Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skype blog hacked

blogs.skype.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: Skype blog hacked

#51

Post by barsxl »

jfoster wrote: post #48
xSwag wrote: post #4

This blog is not hosted by the Skype but on WordPress VIP. This means that, most likely, the blog was not broken into using a software exploit of any sort since the security on VIP blogs is professional. Knowing that this is the Syrian Army, this attack was most likely done using phished credentials. If they had any sort of system access they would have defaced the entire subdomain or the main site. So most likely, t…

Doesn't WordPress offer any two-step auth option? Feels like a rather large limitation.

WordPress.com offers two-step authentication for all of our users. You can use any application which supports Time-Based One-Time Passwords (TOTP) such as Google Authenticator, Authy, etc. and you can also receive a one time password via SMS.

Re: Skype blog hacked

#52

Post by X4 »

krapp wrote: post #44
X4 wrote: post #41

Earlier quoted context omitted.

Hardening Wordpress. That made me speechless………… But hey, what do I know? ¯\_(ツ)_/¯ Only the tip of the iceberg. Some men believe. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=wordpress

How much of what's on that list actually applies to a recent version of Wordpress?

>> to a recent version of Wordpress

Saying recent here isn't logical, because after patching the incident, it's not an incident anymore. But I guess you mean how secure you are with a recent version of Wordpress. I think this is though question, because Wordpress relies to a high degree on external components and plugins. There is probably no single pure Wordpress Blog, because the original Wordpress archive already relies heavily on external dependencies. That's where many of the issues were found as correctly pointed out by wyck. However this reliance on external code, without a Wordpress team or at least a software that is evaluating the code-quality or any other metric, you can't be secure. Yeah we can argue with: "But Wordpress is n-times more popular than X." However it still makes WP very vulnerable to attacks. I've cleaned and recovered some hacked commercial wp blogs and shops myself (not installed by me, but the previous dev). So whatever you believe in WP may be, just get over it. There are so many other opensource alternatives that wait for you to be tried out.

Re: Skype blog hacked

#53

Post by krapp »

X4 wrote: post #52
krapp wrote: post #44

Earlier quoted context omitted.

How much of what's on that list actually applies to a recent version of Wordpress?

>> to a recent version of Wordpress Saying recent here isn't logical, because after patching the incident, it's not an incident anymore. But I guess you mean how secure you are with a recent version of Wordpress. I think this is though question, because Wordpress relies to a high degree on external components and plugins. There is probably no single pure Wordpress Blog, because the original Wordpress archive already…

Show me an alternative that I can sell to a non-technically minded client with a small business who just wants to blog and put up a youtube feed and do e-commerce and maybe SEO. And oh, they can't ever even know what a terminal is, much less git.

Re: Skype blog hacked

#54

Post by gregmolnar »

krapp wrote: post #53
X4 wrote: post #52

Earlier quoted context omitted.

>> to a recent version of Wordpress Saying recent here isn't logical, because after patching the incident, it's not an incident anymore. But I guess you mean how secure you are with a recent version of Wordpress. I think this is though question, because Wordpress relies to a high degree on external components and plugins. There is probably no single pure Wordpress Blog, because the original Wordpress archive already…

Show me an alternative that I can sell to a non-technically minded client with a small business who just wants to blog and put up a youtube feed and do e-commerce and maybe SEO. And oh, they can't ever even know what a terminal is, much less git.

Why should the client know git or anything else if you are the one who has to setup the blog for him/her? Or are you working with clients only who know html, css, ftp etc so they can do the work themself just being lazy and paying you instead?

Re: Skype blog hacked

#55

Post by Ergomane »

elwell wrote: post #8
t0 wrote: post #6

Earlier quoted context omitted.

You're right. It was probably a brute force since they don't have maximum login attempts. http://blogs.skype.com/wp-admin

Such a simple feature to implement...

It is only a simple feature if you don't care about DOS against the user account and do not have an adversary with a large botnet.

Re: Skype blog hacked

#56

Post by krapp »

gregmolnar wrote: post #54
krapp wrote: post #53

Earlier quoted context omitted.

Show me an alternative that I can sell to a non-technically minded client with a small business who just wants to blog and put up a youtube feed and do e-commerce and maybe SEO. And oh, they can't ever even know what a terminal is, much less git.

