WooThemes Security Audit Process & Development Partner WebDevStudios

PSA: December Zero Day’s Announced – MySQL, FreeSSH, Free FTPD

December 3, 2012 by Tony Perez 1 Comment

So it looks like we’re closing out the year in style in 2012. This weekend a number of new, very serious, zero-day vulnerabilities were released for a number of very popular applications – MySQL, FreeSSH, Free FTPD.

MySQL

FTPD

Remote Authentication Bypass

>FreeSSHD

Remote Authentication Bypass

Of the three, the most concerning is obviously MySQL. If you listen to any of our security presentations you know that your application is but one piece of the puzzle, and you environment is a critical component of that puzzle too.

MySQL is integral to any LAMP based application – LAMP = Linux, Apache, MySQL, PHP – this includes many open source content management systems (CMS) like WordPress, Joomla, Drupal, Magento, osCommerce and many more. This is exceptionally dangerous to those environments in which MySQL is being published (i.e., not bound to itself or it’s port open) to the world and applies to VPS and Shared environments alike.

Filed Under: awareness, communications, community, security, vulnerability Tagged With: awareness, vulnerability

Website Malware – SEO Poisoning

November 20, 2012 by Tony Perez 5 Comments

We’ve been seeing a lot of cases of SEO poisoning as of late and felt it was time to spend a little more time explaining it. That’s what this post will be about.

SEO, short for Search Engine Optimization is all the rave these days. Anybody that owns a website and is trying to make an impact or working to improve their traffic has heard the term, and has undoubtedly become an SEO expert. If you’re not familiar with SEO here is your quick definition:

…the process of affecting the visibility of a website or a web page in a search engine’s “natural” or un-paid (“organic”) search results.. – Source: Wikipedia

Many organizations will actually enlist the help of marketing consultants to assist in this optimization process and ranking on the first page is highly coveted by many. In essence, if you are able to rank on the first page for a specific keyword, phrase, subject, etc… you have the ability to generate a lot of traffic to your site. This in turn increasing the odds of visits, and if you’re an e-commerce site often equates to purchases, and if you’re a services company often equates to new clients. The idea is simple and highly effective, and what is even better is that most search engines like Bing, Yahoo and Google offer set criteria’s designed to improve your ranking within their searches.

It all sounds pretty awesome right?

Read More

Filed Under: awareness, hacked, Malware, pharma, security, Spam, sucuri Tagged With: pharma, security, seo, SEO Poisoning, sucuri

PSA: Skype Vulnerability Released

November 14, 2012 by Tony Perez Leave a Comment

While not exactly related to web security, it’s always good to take a minute to look at the web’s cousin, the desktop. On November 13th a Skype vulnerability was released that would allow an attacker to hijack an existing account. All the attacker would need is to know the primary email on any account.

The vulnerability is actually ingenious in retrospect, and it’s interesting it hadn’t been identified earlier. Do note however that it had been out for a few months. Protalinski with The Next Web explains how it works:

Read More

Filed Under: awareness, security, sucuri, vulnerability Tagged With: awareness, security, skype, sucuri, vulnerability

Joomla Pharma Hack – Web Malware Removal

November 6, 2012 by Fioravante Souza 2 Comments

In my last SEO poisoning post I wrote about some really nasty conditional malware. In this one, we’re going to revert our attention to the more common variation of the attack, and look at the Joomla CMS.

Joomla Pharma Hack

This variation will be the Pharma hack. As of late, it seems to be going on a rampage on a number of CMS applications and many of its characteristics are similar. The objective appears to be clear though, find its way into Google’s search engine result pages (SERP).

While we can only speculate, the idea is simple – The SERPs are a cached product and as long as they keep the injections benign of malware they increase their odds of bypassing detection until someone spots it and reports.

Read More

Filed Under: joomla, Malware, pharma, security, SiteCheck, Spam, sucuri Tagged With: hack, joomla, Malware, pharma, Spam, sucuri

WordPress Security Hangout – Grand Rapids WP Meetup

October 19, 2012 by Tony Perez 1 Comment

Every now and then, trying to summarize a conversation doesn’t do it any justice. Here is the discussion in its entirety between Dre Armeda, Mark Jaquith and I, Tony Perez, for the recent Grand Rapids WP Meetup. As you might imagine, it’s about WordPress Security:

It’s lengthy, true, but it covers a number of subjects. Everything from passwords, their management, to hardening and appropriate security controls.

If you’re not familiar with Mark Jaquith, you should be. He has been actively engaged in the WordPress community for 8 years +, is a lead developer for the project and has contributed countless patches to the core, many addressing security issues. If you’re looking for development advise or for a third party audit of your code then he’s about as good as it gets, be sure to check him out at http://coveredwebservices.com/

Filed Under: awareness, corporate, security, sucuri, WordPress

Is WordPress.com SPAM Campaign Due to Compromise?

