Attacks/Breaches
4/12/2010
04:20 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

'Design Flaw' Led To Wave Of Attacks On Hundreds Of WordPress Blogs

Database storing user credentials in plain text gets hacked

Hundreds of WordPress blogs were hacked during the past few days by attackers who pilfered blogger credentials stored in plain text in the database.

The researchers who discovered the attacks say a design flaw in the WordPress blogging platform was the underlying problem because by default it allows users to set up permissions that let anyone read their blog's wp-config.php file configuration files, and because WordPress stores the bloggers' credentials in plain text.

The attackers injected malicious iFrames into the blogs so that any visitors would automatically be infected with malware, including code that spreads fake antivirus software.

"A few people got hacked last week and asked us to help," says David Dede, founder of Sucuri Security, which also uses WordPress for its own blog. "We fixed them and in one site, just after we fixed it, it got hacked again. Looking at the logs, we didn't see any access in there at all, so the attack didn't come from the Web."

Dede says after further analysis and more complaints of hacked blogs, he and his team found that the blogs were getting hit with a malicious iFrame, and that the blogs were all hosted on Network Solutions' servers. Most were running the newest version of WordPress, 2.9.2, he says

The attacker basically created a scanner to locate all configuration files containing incorrect permissions, Dede says. "It read the database credentials from there and started hacking everyone," he says.

Network Solutions has now cleaned up the infected blogs and stopped the attacks by changing database passwords for WordPress. The hosting provider recommends that WordPress users log into their accounts and change their administrative passwords, as well as delete any administrative access accounts they don't recognize.

WordPress, meanwhile, says it hasn't seen any evidence that the attacks were related to a security problem with its software. Barry Abrahamson, systems wrangler for WordPress, says the attacks appear to have targeted weak file permissions. "File-level permissions and Web server security are the responsibility of the hosting environment, not the application," Abrahamson says. "WordPress can be installed a number of ways, and many hosts have built custom installers. I am not sure how WordPress was installed in these cases."

If a blogger wants to check if his site was hacked, then he should look for extra HTML in the header and view the source for any iFrames pointing to http://mainnetsoll.com/grep or http://networkads.net/grep, he says. "They can [also] try installing the WordPress Exploit Scanner plug-in," Abrahamson says. "The database scan portion of this plug-in should catch if a malicious iFrame code has been inserted into the options table in their database."

Contact your hosting provider if you find either of these issues, he adds, and ensure you're running WordPress 2.9.2.

The good news is the attacks were not as malicious as they could have been, Sucuri Security's Dede notes. The attackers modified only the site URL, he says. "So they were actually nice," he says.

Dede and other experts say the attacks suffered by WordPress could happen to most any popular blogging platform: "It's a hard problem to fix. They need the credentials stored somewhere, and the Web server needs to be able to read it," Dede says. Joomla, Mediawiki, and other blogging platforms that are set up the same way are also vulnerable to this type of attack when the permissions in the configuration files are set up incorrectly, he says.

Encrypting the credentials isn't an option because the keys have to be stored where the Web server can read them in order to decrypt the data, he says.

There's no way to decrypt the credentials for the database without accessing the database, WordPress' Abrahamson notes. "We would have to store the decryption key in another file somewhere on the file system. If a malicious user has access to the file system -- like they appeared to have in this case -- it is trivial to obtain the keys and decrypt the information. When you leave the keys to the door in the lock, does it help to lock the door?"

The users erred by setting up permissions for anyone to read the configuration files, Dede notes, although that was the default on WordPress. WordPress now is no longer recommending this, however, he notes.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3366
Published: 2014-10-31
SQL injection vulnerability in the administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to execute arbitrary SQL commands via a crafted response, aka Bug ID CSCup88089.

CVE-2014-3372
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM reports interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90589.

CVE-2014-3373
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM Dialed Number Analyzer interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCup92550.

CVE-2014-3374
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM admin interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90582.

CVE-2014-3375
Published: 2014-10-31
Multiple cross-site scripting (XSS) vulnerabilities in the CCM Service interface in the Server in Cisco Unified Communications Manager allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug ID CSCuq90597.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.