Security Advisory: Stored XSS in Jetpack
Marc-Alexandre Montpas During regular research audits for our Sucuri Firewall (Cloud WAF), we discovered a stored XSS vulnerability affecting the WordPress Jetpack plugin, currently installed on more…
PCI for SMB: Requirement 1- Install and Maintain a Firewall
Daniel Cid Update: Read our new PCI Compliance guide. If you have an ecommerce website, allowing you to accept credit cards on your site, PCI compliance should…
Magento CC stealer adding user’s credentials to the loot
Douglas Santos While analyzing a compromised Magento site, we found another Credit Card (CC) stealer variation. We posted a few times about this type of malware, but…
Nulled WordPress Themes: Malvertising and Black Hat SEO
Denis Sinegubko If you have been following our blog for some time, you know that we regularly warn about risks associated with the use of third-party software on…
Credit Card Stealer on OpenCart CMS
Cesar Anjos We have previously analyzed many Credit Card stealers code, specially targeting the Magento platform: Magento Malware Emails Stolen Credit Card Details to Hackers Magento script…
Backdoor in Fake Joomla! Core Files
Fioravante Souza We usually write a lot about obfuscation methods on Sucuri Labs and here on the blog. Sometimes we write about free tools to obfuscate your…
Mobile conditional redirect hidden in the database
Krasimir Konov We recently found a website that was redirecting mobile users to a third-party site called chickenkiller .com, after further investigation we found that the malware was…
Hacked Website Report – 2016/Q1
Our Remediation group is comprised of two distinct teams, the Incident Response Team (IRT) and Malware Research Team (MRT). These teams work closely with our…
Secure Coding: How to Account for Input Sanitization
Rodrigo Escobar On average, a website leverages around 18-20 different plugins in its structure. These plugins enhance the website’s functionality and in some instances extend the applications…
Domain Validation: SSL’s Other Job
Jon Watson SSL certificates are a hot topic today. Website owners are becoming increasingly aware that collecting information on non-HTTPS secured pages is a bad idea and…
New Wave of the Test0.com/Test5.xyz Redirect Hack
Last week we described the hack that randomly redirected site visitors either to a parked test0 .com domain or to malicious sites via the default7 .com…