61–70 of 83 posts
And what part of it is a backdoor? It looks like the C&C server can only tell the software what page to redirect to? That's not the sort of access I generally associate with a "backdoor"...
I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem. "Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming lan…
Haven't had a blog in about a decade, but when I spin one back up it'll be with a static generator like Zola[0] running on a provider like Netlify[1]. Comments are nice to have but not worth the hassle that comes with a dynamic app or the moderation overhead required to keep comment spam at bay.
There is a nice writeup about the exploit which includes more information about the indicators of compromise (IOCs) on the (drweb) site: https://vms.drweb.com/virus/?i=25604695 For example, the binary file has a SHA1 of 215a4470063080696630fb6015378938e8c16a15. It reaches out to a C2 server with the IP address 109[.]234.38[.]69. It injects a script called "lone.js" which contacts another server. Etc. Someone has also…
After my experience running a WordPress blog back in the mid-late 2000s, I swore off of it. Even with the meager traffic I got I saw a constant barrage of linkfarm exploits and the like that occurred with even the most brief lapses in keeping WP up to date. Haven't had a blog in about a decade, but when I spin one back up it'll be with a static generator like Zola[0] running on a provider like Netlify[1]. Comments ar…
Earlier quoted context omitted.
Wordpress typically has write access to itself so it can auto-install updates right away, which is also a good idea for security. But I t’s definitely a tradeoff in that it also increases the potential harm from bugs.
Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't?
In theory yes. In practice no.
I think a big reason that PHP grew popular years ago was that basically all you needed in order to set up a PHP site on a host was FTP access, and in certain cases DB credentials. For example, case in point, for WordPress you only need FTP and DB access.
Certainly it was the case for me back in the day, when I started learning to program with PHP. I was still using Windows back then and I knew nothing about Linux or any of the other Unix-likes at the time. All I had was my Windows XP computers with XAMPP, and free hosting which provided me with FTP access. Many free hosts would give you MySQL DB credentials also I think.
Cron and things like that would have been beyond my abilities at the time, and beyond what I was given access to by the free hosting companies.
I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem. "Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming lan…
IMO I think the platform the binary payload is targeting is a valid criteria to characterize a threat, so no problem in calling it a Linux virus, just as we have no problem calling those "Windows viruses".
In the "network indicators of an attack" [1] what's the significance of some periods being in square brackets and others not? 1. https://github.com/DoctorWebLtd/malware-iocs/tree/master/Lin...
Wordpress is great for rapid prototyping but as history has shown, relying on third parties for additional functionalities in production environments, comes with great risks. Most usage of Wordpress today are definably not blogs, but full blown websites with many functionalities not found on a blogging software.
Anyone with any ability to write a little PHP would be far far better off building their site in a CMS like ProcessWire [1], which has a very small core, but a extremely powerful content (PHP) API [2], which means you can replicate pretty much everything you have in Wordpress and Drupal with a few API calls in your templates.
This means you build your listing and presentation-logic custom made with the minimal amount of code needed, and the attack vector shrinks to pretty much nothing, as long as you don't voluntarily do something stupid.
Why does all this open source stuff have so many problems? Aren’t there a lot of eyes looking at the code?