Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security The Internet Communications Google Privacy Technology

Attacks On WordPress Sites Intensify As Hackers Deface Over 1.5 Million Pages (bleepingcomputer.com) 119

Posted by BeauHD from the feeding-frenzy dept.
An anonymous reader writes: "Attacks on WordPress sites using a vulnerability in the REST API, patched in WordPress version 4.7.2, have intensified over the past two days, as attackers have now defaced over 1.5 million pages, spread across 39,000 unique domains," reports BleepingComputer. "Initial attacks using the WordPress REST API flaw were reported on Monday by web security firm Sucuri, who said four groups of attackers defaced over 67,000 pages. The number grew to over 100,000 pages the next day, but according to a report from fellow web security firm WordFence, these numbers have skyrocketed today to over 1.5 million pages, as there are now 20 hacking groups involved in a defacement turf war." Making matters worse, over the weekend Google's Search Console service, formerly known as Google Webmaster, was sending out security alerts to people it shouldn't. Google attempted to send security alerts to all WordPress 4.7.0 and 4.7.1 website owners (vulnerable to the REST API flaw), but some emails reached WordPress 4.7.2 owners. Some of which misinterpreted the email and panicked, fearing their site might lose search engine ranking.
This discussion has been archived. No new comments can be posted.

Attacks On WordPress Sites Intensify As Hackers Deface Over 1.5 Million Pages More

Attacks On WordPress Sites Intensify As Hackers Deface Over 1.5 Million Pages

Comments Filter:

  • The reason I hate WordPress is PHP. (Score:4, Insightful)

    by Larsen E Whipsnade ( 4686581 ) on Friday February 10, 2017 @03:27AM (#53837655)
    I could harsh on PHP until the cows come home, but that would be annoying. So I'll just say that this sort of security problem shows that it's impractical to write anything secure in PHP. Why? Mainly because it adds a layer of complexity atop compiled binary, and it adds source code access once a hacker has got past a certain level, and... oh, it's just all kinds of insecure.

    Just why did PHP become so popular, anyway? I really don't see the attraction. Now WordPress would be a wonderful thing, if only they'd ditch the PHP. It would be a little harder to customize and extend, but far from impossible. Worst case, we could supply a scripting language ONLY for custom extensions. Basically a macro language. Python's embeddable.

    (No, I don't consider a widely used API to be a custom extension. That's part of the core.)

    More opinion: in a production system, scripting languages and macros should be only for custom extensions, and never for core code. There should never be scripts BEHIND an API. If WordPress were written in a compiled language and run as a binary, it would be less easy to hack. But not C. Those damn pointer arithmetic exploits...

    • Re:The reason I hate WordPress is PHP. (Score:4, Insightful)

      by rudy_wayne ( 414635 ) on Friday February 10, 2017 @03:33AM (#53837661)

      Everything you said is more or less true, but, the bigger problem is that WordPress and many other software packages are written by people who are just plain incompetent and/or stupid. They either don't give two shits about security or are to stupid to figure it out.

    • Re: (Score:1)

      by Anonymous Coward

      > Just why did PHP become so popular, anyway? I really don't see the attraction.

      You've heard the expression, "good, fast, cheap - pick two"?

      PHP is fast and cheap.

      • PHP was slow as molasses until recently, and cleaning up compromised servers after you get pwned isn't cheap, nor is maintaining a legacy code-rotting PHP codebase, which is what PHP encourages.

        PHP became popular because it was easy back when the dynamic web was getting started and people just wanted to write quick hacks. By the time people realized it was a terrible idea we had legions of PHP coders who thought they knew what they were doing, and tons of PHP frameworks evolving from toys to something that

        • PHP was slow as molasses until recently, and cleaning up compromised servers after you get pwned isn't cheap, nor is maintaining a legacy code-rotting PHP codebase, which is what PHP encourages.

          The AC is actually correct. The term good-fast-cheap is usually referred to Project management triangle [wikipedia.org] which is not the same as what you are thinking. It does not really apply to maintenance part. Though, It partially applies to running speed (quality of the product).

    • The reason I hate WordPress is PHP.

