Prestige Conference Means Business


A great career in business could be likened to a well penned novel. It will be wrought with twists, sharp turns and will feature dull plateaus as well as the occasional apex. Woven among the exposition, rising action, climax, falling action and finally a resolution, the story line of each career can change very quickly. This statement rings even truer in the current world economy. However, while still in movement, any career can always use fresh perspective, direction, and new goals or ideas.

Perhaps you are a serial entrepreneur exploring the possibilities for your next start-up. Or, maybe you are a mid-career professional working toward your next big move. You could possibly be in the process of re-branding yourself to leverage your current position and network in a new improved way. Regardless of the Business/Career stage you are in, Prestige Conference offers not only valuable information, but also quality relationships that can better purpose, position or power your next steps.

Learn From the Best

Our friends at the Prestige Conference have engaged in careful consideration as they evaluated and ultimately decided on which speakers in which they would invest in effort to provide the best opportunities for the personal and professional growth of attendees. Boasting patronage and sponsorship from among arguably the best and brightest minds in the tech and business space, Prestige is an event designed to make real impact for real people. This is one of the many reasons Sucuri has partnered with Prestige and will be represented by our very own Co-Founder and CEO, Tony Perez who speaks at 10am on the business of security.

As a brisk preview, our CEO, Tony Perez, will specifically highlight challenges we have faced as we build one of the fastest growing and most recognizable brands in website security. Attendees will receive a wealth of wisdom as Tony shares what it means to build your business around true value in an industry often riddled with manipulation and skewed with Fear Uncertainty and Doubt (FUD) and/or snake oil. Navigating such terrain will undoubtedly offer insight which will be applicable across a variety of backgrounds. Whether you participate in person or view virtually, you are encouraged to tune in and tap into one of the minds on our leadership team that is inspiring and guiding our company into its next phase.

The conference begins TOMORROW and therefore would call you to speedy registration. However, if you are unable to attend in person, you should still capitalize on the conference by taking advantage of their live-stream. No need to miss! Hope to see you there!

WP-CLI Guide: Secure Plugin & Theme Management

WP-CLI Guide to Plugins and Themes

Welcome to our third post on WP-CLI for secure WordPress management over an SSH command line interface. In our previous two articles, we discussed how to connect to WordPress over SSH, and then how to back up & update WordPress securely.

Like other open-source content management systems, WordPress lets you easily add code to make your website look and act differently. These are your themes and plugins, built by inspired developers and designers who understand how WordPress works. It’s these extensions that allow you to publish content with added functionality for your visitors and what facilitates the unique look of your brand.

The people who build these extensions know quite a bit about internet technology when it comes to user experience, but there are just too many ways to break a website. All developers should be ready to deal with a security flaw by patching and notifying users of an update if it comes to that.

Security is not the core competency for most developers and designers. Even the most secure code in the world has flaws that can allow an attacker to gain unauthorized access.

WordPress Plugin and Theme Security

Plugins and themes are no exception, in fact, exploitation of software vulnerabilities is one of the leading causes of WordPress infections.

Read More

Malicious Google Analytics Referral Spam



Robots (bots) have outnumbered people on the Internet for almost two years, and they browse much faster than your average visitor. Aside from spamming your comment systems and crawling for vulnerable websites to attack, bots can also cause a lot of confusion in your website traffic reporting systems.

If you use analytics software on your website, you may have already noticed some strange, inexplicable referrers in your reports. The scourge of malicious referrals and bad bots is becoming a real problem. Over the past six months, Google Trends shows an exponential increase in search engine queries involving “referral spam” and “google analytics spam.”
Read More

WP-CLI Guide: Secure WordPress Backup and Update

WP-CLI Guide to Secure WordPress Updates and Backups

Welcome to our second post in the series on WP-CLI for WordPress management over SSH. In our previous post, we discussed how to get your SSH credentials and use WP-CLI to connect to your website over the command line.

Before we get into changing anything, we’ll show you how to back up your database and compress it with your files to make sure you have a complete backup of your system. For this, we’ll have to go a bit beyond WP-CLI’s capabilities and use some normal command-line tools to finish the backup.

After your website (database and files) is securely backed up and transferred to a safe location, you can update the WordPress core and DB without any worries.

Sometimes, things go wrong! Be sure to read our tips on how to back up your website safely.

