Beware WordPress users!!

xxf8xx said:

My entire hosting was hacked recently. All my sites redirected to a Russian domain. I fixed it by running some script which scans every file on your hosting and searches for malicious code. Then I just deleted those files it found.

EDIT: Just a heads up. Changing file permissions won't usually help as the hacker has access to change the permission via a webshell. When it happened to mine all my htaccess file were hacked and then set back to 444 (as if the hacker thinks I don't know how to change it back). Best way I found to be safe is to update everything as soon as it comes out.

Click to expand...

The most usual hacks on wordpress today is through a sploit in plugins or wp itself and is automated. chmoding will help against those types of attacks but not if a real person is hacking the host itself.

How the hacker will manage to get a webshell if set correct permissions to the files & folders?
BTW: thanks for this thread. I'm going to scan through all of my WPs.

D.

I swear by WordPress Firewall 2. Better to redirect suspect traffic back to the home page than to allow them further access.

Also, the first thing you should do for any WordPress install is to move the wp-config.php out of the WordPress installation directory. WordPress knows to check. Of course, as anyone who regularly trolls the download section knows, make sure to set up directory access permissions in your .htaccess. Of course, in the exploit/hacking world - when there's a will there's a way - but you should still do more than trust your hosting.

Sign up for a site monitoring service that emails you when your site goes offline for any extraneous amount of time. I use - http://www.internetseer.com. It's free and it sends me a weekly report to identify not only downtime, but how long it took my site to load on avg during its checks.

Finally, I swear by XCloner for backup utility. Works perfectly to do automatic backups to your S3 Cloud, FTP, even email and it's free. Back up and running in no time. Literally hands off - set it and forget it. There are - of course - other paid/unpaid options that work equally as well. Really, if backups were treated as importantly as they are when in crisis - this would be a non-issue.

Despite all of this - thank you for the heads up 2k9. It's still nice to be aware of the potential zero day release.

Just wondering if ^ they have an Aff. program :tounge-in

Keep your themes, wordpress and plugin updated. This is really very crucial and most people tend to ignore this. Try to set a firewall and also get login lockdown plugin installed. Also another important thing is to keep backing up our files. If the attack continues then change your host who has got better and secured servers

aakon7 said:

Yeah, make sure you apply all wordpress updates as soon as they are issued. We use Page.ly for our webhost and have never gotten hacked since we moved.

Click to expand...

This is bad advice. Its not always possible to update WP to the latest version due to plugins, themes that are not supported. Unless you want to see your site foobarred, go ahead and blindly update. For the record, im still running wp 3.0 and up. Iv yet to see anyone hack my sites. In 3 yrs iv never had a wp site hacked. Its true, i own and administer my own servers including their security. Thats a possible reason why i have never had a site hacked. I cant say what others hosting companies may be doing but it does seem their server administrator functions are seriously lacking in the security niche.

The op should probably start out by telling us what plugins his using. I bet one of them is wp super cache. Thats the first one to get rid off like the plague. What are the others?

All the more reason to have at the minimum, the db backup plugin running. At least if your site gets hacked your back in biz with a db restore in one piece.

HatIsBlack said:

The most usual hacks on wordpress today is through a sploit in plugins or wp itself and is automated. chmoding will help against those types of attacks but not if a real person is hacking the host itself.

Click to expand...

Yes, TimThumb image cropping code was responsible for recent hack. (in most cases)

dbyrn said:

How the hacker will manage to get a webshell if set correct permissions to the files & folders?
BTW: thanks for this thread. I'm going to scan through all of my WPs.
D.

Click to expand...

plugins have access to wordpress code, and vulnerable plugin can be hacked.

i just logged into my wordpress and there is an update.

There has been an outbreak of infected themes and plugins, that some have been pushing through blackhat and share communities.

Basically, they offer sought after, expensive or rare/hard to crack plugin or theme and claim it's nulled.
There is a wp_head injection in there that poisons your wp installation which can be anything from cpa/content-locking to malicious/virus/malware etc
You only have to install/activate the plugin or theme, by then you find out its junk or not nulled and it may be too late.. you're infected.

