In the "network indicators of an attack" [1] what's the significance of some periods being in square brackets and others not?
1. https://github.com/DoctorWebLtd/malware-iocs/tree/master/Lin...
WordPress sites under attack from newly found Linux trojan
21–30 of 83 posts
Re: WordPress sites under attack from newly found Linux trojan
#22Website loads as a white page to me. Even the Google-cached version.
I think it's some sort of anti-ad blocker technique, disabling uBlock Origin allowed the page to load for me
Actually, leaving uBlock on and just waiting ~5 seconds allowed the page to load also.
Re: WordPress sites under attack from newly found Linux trojan
#23answers, "why you should write your own framework, if you have the knowledge and time."
Definitely not. Wordpress plugins are the source of exploits in the Wordpress ecosystem -- it's very very rarely the Wordpress core itself.
Yes, though the plugin system itself has really no rails at all. Any plugin can do anything.
Re: WordPress sites under attack from newly found Linux trojan
#24Earlier quoted context omitted.
> It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites. > (Long-ish list of relatively big-name plugins) /me reconsiders trying to relaunch a blog at all
Do you need a cow the WordPress is, for a blog? Static Site Generators like Hugo or Jekyll work great.
I've been a fan of the 'simply static' plugin for wordpress for a few years now. Basically, install wordpress on a server, make it accessible only to authorized users (vpn, acl, htauth, whatever works best for you), then have it deploy to an apache server or s3 bucket.
The WP designer feels at home. Has a simple deploy button. The pages load significantly faster.
Works well most of the time. Sometimes forms can be a bit tricky, but the sites I've deployed it with usually don't have many of them.
Re: WordPress sites under attack from newly found Linux trojan
#25Wordpress is great for rapid prototyping but as history has shown, relying on third parties for additional functionalities in production environments, comes with great risks. Most usage of Wordpress today are definably not blogs, but full blown websites with many functionalities not found on a blogging software.
It's the same tradeoff with any package ecosystem: improved convenience but less control over the codebase. Leave any JS project alone for a couple months and as soon as you `npm install` you'll see something like "30 vulnerabilities (4 low, 8 moderate, 14 high, 4 critical)"
The core WordPress is one of the most secure software in the world: there are thousands of people trying all the time to find exploits and the codebase is public. Go take a look at what CMS whitehouse.gov (one of the highest-profile hacking targets out there) is using.
Re: WordPress sites under attack from newly found Linux trojan
#26Wordpress is great for rapid prototyping but as history has shown, relying on third parties for additional functionalities in production environments, comes with great risks. Most usage of Wordpress today are definably not blogs, but full blown websites with many functionalities not found on a blogging software.
I wasn't surprised to read that once again the plugins were the cause of the security issues.
I don't know what the dynamics are for WordPress plugin developers to write this much vulnerable code, but WordPress itself has had very few vulnerabilities over the years. Even still, the vulnerabilities this plugin exploits have CVE numbers starting with 2016 and 2019.
I'd say that you can use WordPress for websites perfectly fine as long as you maintain your web server platform like any web server platform: with regular security updates and migration or mitigation plans if those updates are breaking anything. Running a website under your own control is not the one-time setup that many WordPress hosting sites promise customers. It usually doesn't take much time to hit the update button, but if you can't spend an hour a week/month making sure your website is still up to date, you shouldn't host your own stuff. Pay someone to manage it for you instead.
Re: WordPress sites under attack from newly found Linux trojan
#27In the "network indicators of an attack" [1] what's the significance of some periods being in square brackets and others not? 1. https://github.com/DoctorWebLtd/malware-iocs/tree/master/Lin...
I think it's to prevent virus scanners from detecting the IP listed in the web page. If your (super aggressive) AV engine has been updated to include these IoCs and you're just trying to read more about this virus, you don't want it to trigger a block.
Re: WordPress sites under attack from newly found Linux trojan
#28Earlier quoted context omitted.
And it's almost always older versions of plugins that are vulnerable; however, at some point a plugin update will break the website and then you don't upgrade because there's more important things to do ...
It's the dependency loop of Wordpress really - people can't update the core because their plugins don't work with new core (yet, sometimes never), so their (outdated) core remains an exploit.
Not strictly a Wordpress issue, this happens with any CMS that allows third party modules (Drupal, for one, as I know from direct experience).
Re: WordPress sites under attack from newly found Linux trojan
#29Why does all this open source stuff have so many problems? Aren’t there a lot of eyes looking at the code?
Re: WordPress sites under attack from newly found Linux trojan
#30Website loads as a white page to me. Even the Google-cached version.
Maybe because of this:
> window.loadedOnetrust = true;if (window?.activeAdsLoad {window.activeAdsLoad?.checkAdsBlock();window.activeAdsLoad?.activeAds()}
Who cares, I just close the window and don't give it another thought - the site just eliminated itself from the usable part of the Internet.