Comments on: WordPress Exploited – 2.8.4 Release

By: lauren

lauren — Wed, 24 Feb 2010 17:57:32 +0000

i was also hacked on a number of WP sites while using Rackspace.
Most recently, my master acct was hacked and an entire domain name and its hosted contents removed. after they told me it was my fault, and maybe the client changed it to be hosted elsewhere, they said, essentially, tough sh*t someone must have hacked it on your end. Right. at 3am on a weekday someone broke into my house logged into my account and deleted one website and all its files.

i better get a better door lock.

By: Angela

Angela — Mon, 18 Jan 2010 06:58:05 +0000

Just had a 2.8.4 site hacked. Yes, I know I should have at least been up to 2.8.6, but I just missed that update when 2.9 came out and some of our plugins wouldn’t work. The site is hosted on Network Solutions and apparently several sites were hacked this weekend on their servers. I still don’t know how they got in. They placed index.php.BAD files in various directories.

I was surprised because we had taken every security measure prior to this attack (with the exception of removing the generator tag — oops! — meant to do that but forgot on one of the templates). We had renamed the table prefix, had limit login attempts and the SEO WP Firewall plugins installed, were using limited plugins, did not use admin for username and had very strong passwords.

I’m reading these comments to see what I can do to scan to find out what caused the hack. Of course, Network Solutions was completely unresponsive and unavailable by phone, so it’s quite frustrating to watch hour by hour a hacker logged into your site and changing files (even after we changed all the passwords AGAIN and updated to 2.9.1). At one point, I changed the permissions on the themes folder, and the hacker promptly responded by deleting all my theme’s files. He was definitely watching my every move and responding in kind to my various attempts to block — in a personal not robotic way. Very creepy and annoying since I couldn’t get through to Network Solutions after being on hold for more than 30 minutes with no sense of a queue and just repetitive playing of Pachelbel’s Canon. I think they do that to encourage you to hang up.

By: Nobnoobody

Nobnoobody — Thu, 22 Oct 2009 00:47:00 +0000

Consider this a drive-by post, but I’m LOLing at the thought that this is blamable on wordpress. You said someone editted the template file. That means it wasn’t a security problem in wordpress but rather something else. Way to blame them for the problem.

(And this is coming from someone who loves Drupal far more than WordpresS)

By: Lon

Lon — Wed, 30 Sep 2009 03:03:24 +0000

Before switching to 2.8.4, our site was compromised. The @*%$! spammers deployed two files to our system /wp-admin/fotter.php and /wp-admin/inclode.php (note the purposeful misspellings). These were encrypted files that were web-based backdoors. These were causing our theme footer to be overwritten nightly.

By: Follow-Up To The Wordpress Exploit and Tips to Protect Your Blog | CenterNetworks

Tue, 22 Sep 2009 00:24:16 +0000

[...] With Newly-Acquired Omniture Potential Quantcast RivalTodays Startup and Entrepreneurial UpdatesWordpress Exploited 2.8.4 ReleaseEnsequence Grabs a Bundle of Cash and a New [...]

By: Otto

Otto — Mon, 21 Sep 2009 21:43:05 +0000

Make sure you search *real* good. A mere search for “base64″ isn’t enough.

See here: http://ottodestruct.com/blog/2009/hacked-wordpress-backdoors/

By: Otto

Otto — Mon, 21 Sep 2009 21:41:26 +0000

Yeah, and Macs are immune to malware too.

How many WordPress sites are there? How many Drupal sites?

Thought experiment: You’re a malware author. What do you target?

By: wplaat

wplaat — Mon, 21 Sep 2009 05:47:57 +0000

My WordPress 2.8.4 website was also hacked last three days. Footer.php is edited every night. Download file permissions were changed. Does anybody has a solution for it! Looking forward to all your replies!

By: Nikolay Kolev

Nikolay Kolev — Sat, 19 Sep 2009 20:29:58 +0000

Drupal indicates when a new version is not an “upgrade”, but rather – a required security patch. In WordPress, there’s no such indication and you should not expect people to rush to upgrade.

Anyway, kudos to WordPress for the one-click upgrades of everything – core, plugins, themes. This process is so painful with Drupal!

By: Mario Olckers

Mario Olckers — Sat, 19 Sep 2009 20:26:03 +0000

hey allen :) yeah, sure but my point is nevertheless to also look out for that kind of thing in themes found elsewhere on the web

many design and webdevelopment type sites have regular compiled lists of free themes and I have taken a couple apart and some had the encrypted string in the footer file

By: Chuck

Chuck — Sat, 19 Sep 2009 19:36:09 +0000

WordPress is leakier than Drupal but my Drupal sites have been hacked a couple of times.

The most important thing about any CMS is to stay up to date.

By: Deltina

Deltina — Sat, 19 Sep 2009 18:28:54 +0000

Matt,

I use the WP Security Scanner plugin on all of my WordPress sites, and I seem to keep relatively hack free. By relatively, I mean that there are hacking attempts, but they never get very far. Is this a plugin you would recommend for everyone, or is there another as well?

I am also a Drupal user, but am willing to take the risk with WordPress because of its user-friendly backend and its SEO and SMO superiority. If we as developers are using FREE software, we should be privy to the responsibility and risk that comes with it.

Thanks for all you do, Matt!!

By: Allen Stern

Allen Stern — Sat, 19 Sep 2009 18:16:25 +0000

just to confirm – the CN theme I made :)

By: Mario Olckers

Mario Olckers — Sat, 19 Sep 2009 18:12:04 +0000

@Admiral thanks for the good advice, also as you mentioned searching for the eval(base64) string, a lot of the free wordpress themes out in the wild has that very same string with the gobbledygook string of characters in the footer.php file and i think that is how many installs get pwn’ed

apparently it is to keep unscrupulous people from editing out the credit in the footers of themes, but in most cases it carries nasty backdoor entries into your wp install and ultimately the servers on which your blog is hosted

so stick to either the themes from wordpress.org or pay someone to customize or design your desired theme from scratch

just my 0.002 :)

By: Allen Stern

Allen Stern — Sat, 19 Sep 2009 17:58:37 +0000

Yep, this happened before – the backdoor was inserted into one of the core WP files which wasn’t easily noticeable.