Why should the client know git or anything else if you are the one who has to setup the blog for him/her? Or are you working with clients only who know html, css, ftp etc so they can do the work themself just being lazy and paying you instead?

I think they don't want to be intimidated by complexity and don't want to have to pay someone more to deal with it for them in the future. Typically they want to be able to administrate the site themselves, and they can do that through web forms easily enough.

Re: Skype blog hacked

#57

Post by X4 »

krapp wrote: post #53
X4 wrote: post #52

Earlier quoted context omitted.

>> to a recent version of Wordpress Saying recent here isn't logical, because after patching the incident, it's not an incident anymore. But I guess you mean how secure you are with a recent version of Wordpress. I think this is though question, because Wordpress relies to a high degree on external components and plugins. There is probably no single pure Wordpress Blog, because the original Wordpress archive already…

Show me an alternative that I can sell to a non-technically minded client with a small business who just wants to blog and put up a youtube feed and do e-commerce and maybe SEO. And oh, they can't ever even know what a terminal is, much less git.

Try http://getkirby.com or http://concrete5.org or http://silverstripe.org there are many many other CMS or Blogging platforms too. For just Blogging as the main thing, you're perfectly set with https://ghost.org/

Without exaggerating, I've downloaded almost any CMS on Github and Bitbucket and Sourceforge and I'm almost done with testing all of them. I think about 15 remain. With all honesty, I cannot say that I'm impressed with any CMS so far. There is just one thing that stood out, with it's concept, but it's still only Alpha grade quality, that's: http://parsimony.mobi/

I've you're curious what I ended up with, just ping me and I'll share my results, after I've really compared all CMS with each other. Currently I would say that there are about ~10 good quality CMS, with hundreds of miserably coded ones. That is a good benchmark, for how good developers are in the real world, I mean there is only so much space at the top of the iceberg. Not everybody can excel with every project they start (well, except people like Fabrice Bellard)

I've not compared Typo3, Alfresco and other Enterprise CMS, because even when they come with all features loaded, they suck at code complexity and user friendliness

You can't tell me that Wordpress is the only blogging platform that fits to all of your requirements, because there are thousands of CMS out there and you'll spend weeks testing all of them.

Re: Skype blog hacked

#58

Post by X4 »

krapp wrote: post #56
gregmolnar wrote: post #54

Earlier quoted context omitted.

Why should the client know git or anything else if you are the one who has to setup the blog for him/her? Or are you working with clients only who know html, css, ftp etc so they can do the work themself just being lazy and paying you instead?

I think they don't want to be intimidated by complexity and don't want to have to pay someone more to deal with it for them in the future. Typically they want to be able to administrate the site themselves, and they can do that through web forms easily enough.

What you describe can easily be solved with Google Fusion Tables and a tiny script in your favorite server-side language.

Re: Skype blog hacked

#59

Post by krapp »

X4 wrote: post #57
krapp wrote: post #53

Earlier quoted context omitted.

Show me an alternative that I can sell to a non-technically minded client with a small business who just wants to blog and put up a youtube feed and do e-commerce and maybe SEO. And oh, they can't ever even know what a terminal is, much less git.

Try http://getkirby.com or http://concrete5.org or http://silverstripe.org there are many many other CMS or Blogging platforms too. For just Blogging as the main thing, you're perfectly set with https://ghost.org/ Without exaggerating, I've downloaded almost any CMS on Github and Bitbucket and Sourceforge and I'm almost done with testing all of them. I think about 15 remain. With all honesty, I cannot say that I'm im…

I'm not actually a Wordpress fanboy by any means (though it does pay the bills) - for my own personal use i'm setting my site up in Slim Framework. Professionally, though, i've found that if someone wants to blog or do "e-commerce", talking them out of Wordpress (and into something they're still willing to pay for) is a difficult thing to do.

Re: Skype blog hacked

#60

Post by krapp »

X4 wrote: post #58
krapp wrote: post #56

Earlier quoted context omitted.

I think they don't want to be intimidated by complexity and don't want to have to pay someone more to deal with it for them in the future. Typically they want to be able to administrate the site themselves, and they can do that through web forms easily enough.

What you describe can easily be solved with Google Fusion Tables and a tiny script in your favorite server-side language.

You're right - I think the problem is mostly one of marketing the alternatives.
Post reply on HN