      LAMP rules. Get over it. Yes, PHP is awkward (said it myself [slashdot.org]) and I don't particularly like it that much either. But show me another web PL that does what PHP / LAMP does.
      Hello World in PHP is "Hello World." There. Done. Upload a bunch of PHP files on to a LAMP setup, type in the URL in the browser and watch magic happen. No compiling, no appserver to babysit 24/7, no race conditions. Pure simple stupid procedural turing complete web template logic with some nifty utility

  • Plea for simplification: static HTML (Score:5, Insightful)

    by xororand ( 860319 ) on Friday February 10, 2017 @04:15AM (#53837759)

    It is absurd how much computing power is wasted on dynamically generating what is effectively static content, like blogs.
    A simple blog should not require an SQL database and complex software stacks that are executed whenever someone visits the site.

    Instead, consider using a static website generator like Pelican [getpelican.com], or one of the many alternatives [staticsitegenerators.net].

    Write articles and blog posts in a simple, human-readable markup language such as Markdown or ReStructuredText.
    Manage your documents in git. Run the generator to recreate the HTML and update Atom/RSS feeds.
    The resulting website is blazing fast and can be hosted on dirt cheap servers.

    More simplicity on the Internet please.

    • Re: (Score:1)

      by Anonymous Coward

      Simplicity on the internet only works for intelligent people who understand how the internet works. Stupid people need gigabytes of hand-holding frameworks to accomplish anything.

      Ironically, git is too complex for actual gits to use.

    • This.

      The irony is that any WordPress site getting any reasonable amount of traffic is already using WP-Super-Cache... which generates static HTML pages for public content to be served directly from the web server. So they get the worst of both worlds: caching issues and a dynamic backend that is still just as susceptible to exploits as without the cache.

    • Re:Plea for simplification: static HTML (Score:5, Insightful)

      by thegarbz ( 1787294 ) on Friday February 10, 2017 @04:56AM (#53837857)

      You say this as someone who knows what they are doing. Markdown? Restructured text? Git? You've just gone beyond the expertise of 99% of blog writers out there.

      Wordpress's killer feature is not that it dynamically renders content, its that it allows a complete idiot to dynamically generate it.

      Remember the alternative? Remember people typing word documents and saving them as HTML files? If you don't provide a dead simple online WYSIWYG editor with instant publish features and without the requirement to install software on a machine, any proposal you come up with is DOA.

    • Yeah... that's what I told my marketing manager. We used to update our 10 web pages once or twice a year, and now it is a $30k annual expenditure with about the same attributable revenue. Joys of WordPress.

      But it does look prettier...

    • It is absurd how much computing power is wasted on dynamically generating what is effectively static content, like blogs.
      A simple blog should not require an SQL database and complex software stacks that are executed whenever someone visits the site.

      I absolutely agree with this...in theory.

      Instead, consider using a static website generator like Pelican [getpelican.com], or one of the many alternatives [staticsitegenerators.net].

      Okay, let's do that. Hrmm...not in Softaculous, or the other one-click install options at Godaddy or Hostgator. That's annoying, but it's only one time, so let's check the website...Hrmmm...no 'download' area from the front page...documentation I guess? Great! They have an install instructions area! ...that is full of CLI installation commands and doesn't provide a download link at all for shared hosting environments. Also, while PHP support is near-universal on shar

  • I almost believed in WordPress (Score:5, Interesting)

    by NaCh0 ( 6124 ) on Friday February 10, 2017 @05:26AM (#53837901) Homepage

    I subcontract with marketing companies so I work with some aspect of WordPress development on a daily basis. The standard groupthink from WordPress evangelists is that the security problems are behind us -- that WordPress core hasn't had a serious vulnerability in years, core has a review process, blame your out of date installations and inexperienced plugin developers.

    For those not in the know, the REST API is something new to wordpress. Developers could get early access thru a plugin, but the API now comes included with WP4.7. There is so much buzz and excitement, even among wordpress people who have no idea what REST really is, few people questioned it because this meant WordPress can now take over the world.

    I for one questioned it. When I saw REST enabled in 4.7 without a control to disable it my literal reaction was "Are you FUCKING kidding me???" I have experience in security. I understand attack surfaces. I have seen what a fiasco xmlrpc.php attacks are to wordpress. And these idiots open REST APIs to the internet by default? Jesus fucking Christ, I really don't think Matt Mullenweg or any of the other idiots running the WordPress show have any ability to learn from history.

    Sadly, there is no evidence of other CMS's surpassing WP in popularity. You should get used to WordPress continuing to be the sendmail of php apps.

    • The problem here is it wasn't deployed in Docker. With a real database like Oracle. The whole thing should be run in the browser [bellard.org] to give it an extra layer of containerized security.

