Labs Notes Monthly Recap – Jan/2017
Estevao Avillez Every month we recap the latest posts on Sucuri Labs, written by our Malware Research Team (MRT) and Incident Response Teams (IRT). The Sucuri Labs…
Hiding malicious code from the user using white spaces
Yuliyan Tsvetkov Over the years, attackers have used different techniques for hiding malicious files on websites. They obfuscated code, changed legit functions to execute malware, modified whole…
RCE Attempts Against the Latest WordPress REST API Vulnerability
Daniel Cid We are starting to see remote command execution (RCE) attempts trying to exploit the latest WordPress REST API Vulnerability. These RCE attempts started today after…
JavaScript Injections Leads to Tech Support Scam
Krasimir Konov During a recent malware investigation, we found some interesting obfuscated Javascript code. This code pretends to appear as part of the popular AddThis social sharing…
Checking blacklisted domains or IP for spamming
Luke Leal Often times we will encounter websites that have been injected with a redirect and these can vary from blackhat SEO tactics for boosting domain rankings…
WordPress REST API Vulnerability Abused in Defacement Campaigns
WordPress 4.7.2 was released two weeks ago, including a fix for a severe vulnerability in the WordPress REST API. We have been monitoring our WAF…
Website Application Firewalls (WAF) – Practical Approach to Website Security
Tony Perez In 2016, I shared some thoughts about firewalls in general; their history and purpose in the information security domain. The point of the article was…
RealStatistics Goes TrafficAnalytics
Rodrigo Escobar In the last few months, our Incident Response Team detected an interesting malicious code that affected a high number of websites. This malware is a…
Content Injection Vulnerability in WordPress
Marc-Alexandre Montpas As part of a vulnerability research project for our Sucuri Firewall (WAF), we have been auditing multiple open source projects looking for security issues. While…
Joomla admin login bypass – set your UA for full admin access
Every day we analyse hundreds of new malicious files. Some of them are simple backdoors, injected iframes, or one liner defacements. Another type of malware,…
Fake Google Analytics tracking code leading to Adware
John Castro Our Incident Response process makes sure we remove all malicious files and other small pieces of code inserted in good files that could be used…