Read More

WP-CLI Guide: Connect to WordPress via SSH Intro


Do you use the WordPress dashboard to update plugins and themes? How do you back up your database? If you have not used it yet, WP-CLI is an efficient way to manage your WordPress installation using a command line interface, meaning you type text commands like these two:

wp core update
wp plugin update-all

You type these lines into a Secure Shell (SSH) window that is connected to your website server. If you are new to using command line interfaces, this is a great place to start learning. Beginners will feel like masters of the Matrix in no time.
Read More

10 Years of Joomla! – Supporting JoomlaDay Minnesota


As Joomla prepares to celebrate its 10 year anniversary, we want to be certain to join in the festivities.

Why? Because open source platforms allow individuals to better support their families, capitalize on time at home, and maximize earning potential. The follow up questions to these assertions could be: “How do you come to that conclusion? How is that important to a website security firm?”

Making a Better Internet

First, open source platforms provide lower barriers to entry which enable would-be business owners to effectively “start-up.” Of the many users who have opted to utilize Joomla, we recognize the number of successes that make up between 2.5% to 3% of the most prominent 1 million sites worldwide. Alone, that percentage is a great foundation that lends itself to the legitimacy of such an open source community.

However, there is yet another element that ties our interest to the Joomla community. As a company whose core purpose is rooted in providing security, we can appreciate the access, reliability, and sustainability offered through the Joomla! open source community. The goals motivating and maintaining Joomla’s commitment are essentially the same as ours here at Sucuri.

We want our customers to experience a safe and capable Internet. We want them to have an experience that allows them to maximize their online potential without the hassles of nuance and micro-details which can be more easily addressed through an “economies of scale” model. Joomla accomplishes that in the same way we accomplish security for our clients while still facilitating flexibility and customizability.
Read More

Common Website Security Terminology Defined


If you want to keep your website safe, it is important to understand the website security terminology used to describe the causes and effects of hacks. Software vulnerabilities and access control issues are two of the main causes of website infections, and in this post we will define some of the terminology used to describe them. We will also discuss some of the effects of having a hacked website in order to give you a well rounded understanding of both the symptoms and the consequences.

Read More

Analyzing a Facebook Clickbait Worm


Here at Sucuri we suspect everything, especially when your friends start to share content written in another language with clickbait headlines. Malicious Facebook posts are one way that hackers can use social engineering to attract and attack victims.

If you are not familiar with the term, clickbait is when web content is created in a way that psychologically exploits the reader’s curiosity using compelling headlines. When someone clicks on the article to read it, the service promoting the article generates online advertisement revenue.

You may know several websites that rely on strategies like this, with BuzzFeed being the typical example. You have already read headlines like: You won’t believe what this guy did after doing that other thing! Or 27 things that people with some personality do! Most of these sites just want your click (and the revenue that they generate), however, some of them turn to the dark side in order to get their message out.
Read More

Websites Hacked Via Website Backups


The past few months we’ve been spending a good deal of time talking about backups. This is for good reason, they are often your safety net when things go wrong; interestingly enough though, they are often the forgotten pillar of security. It’s why we spent some time thinking through what a good backup strategy might look like. As in most things however, we have to give real-world examples to help illustrate not only the value of backups, but also the potential threats they pose.

In our strategy discussion, you might recall our emphasis on the location of your backups. As described, the act of having a backup is great, but having it on the same server, worse yet, in the same web directory, can be devastating.

An example of this is in the database backups. The database backup does not just contain your posts, pages and comments; it holds something so much more valuable – think usernames and passwords.

Websites Hacked Via Website Backups

How ironic to think that the thing that is designed to be your safety net, can also be used against you. Such is the tale with Website Backups, when employed incorrectly. We want to focus specifically one type of backup, those of your database.

Most website owners believe that your information on the website server itself is safe from prying eyes, and in most instances that’s true, but in many instances it’s not.

You might be thinking, “But my database backups are not linked anywhere on my website.”

Search engines though, are still able to index a web directory via a process known as Directory Indexing. Directory indexing occurs when a normal base file is missing (i.e., index.html / home.html/default.htm/default.aspx, etc..). If one of these files are not present, the web server will issue a directory listing, which in turn causes them to be indexed via search engines. Those directories might have a treasure throve of content that isn’t meant for public consumption; information you might not want indexed.

There are a number of things that Directory Listing can lead to, they include some of the following:

  • Backup Files
  • Temporary Files
  • Hidden Files
  • Naming Conventions
  • Enumerate User Accounts
  • Configuration File Contents
  • Script Contents

A good example can be seen using a carefully crafted Google search.  We were able to find the following database backups being indexed by Google:

Databases in Google Search Results

Databases in Google Search Results

If a user were to download these files, they’d be able to find information like user information, hashed passwords and a number of emails in plain text (great for spamming and new phishing lures):

Sensitive user information is readable from the file

Sensitive user information is readable from the file

Cracking Hashed Database Passwords

The first anticipated argument is the fact that the passwords are hashed. That’s true, they are.

