Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


WordPress Site Hacks Continue

70% of WordPress sites are running outdated software and are vulnerable to hackers launching DDoS attacks. Recent examples hit MIT, NEA and Penn State servers.

WordPress installations sporting known vulnerabilities continue to be compromised by hackers and turned into distributed denial of service (DDoS) launch pads.

That warning was sounded last week after IT professional Steven Veldkamp shared an intrusion prevention system (IPS) log with Hacker News, which found that a single 26-second DDoS attack against a site run by Veldkamp was launched from 569 different WordPress blogs. Those blogs appear to have been compromised by attackers, since they comprised everything from a "mercury science and policy" blog at the Massachusetts Institute of Technology (which as of press time remained offline) and a National Endowment for the Arts blog to WordPress sites run by Pennsylvania State University and Stevens Institute of Technology.

"The key aspect to note here is the number of compromised WordPress servers," said Stephen Gates, chief security evangelist at DDoS defense firm Corero Network Security, via email. "It's a simple mathematical equation -- attackers are looking to infect servers sitting in hosting environments with each server easily capable of generating 1 Gbps of attack traffic. It is quite easy to generate extremely high volumes and varieties of attack traffic by compromising just a few WordPress servers."

Once WordPress servers get compromised, attackers can use them for a variety of purposes, such as attacking U.S. financial institutions. "From volumetric attacks that melt down firewalls to the 'low and slow attacks' that sneak through firewalls undetected -- the list is really endless," Gates said.

[ Could crowdsourcing lead to a better security solution? Read Project Sonar Crowdsources A Better Bug Killer. ]

WordPress blogs, of course, are easy to provision and host. But that ease of installation -- and use -- means that such software is often run outside the purview of IT provisioning and oversight. Furthermore, many WordPress administrators fail to keep their software updated or follow security best practices, such as choosing unique usernames and strong passwords for WordPress admin accounts. As a result, numerous WordPress sites sporting known vulnerabilities -- or "admin" as the admin account name -- remain sitting ducks for automated attacks.

Indeed, malware is often used to automatically find and exploit vulnerable WordPress installations. In August, Matthew Bing, an Arbor Security Engineering & Response Team (ASERT) research analyst, noted that the Fort Disco malware -- first discovered in April 2013 -- was being used to target known vulnerabilities in content management systems, backed by six command-and-control servers that were running a botnet comprised of more than 25,000 Windows PCs. "To date, over 6,000 Joomla, WordPress and Datalife Engine installations have been the victims of password guessing," he said in a blog post.

How widespread is the problem of exploitable WordPress software? According to a study conducted by EnableSecurity CEO Sandro Gauci, the list of the one million most trafficked websites -- per the Alexa index -- includes 40,000 WordPress sites. But 70% of those sites are running a version of WordPress with known vulnerabilities.

Those statistics were relayed last week by WordPress security expert Robert Abela, who studied data that EnableSecurity's Gauci compiled over a four-day period in the middle of September, immediately following the September 11 release of WordPress 3.6.1, which remains the latest version.

In a blog post, Abela reported that of the 42,106 WordPress sites from the Alexa index identified, 19% had already been updated to the new version, while 31% of sites were still running the previous version (3.6). But the remaining 51% of cataloged WordPress sites ran one of 72 other versions, with 2% of all cataloged sites still running version 2.x, which dates from 2007 and earlier.

Needless to say, many historical WordPress updates have included patches for exploitable vulnerabilities. For example, the latest version of WordPress -- 3.6.1 -- patched a known vulnerability in version 3.6 that would have allowed an attacker to remotely execute code. Previous versions of WordPress have also sported a number of known bugs, including version 3.5.1 (8 vulnerabilities), 3.4.2 (12 vulnerabilities) and 3.3.1 (24 vulnerabilities).

