they can help it.
Re:Time for web applications to grow up (Score:3, Insightful)
Actually, this isn't true -- provided you use some common sense about how you customize your Wordpress blog. It doesn't make a lot of sense to go ahead and apply all your customizations to a theme called "default," for example (though I'm sure that lots of people do this). When you go and untar the new version, the "default" theme will be overwritten, as you point out. But if you had taken the time to make a copy of the default theme before you started mucking with it -- into a directory called, I dunno, "mytheme," perhaps -- your theme wouldn't get overwritten by anything in the tarball and your look and customizations would still be there as soon as you upgraded your database.
More of a hassle, I suspect, is that a lot of people run Wordpress on CPanel hosts -- CPanel is a popular server management platform that lets shared hosting customers control their sites without shell access -- and CPanel does not make it particularly easy to upgrade Wordpress. On a lot of hosts I've seen, for example, the function to extract a tarball is configured to never overwrite any files. So far as I can see, the only way to upgrade Wordpress is to rename your current install to a directory called "wordpress-old" or something, then extract the tarball, then copy over all of your modifications by hand using a Web-based file manager. I imagine this is pretty much beyond the capabilities of many Wordpress users. (But then, nobody is forced to maintain their own blog software. I suspect many do it out of a misguided sense of "leet"-ness.)
Re:Time for web applications to grow up (Score:2)
That's assuming, of course, that you can use the old template. The new versions might contain changes to the modified files that can't be simply copied over.
Not that I'm disagreeing with you about the importance of separating out your template.
Re:Time for web applications to grow up (Score:2)
They might. In practice, they seldom seem to -- Wordpress may change but the APIs seem pretty stable. But, yeah, this is one of the things that makes Wordpress sort of a PITA.
Re:Time for web applications to grow up (Score:2)
The updates are better done by the hosting control panel, assuming that it is one that supports automatic script installation like Virtualmin [virtualmin.com] or Fantastico.
Securing LAMP (Score:5, Informative)
SecFilterSelective REQUEST_URI
SecFilterSelective REMOTE_ADDR "!^YOUR.IP.ADDRESS$" redirect:http://www.infiltrated.net/sorry.jpg
SecFilterSelective ARG_username YOURUSERNAME chain
SecFilterSelective REMOTE_ADDR "!^YOUR.IP.ADDRESS$" redirect:http://www.infiltrated.net/sorry.jpg
Where your IP address and your username are the only ones to allow anything to the admin page. Anything else gets redirected elsewhere.
Re:Securing LAMP (Score:0)
It's not much of a solution for anything else. Specifically if you're running your own server, why are you running shit that requires you place sensitive scripts above web root to begin with? Even then why learn another mod_rewrite style config language when you can do something like this... Even automating it across upgrades is easy... for someone capable of admining their own server.
Re:Securing LAMP (Score:2)
Re:Securing LAMP (Score:2)
Re:Securing LAMP (Score:2)
Incomplete headline (Score:-1)
Fixed that for you.
Time to upgrade again (Score:3, Informative)
http://codex.wordpress.org/Upgrading_WordPress [wordpress.org]
SQL injection? (Score:3, Informative)
My personal experience... (Score:0)
Nevertheless, there were a TON of crazy dll and exe files in there that all had timestamp dates AFTER I installed WordPress.
Wordpress (Score:3, Interesting)
Re:Wordpress (Score:2)
Re:Wordpress - a correction (Score:3, Insightful)
2.2 fixes bugs I never noticed and new features I didn't immediately need, so I can see why even good blog administrators might have waited to upgrade this one. I'm not sure BlogSecurity is correct to say 2.2 is the only secure version.
For people using Web hosts with control panels and doing installs and upgrades through a control panel like "Fantastico," the latest version they're offering is 2.1.3.
I agree that Wordpress is a bit of a pain to upgrade if you've done customization. I also like to manually back up my databases before I install a new version. The whole process takes about half an hour if I include the downloading, untarring, killing off files manually, and so forth.
Re:Wordpress - a correction (Score:1)
Re:Wordpress - a correction (Score:1)
Comment removed (Score:1)
Re:Wordpress (Score:2)
Better Title/Article: (Score:0)
People run old software? Really? (Score:3, Insightful)
So if it's news to you that people run old and/or vulnerable software, then this might be something new. Otherwise it's just what I would expect.
what about Blogger? (Score:1)
Re:what about Blogger? (Score:2, Insightful)
This doesn't have anything to do with the WordPress crew sucking at security, just their users.