The nature of the injection is simple and passes through VT or similar scans.
WP exploit scanners should flag it as a curl call, but you really need to check it before installing.

I'm working on a script scanner, so you can upload your scripts/plugins/themes etc and scan for such exploits before installing them. I'm short on time right now, so it's a background thing, but hope to have it running in a few weeks to a month, time allowing.

If you're worried or stuck, feel free to drop me a pm, I'm happy to check through suspect scripts/plugins/themes

Si

Some things you can do to help secure your system (assuming you have appropriate access to the server)..

Password protect the wp-admin directory - just the regular apache auth so nobody can access anything there without logging in again, not just the standard wordpress auth. You may also want to use ssl for any logins.

Use strong passwords - user: admin, password: 12345 is not good! Use passwords with random alphanumeric AND other characters such as #$!^ whenever possible (some silly sites don't allow non-alphanum chars).

Don't use the same user/pass anywhere else!

Use a password manager app such as keepass to store all your login details for everything - keepass is free, it runs on win, linux, android, iphone etc and it encrypts it all and it also generates strong passwords for you so you don't have to think too hard.

Lock down all your tmp and /dev/shm directories - if you set these so scripts cannot be executed in them then a lot of these web app based hacks wont work coz they try to download a rootkit to tmp and run/install it from there. However sometimes having these locked down can interfere with other apps you are using so watch out for that.

Keep your server OS updated.

Keep wordpress and any other web apps, such as phpbb or whatever, updated (as much as possible).

Be careful what plugins or apps you install on your server.

Try to avoid just doing chmod 777 on everything just coz its easier to get some tricky new script working.

If somebody really wants to hack your shit they probably will, sooner or later but no point making it easy for them. Best to prepare for the worst just in case..

Backup your site and your db regularly and store your backups elsewhere - not on the same server! Download to your PC or even onto a usb stick thing so its completely offline.

BlackhatArticles.com said:

plugins have access to wordpress code, and vulnerable plugin can be hacked.

Click to expand...

No way if you set up your permissions correctly. No write permission in the source folders.

D

I've posted this elsewhere on BHW. Go to my site secure-your-website dot com. Towards the bottom of
the sales page, read "my written instructions". If you PM me I'll give you everything you need at no charge
to secure your sites.

simey69 said:

There has been an outbreak of infected themes and plugins, that some have been pushing through blackhat and share communities.

Basically, they offer sought after, expensive or rare/hard to crack plugin or theme and claim it's nulled.
There is a wp_head injection in there that poisons your wp installation which can be anything from cpa/content-locking to malicious/virus/malware etc
You only have to install/activate the plugin or theme, by then you find out its junk or not nulled and it may be too late.. you're infected.

The nature of the injection is simple and passes through VT or similar scans.
WP exploit scanners should flag it as a curl call, but you really need to check it before installing.

I'm working on a script scanner, so you can upload your scripts/plugins/themes etc and scan for such exploits before installing them. I'm short on time right now, so it's a background thing, but hope to have it running in a few weeks to a month, time allowing.

If you're worried or stuck, feel free to drop me a pm, I'm happy to check through suspect scripts/plugins/themes

Si

Click to expand...

Whats the easiest way to check?

Are these nulled WP sites that are getting hacked? I have both nulled and I have bought some-

I'm just wondering if the bought ones are much safer?

Thank You

Someone posted this link a while ago and I found it helpful. Maybe someone else will also.

http://wp.tutsplus.com/tutorials/11-quick-tips-securing-your-wordpress-site/

Thanks for heads up.

Thanks for the heads-up man, I just backup up all my wp databases just in case and looking into wp firewall 2.

this is the very reason why i don't host anything not coded by me on my real website server

for example i am using mybb forums but they are hosted on another machine

What's the best way to backup your Wordpress sites? I see that there are plugins for that. Which is the best?