    • Drupal is written in PHP and features a REST API yet for "some" reason is compromised something like an order of magnitude less than WP. Oddly, when I was choosing between them, the WP install failed with a cryptic error and the Drupal install worked perfectly. Saved by fate!

      • Drupal does have it's advantages and security is one of them. It's biggest disadvantage is that with every major release the core developers change large chunks of API so any add-on you are using has to be upgraded to a stable condition before you as a website maintainer or developer can move forward. After X major rewrites of their plugin because the Drupal developers decided method Y was now the best way to go, many plugin developers give up - understandably - leaving you with no upgrade path if you were

    • Re: (Score:3)

      by trawg ( 308495 )

      I subcontract with marketing companies so I work with some aspect of WordPress development on a daily basis.

      Doing agency work in the last few years I know my colleagues struggled with the process of managing WordPress within source control. If we built a website for someone based in WordPress we'd deploy it - but then if the customer upgraded it or installed a theme or something it would instantly be out of wack with what was in source control.

      Managing the site in source control from there was a bit of a pain as you'd have to download the new version, add new files, commit differences, etc - every time there was

      • Re: (Score:1)

        by NaCh0 ( 6124 )

        You should only put the theme and any plugins you wrote under source control. There's no reason to track the parts out of your control.

        It also used to be the case that if the auto-updater detected source control on core, it would disable auto-updates.(manual updates initiated from the dashboard still can happen)

  • Dynamic content + shoddy plugins + monoculture (Score:4, Insightful)

    by damaki ( 997243 ) on Friday February 10, 2017 @05:49AM (#53837929)
    And web agencies. You got a genuine recipe for disaster. But that's so much fun, all those cheap websites (my company included) which get defaced and hacked to death on a monthly basis, as it cannot be updated timely because they to need every single exotic and never updated plugins. I had to build a presentational website, 15 years ago, and you know what? I did use a static content generator, which I coded myself as it was dead simple! What's is stupid is that as many people told in replies, most of these sites actually needs zero dynamic content and would do as well with a static site generator. But hell, you got to pull the WordPress buzzword to please the corporate people, cause they need cheap flexibility, and buzzwords.

  • Defaced already (Score:1)

    by Anonymous Coward

    The site is already defaced as soon as WordPress is installed.

  • You've established that WP is not the solution. What do you suggest as a solution for less than tech savvy users who want to create good looking, fast, secure web sites?

    • You could try https://simplyedit.io/ [simplyedit.io], disclaimer: I'm one of the authors and it's not (fully) open source. Its a blend between a static site generator and a CMS, as it runs mostly in the browser, not on the server. This means there is very little attack surface on the server. You can very easily write your own server side or connect it to an existing backend.

    • Re: (Score:1)

      by NaCh0 ( 6124 )

      There's not a great solution, only unperfection options.

      They could use a managed website platform like SqureSpace [squarespace.com].

      Or if they need WordPress, a less than tech savvy user can hire a professional management service like WP Site Care [wpsitecare.com] or OnSiteWP [onsitewp.com].

    • If you arn't able to hire someone with two clues to rub together (which is hard and expensive) use something that produces static websites. Unless you are hosting forums or something else that specifically requires code to do the work (like maybe, a comments section), there is zero reason to use a CMS.

      In the old days Dreamweaver was The Thing. You can still use it, or various similar tools (eg: Flux on OSX) to create very beautiful but static code-less sites. If you have a lot of content that requires s

    • I want to know the answer, too. Many organizations use Wordpress because it is free, can do so much, and is a known entity. They can find someone to do big fixes if something breaks. People are expecting great things from their websites and the ability to make changes on their own. It is the ability to make changes on their own that introduces some complexity. My gut tells me that third-party webmasters are dying out (I would love data on that). Yes, I will pay you $X to change the text on the calendar page

  • Security through obscurity not so bad? (Score:4, Interesting)

    by bradley13 ( 1118935 ) on Friday February 10, 2017 @08:17AM (#53838171) Homepage

    We all ridicule people who rely on security-through-obscurity. Incidents like this should make us take another look at that sentence: While we shouldn't rely on obscurity for protection, we shouldn't forget that it does help. Major platforms like WordPress are lucrative targets for hackers, who will spend a lot of energy searching for weaknesses they can exploit.

    Using some lesser-known platform, or even rolling your own, makes you a less interesting target. Sure, you may (will!) have other vulnerabilities, but far fewer people will be hunting for them. This is a not-inconsiderable advantage.