Not just wordpress (Score:0)
It's common for idiots to set up virtual servers and not bother updating any of the software. We should have some form of liability for folks who connect a machine to the internet and fail to patch security vulns in a reasonable time frame. We'd all be better off if virtual servers set up over 2 years ago were patched or removed from the net.
Some perspective please (Score:1)
That said, let's get some perspective on what is described by the author as "a desparate (sic) attempt to try and educate WordPress Plugin developers to some of the common security problems that can occur."
From a quick reading of the guy's postings, these weaknesses really only allow one thing: Admin access to the Wordpress site.
For the vast majority of sites this is really not a life threatening situation - if you're pOwned your best friends might lose access to your archive of cat pictures and right wing political ramblings. Or you might lose the $4.98 a month in Adsense revenue that you're counting on to fund your retirement.
Those sites that actually matter to a business or organization are the ones most likely to be properly updated and backed up.
Not really cause to lose much sleep here....
Quelle suprise! (Score:2)
You either do it yourself and accept the consequences, or find a host with a clue. wordpress.com will even host it for you for the ultra-easy-free option (though they'll charge for extra features).
Just like... well, everything else you might run on a server. Including the OS.
I was hacked... (Score:2, Insightful)
As someone who has just recently been hacked (Druapal 5.1, not WordPress, but I almost went that direction) I can say that I've recently seen my fair share of hacked Wordpress sites (via links to/from referrers) that have been listed as 'defaced' with, "Attack Technics : FTP Protokol" listed on the bragging-rights page. In my particular case it was because my hosting service allows anonymous FTP uploads(?!) with no 'correct' way to disable it (???!!!) -- my solution was to allow 0KB of FTP transfer for anonymous users.
For those whishing to see for themselves and laugh/shutter/worry, etc they can do so by clicking here AT THEIR OWN RISK [turk-h.org].
Re:I was hacked... (Score:2)
So, this had nothing to do with Drupal, right?
Re:I was hacked... (Score:1)
I shure as hell hope so. Before this post and after making the changes to FTP quotas, I had 41 hits from that page and have not been hacked again.
I did make one other change: I moved the install.php file out of my web directory. However my statistics (AWStats) do not show any access to that file for the time period.
I was able to recover well enough with some decent backups (mysqldump) and some help from the Drupal forum.
If I have any more updates on this, I'll be posting them in the drupal forum [drupal.org].
So I read this as... (Score:3, Insightful)
Good riddance if that is the case. If they cannot adapt to the needs of its users, they deserve what will come to them, though their users do not
It's a trap! (Score:1)
How did BlogSecurity get this information? (Score:1)
What does incrementally harvested mean? How did BlogSecurity obtain the version info from the blogs it polled, and how did they go about picking which blogs to poll?
There seems to be a lot of FUD in this article, and it's quickly cobbled together. There's no discussion on *how* vulnerable each version is. 2.1.3 was released April 3, but is discarded simply because the latest stable version is 2.2. Version 2.2, a major feature update version, was released only 8 days ago, and I imagine many people like me are waiting to upgrade until a couple of updates have passed.
Basing a security statement of frightening, alarming proportions solely on what version software people are using to drive personal blogs without any further research on what specific security holes exist (and how easy they are to exploit and what privileges or access they give) is, in my opinion, FUD.
Re:How did BlogSecurity get this information? (Score:0)
As a guess, they probably searched Google for the phrase "Powered by WordPress" (in the default template), then pulled the HTML and looked for the following tag in the HEAD segment:
Comment removed (Score:1)
meanwhile, in other news... (Score:0)
Remind me again why it's the *user's* responsibility to deal with the problems of junky software?
Apparently, it's possible to write secure programs in PHP (I know, I know, but that's what folks on slashdot say). So what's the dealy-deal? Why don't they fix the bugs in WordPress since it's so popular?
someone set us up the RPC (Score:0)
It should be noted (Score:0)
yet another vulnerability (Score:0)
I'd be happy if my wordpress site gets hacked (Score:1)