October 16, 2012 by Tony Perez 6 Comments

*****Updated – 20121019*****

Both Matt Mullenweg and Barry Abrahamson, System Wrangler with Automattic, have confirmed that there was not an environmental compromise and everything was isolated to individual user accounts.

Per their incident handling process they identified a brute force like attack which made use of a list of compromised email / password combinations derived from a third-party application[s].

People often use the same username and password on different sites, even though we all know we shouldn’t. If a password on a smaller site is compromised bad guys try it against the big ones like Twitter, Facebook, and WordPress.com. If anything bad happens to a WP.com user we get in touch with them as soon as possible to assist them. – Automatic.com

At this point it’s unclear of the severity, as WordPress.com has not released anything public, but I would say the odds are not in their favor.

The Hacker News (THN) put out an article this morning titled: 15000 WordPress Blogs Hacked For making Money From Survey.

WordPress.com Spam

Naturally my first reaction was, meh, it’s likely a fluke of some kind, but as I read it I became more suspicious. It all started with this email:

Read More

Filed Under: awareness, communications, security, Spam, sucuri, WordPress Tagged With: automattic, compromise, security, Spam, sucuri, WordPress

Vote SPAM For President: New Election Tactics or Same Old Tricks?

October 15, 2012 by Dre Armeda Leave a Comment

The United States presidential campaign is going full force, and it’s been a doozy. We don’t typically get involved with political situations, short of cleaning some of the crazy defacements we see, this is an exception.

Vote Spam
This election campaign has brought its typical bashing via commercials, the usual rhetoric we see in interviews, and even those cool vote for (plug in your favorite candidate) stickers. My personal favorite was the vice presidential debate which left me feeling like I was on the grade school playground making faces and sticking my tongue out at the resident bully.

Times have adapted a bit, and the tactics have changed along with the advancements in communications, and social interaction. Twitter discussions boasting crazy statistics, Facebook posts about how awesome each candidate is, all of these have even spawned interesting debate and discussion in my own social groups.

Apparently, the crazy and debatably bad tactics stem beyond the historical mediums into our lovely world of geek. I guess it was only a matter of time.

We have drummed up a couple of theories on how this happened, ultimately it’s up to you to decide. More on that at the end.

Read More

Filed Under: blacklisted, election, research, security, SiteCheck, Spam, sucuri Tagged With: blacklist, comments, election, security, Spam, sucuri

Dealing with WordPress Malware

October 11, 2012 by Tony Perez 8 Comments

A few months back I contributed to a post with Smashing Magazine on the top 4 WordPress Infections, it was released yesterday, and it couldn’t have been at a better time. If any one attended WordCamp Las Vegas you might even find some similarities. Fortunately in the process of preparing for the event and working with the team, we were able to compile a bit more information expanding on the things we originally discussed in the last post. It’s perfect timing for a number of reasons, and will complement this post very nicely.

WordPress Malware
The idea of this post, like many in the past, is to outline and discuss this past weekend’s presentation. In the process, hopefully you take something away. Unfortunately, the presentation was capped off with a live attack and hack, and I won’t be able to include that in this post, but I promise it’s coming.

**Note: If you plan to be at WordCamp Philadelphia 2012 you might be in for some treats, just saying. And if you don’t have it on the calendar, you should.

Read More

Filed Under: awareness, blacklisted, google, hacked, htaccess, Learn, Malware, phishing, php, plesk, protection, Redirects, research, security, SiteCheck, Spam, sucuri, vulnerability, WordPress Tagged With: infections, Malware, security, sucuri, vulnerability, WordPress

WordPress Themes: XSS Vulnerabilities and Secure Coding Practices

October 4, 2012 by Tony Perez 4 Comments

As many might imagine, my life revolves around Information Security. If you’re like me, you’re undoubtedly seeing all these new posts talking to insecurities in WordPress themes, specifically a plethora of Cross-Site Scripting (XSS) vulnerabilities. Surprise, surprise, right? Yeah, no, not so much.

WordPress Theme XSS Vulnerabilities

Here are some of the posts I am referring to:

F-Secure – WordPress Premium Theme XSS Vulnerability
PC Magazine – More XSS Vulnerabilities Found in WordPress Themes
Sophos Threatpost – Some WordPress Themes, Thousands of Sites Open to XSS Vulnerability

Read More

Filed Under: developer, security, sucuri, vulnerability, WordPress, xss Tagged With: security, sucuri, themes, vulnerabilitiy, WordPress, xss