However, the art of password cracking has evolved greatly over the years. What makes it more convenient for the attacker is that they do not have to expend much energy attacking a website directly, they are able to download the files locally and perform a series of Brute Force techniques to reveal the password.  All that is needed is the right brute-force software; yes, there are a wide range of tools freely available that the attacker configure and deploy daily.

The worst part is, you won’t even know you’ve been,, or are under attack; until it’s too late.

The discussion of password cracking is not new, it’s been going around for years. Joseph Bonneau wrote back in 2013:

Password cracking can be evaluated on two nearly independent axes: power (the ability to check a large number of guesses quickly and cheaply using optimized software, GPUs, FPGAs, and so on) and efficiency (the ability to generate large lists of candidate passwords accurately ranked by real-world likelihood using sophisticated models). It’s relatively simple to measure cracking power in units of hashes evaluated per second or hashes per second per unit cost.

To put this into context, Jeremi Gosney, Founder & CEO, Stricture Consulting Group (an organization that cracks passwords for a living), was able to crack 14,734 of 16,449 MD5-hashed passwords in 20 hours, using a common computer with a single AMD Radeon 7970 graphics card.

That’s over 90% of the passwords on the list. The experiment was conducted by Ars Technica in response to a previous test conducted by one of their reporters, Nate Anderson, who was able to decipher close to half of the same 16,000 cryptographically hashed passwords that Jeremi worked on. All done with no experience in the art of password cracking.

Granted, this example is specific against an MD5 hash.

Most cryptographers out there will laugh that it’s employed, and as such the passwords deserve to be revealed. No arguments there! It’s also why some of the more modern CMS applications, including WordPress and Joomla!, leverage some salt+md5 hashing configuration. Unfortunately, that’s of little comfort as the technology has evolved and tools like HashCat have hit the market making the cracking of those passwords that much easier to crack.

Hardening Server Directories

The emphasis on the art of cracking is important to help drive the point home on the importance of your backups. They contain information that is critical to your website, and most likely your online brand and business.

It’s why we place so much emphasis on a good policy for passwords, and always recommend randomly generating them, retaining a good length (greater than 20) and the use of a password manager. All this is moot however if the attackers can get access to the hashes themselves (via your database backup).

If you must store the backups on the same server/account as your website we recommend placing them outside the public web directory. Please, also make sure they are not accessible from the outside.

You can also add additional rules to the .htaccess file inside the backup directory to further harden it:

# Block Directory Listing 
Options -Indexes

This will only work if your web server is configured to allowed server overrides. If on a shared host, be sure to ask your host for guidance.This configuration is only for those on Apache web servers.

If you’re using NGINX, another very popular web server, the directory listing option is disabled by default.

Windows IIS however, is similar to Apache, in that it’s set to enabled by default, so to disable directory listing you’ll want open the command line on your web server and use the following:

appcmd set config /section:directoryBrowse /enabled:false

Don’t Underestimate the Value of Your Backups

Backups are a critical piece of your overall security posture, be sure to have them. Having a backup however is just the first step, you must have a good approach to creating them and more importantly storing them.

There is no greater example than the impacts if your database backups were to get into the wrong hands. Database backups contain secret / sensitive information about your users; things like their email addresses, and passwords to name a few (varies on what you collect), and wide range of other data. In the wrong hands, this information can be used to wipe out your website, worse yet, attack your users. We’ve illustrated the processes employed by today’s attackers to crack passwords in an effort to demonstrate its impacts. When a hacker gains access to your information, there is no telling what will happen next.

Make sure that you keep your website backups in a secure location. If you don’t have such a configuration and you’re a client, we highly recommend looking into the Sucuri backup service.


10 Tips to Improve Your Website Security


In recent years there has been a proliferation of great tools and services in the web development space. Content management systems (CMS) like WordPress, Joomla!, Drupal and so many other allow business owners to quickly and efficiently build their online presences. Their highly extensible architectures, rich plugin, module, extension ecosystem have made it easier than ever to get a website up and running without years of learning required.

This is undoubtedly a great thing; however, an unfortunate side effect is that now there are many webmasters who do not understand how to make sure their website is secure, or even understand the importance of securing their website. In this post I want to share with you the top 10 steps all webmasters, website owners, can, and should, take to keep their website secure.
Read More