    • Using some lesser-known platform, or even rolling your own, makes you a less interesting target. Sure, you may (will!) have other vulnerabilities, but far fewer people will be hunting for them. This is a not-inconsiderable advantage.

      It's not an advantage since people are going to play all the same attacks against all the sites regardless of what they claim to be running, and since you are not a whole team of people you will almost certainly make several of the same mistakes and get owned anyway. If you don't know what you're doing when it comes to security, you are almost certainly going to do a worse job even than Wordpress, let alone Drupal. (Wordpress has a new major hole every other week; Drupal has only had a few of them total.)

    • Re: (Score:1)

      by Anonymous Coward

      My client just uses an ancient version of Wordpress that doesn't have the API feature yet - practically unhackable ;-)

  • Since WordPress runs more than a fourth of the entire web (110+ Million Websites), 1.5 Million infected sites isn't all that much. Yes, WP is a mess and could use a redo, but then most legacy systems could, so what gives? WP is popular, is exposed via port 80 all over the planet and thus is a big fat jucy target. I'm glad Automattic (WordPress Corp.) is alive and well and doesn't try to be anything else than the herald of WordPress and it's (small) business arm and does it's dues by keeping up with patches

  • Funny how the URL says 15 million and the article says 1.5 million.

    https://it.slashdot.org/story/... [slashdot.org]

    Has Slashdot been defaced too?

  • So I have five separate personal WordPress sites for testing/hacking/tinkering and casually look after one for a friend. Every single one of mine updated on the day the patch for this problem was fixed.

    I got email notifications from each of my sites notifying me they were updated before I heard about the problem. I read the WP blog post about it and thought "shit, that would have been a huge problem if my sites hadn't auto-updated!" and forgot about it completely.

    (Incidentally, the next night I had a much, much higher than normal number of brute force login attempts. Not sure if related.)

    I'd be very interested to find out why these 1.5m sites did not automatically update. I wonder if they're being manually updated or what the deal is. But if auto-patching worked as it was supposed to this vulnerability would have been mitigated much more quickly.

    • Re: (Score:2)

      by rklrkl ( 554527 )

      WP auto-updating does have its risks of course - we've seen WP 4.7 introduce this big vulnerability for example (though I believe you can hold back these "major" updates and do them manually). Plus a lot of admins would prefer a scheduled time/day to update - it seems that by default auto-updating is fairly random w.r.t to its scheduling. Plus you'd want to update dev/UAT first before live in case there is breakage. Also, as far I know, WP auto-updating by default doesn't backup the Web tree/DB first and ha

    • In my experience, the answer is "custom code and plugins". If you're running a bog standard Wordpress install with Akismet, FormNinja, Gallery, and a handful of the other top-20 plugins, auto-update is just fine and won't bother you at all. If you have a lot of custom layout code, or specialized plugins that are mission critical but not regularly updated, updating Wordpress can break them, thus breaking the website. Yes, it's stupid. Yes, this situation should not be the case. However, you asked thy people

  • Don't rely on /readme.html to show you the exact version any more for a recent WP install. They seem to have knocked off the third field, so versions 4.7, 4.7.1 and 4.7.2 all now say "4.7", which might scare someone into thinking they're still on the vulnerable 4.7.

    Of course, you can log into your WP admin interface and find the exact version there, plus it's also present as the $wp_version variable in /wp-includes/version.php if you have access to the Web tree filestore.

  • A developer's peers will generally know whether they provide good value or not. When preparing to do a performance review of a developer, ask for feedback about that developer from other developers on the team (and other co-workers they interact with on other teams).

  • Any web software or web developer who seriously uses the phrase “REST API” possesses by definition an understanding of how the web is meant to work that is 100% complete and 100% wrong. And security is 10,000% more difficult to learn and implement correctly than HTTP is, so why anyone still trusts either one to such know-it-all idiots is entirely beyond me.

    • APi, with a small i ?

      Take out their families!

      • Re: (Score:1)

        by hhas ( 990942 )

        Seriously, the web is not an "API" at all, it's a distributed data graph: a giant state machine where the only permitted operations are reading state, changing state, and introspection, and data transfers are automatically transcoded to whatever representation is most mutually agreeable to client and server. Everything else—information access, emergent behavior, evolutionary flexibility and robustness—is defined and shaped by a handful of ridiculously simple, totally uniform, interaction rules o

Slashdot Top Deals

Math is like love -- a simple idea but it can get complicated. -- R. Drabek

Close