All of this adds up to numerous WordPress sites that can be relatively easily hacked, based on a review of the top 10 most-seen versions of WordPress seen among the more than 40,000 counted by Gauci. "At least 30,823 WordPress websites out of 42,106 are vulnerable to exploitable vulnerabilities," said Abela. "This means that 73.2% of the most popular WordPress installations are vulnerable to vulnerabilities which can be detected using free automated tools. Considering the number of vulnerable WordPress installations out there, and the popularity of such websites, we are still surprised ... most of them haven't been hacked yet."

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
10/15/2013 | 6:46:04 PM
re: WordPress Site Hacks Continue
Great article Mathew. The average small business owner does not have the time or staff do keep their WordPress websites up to date. That is why I created a complete WordPress monitoring and maintenance service called WP-MONITOR http://www.wp-monitor.com/ we we take care of all of these vulnerabilities on WordPress sites for the clients. Not only do we take care of the security, but we also provide Daily WordPress Backup, Plugin Updates, Uptime Monitoring, Traffic Reports, Broken Links reports, Security Scanning, Malware removal, Theme Changes, more features than any other WordPress Monitoring plan.
Eddie Mayan
Eddie Mayan,
User Rank: Apprentice
10/10/2013 | 9:18:46 AM
re: WordPress Site Hacks Continue
It is very necessary to update with security or get a very best option to try Managed wordpress service like Cloudways.
User Rank: Apprentice
10/1/2013 | 11:38:41 PM
re: WordPress Site Hacks Continue
I wonder what the NSA will make of my Pictures posted ( Altered Photos of Hitler performing Stupid Magic tricks and other Dada/Surrealist rants raves and absurdity, They'll probably think it's some Code for something and since I post my Beliefs as "Anarcho-Surrealist", which means Nothing. I mean the header of one of my blogs is " A Hobo with a Jar of Mustard", and the other is "How can I disturb your sense of Reality today?" Anyway, I think all American should set up a an Identical blog, that streams 24/7 webcam shots of Toasters, or Toilets, or the inside of an old boot in a ditch..
Joanie Mann
Joanie Mann,
User Rank: Apprentice
10/1/2013 | 8:48:54 PM
re: WordPress Site Hacks Continue
I agree with Mr Carr - get the site hosted by WordPress or another professional host that will ensure the software is kept up to date. Too many businesses try to take these responsibilities upon themselves, but don't really have the skills or resources to do it really well. The issue isn't just the vulnerabilities they introduce for their own businesses, it's the fact that they become effectively complicit in creating issues for others, too. While not as loathsome, it's rather like drunk driving, where the potential victim(s) is not likely to be only the driver.

Thomas Claburn
Thomas Claburn,
User Rank: Ninja
10/1/2013 | 8:09:15 PM
re: WordPress Site Hacks Continue
The fact that WordPress.com asked me to agree to its "fascinating terms of service" was almost enough to get me to sign up on the spot.
David F. Carr
David F. Carr,
User Rank: Apprentice
10/1/2013 | 4:16:46 PM
re: WordPress Site Hacks Continue
If you can't take responsibility for keeping the software up to date, consider whether hosting with WordPress.com is practical for your purposes. You can pay to upgrade from the free service to one associated with your domain and then let their webmonkeys worry about software patches.
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-05-13
An improper access control vulnerability has been reported to affect earlier versions of Music Station. If exploited, this vulnerability allows attackers to compromise the security of the software by gaining privileges, reading sensitive information, executing commands, evading detection, etc. This ...
PUBLISHED: 2021-05-13
A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to This issue does not affect: QNAP...
PUBLISHED: 2021-05-13
An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3...
PUBLISHED: 2021-05-13
An Authentication Bypass vulnerability in the SAML Authentication component of BlackBerry Workspaces Server (deployed with Appliance-X) version(s) 10.1, 9.1 and earlier could allow an attacker to potentially gain access to the application in the context of the targeted user’s acco...
PUBLISHED: 2021-05-12
Use After Free vulnerability in nfc sockets in the Linux Kernel before 5.12.2 allows local attackers to elevate their privileges. In typical configurations, the issue can only be triggered by a privileged local user with the CAP_NET_RAW capability.