4 ms·

This "breach" happened a year ago and all sources indicate that it was an inside job. Seeing Wordfence using this to promote their product does not create much

This "breach" happened a year ago and all sources indicate that it was an inside job. Seeing Wordfence using this to promote their product does not create much confidence.

disposeofnick9 11y ago
Yup, sounds like press-release marketing. A terabyte+ of crown jewel dbs doesn't sprout legs, even from an APT.
creullin 11y ago
I dunno if this promotes their product all that much. It does highlight some major issues with out of date plugins and WP installs though.
- nissehulth 11y ago
  Well, that may be worth saying again and again, though those who need to understand it are probably not reading anything security related anyway.
mmaunder 11y ago
Wordfence ceo here. All sources? Did you read the forbes article we link to? Edit: One of the partners confirmed it's a hack. http://www.bbc.com/news/world-latin-america-35975503 http://www.bbc.com/news/world-latin-america-35975503
- nissehulth 11y ago
  Right, let me rephrase that. "All reliable sources indicate that it was an inside job".
  - mmaunder 11y ago
    Cite yours please.
    - Fundlab 11y ago
      Is this speculative forensics or an absolute? Does the fact that they have an outdated plugin mean the leak was siphoned by that? Im genuinely curious
      - mmaunder 11y ago
        We're just reporting what we know at this point and what we think is likely. What we know is that their web server had access to _client data_ (the client portal). Two websites had vulnerabilities - both the WP site and the Drupal site. And it is _client data_ that was exfiltrated. So in my opinion it's highly likely that the client data was taken via either a Drupal or WP attack vector. Even if this beach didn't happen, the client data eventually would have been stolen via one of these vectors. There are thousands of bot scripts that are exploiting revslider every day and so it's inevitable the site would have been hacked repeatedly and someone would have noticed a 2.6TB database that the web server had permission to access. To illustrate: I've seen scripts running in real-time coming into a honeypot that run 'show databases;' and then dump everything to a .sql file in a public web directory and hit that URL to download. An attacker might have gotten a partial dump and then gone OMG and gone back for seconds... and thirds, and fourths...
        truthfinder007 11y ago
        I think the use of "reporting" is a stretch.. you're speculating and twisting information in your favor. You're right, data was exfiltrated... Do we know if the portal was on the same server as the website? You seem to be making that connection, but that hasn't been illustrated. So if you're opinion is that it was either a Drupal or WordPress attack vector, why not highlight that in your article or subsequent email? Based on your email, you imply it was WordPress but fail to make this point...
        mmaunder 11y ago
        OK "truthfinder007" whose account was created 2 hours ago and has karma of 2. I think I've had about enough of what's going on here. Tell your boss I say hi and that he owes me a beer at the next wordcamp. ;-) Edit: And then I looked at your comment history. Seriously? http://i.imgur.com/HBqJ8vV.png http://i.imgur.com/HBqJ8vV.png
- deleted 11y ago
  [deleted]

This "breach" happened a year ago and all sources indicate that it was an inside job. Seeing Wordfence using this to promote their product does not create much confidence.

disposeofnick9 11y ago

Yup, sounds like press-release marketing. A terabyte+ of crown jewel dbs doesn't sprout legs, even from an APT.

creullin 11y ago

I dunno if this promotes their product all that much. It does highlight some major issues with out of date plugins and WP installs though.

nissehulth 11y ago
Well, that may be worth saying again and again, though those who need to understand it are probably not reading anything security related anyway.

mmaunder 11y ago

Wordfence ceo here. All sources? Did you read the forbes article we link to? Edit: One of the partners confirmed it's a hack. http://www.bbc.com/news/world-latin-america-35975503 http://www.bbc.com/news/world-latin-america-35975503

nissehulth 11y ago
Right, let me rephrase that. "All reliable sources indicate that it was an inside job".
- mmaunder 11y ago
  Cite yours please.
  - Fundlab 11y ago
    Is this speculative forensics or an absolute? Does the fact that they have an outdated plugin mean the leak was siphoned by that? Im genuinely curious
    - mmaunder 11y ago
      We're just reporting what we know at this point and what we think is likely. What we know is that their web server had access to _client data_ (the client portal). Two websites had vulnerabilities - both the WP site and the Drupal site. And it is _client data_ that was exfiltrated. So in my opinion it's highly likely that the client data was taken via either a Drupal or WP attack vector. Even if this beach didn't happen, the client data eventually would have been stolen via one of these vectors. There are thousands of bot scripts that are exploiting revslider every day and so it's inevitable the site would have been hacked repeatedly and someone would have noticed a 2.6TB database that the web server had permission to access. To illustrate: I've seen scripts running in real-time coming into a honeypot that run 'show databases;' and then dump everything to a .sql file in a public web directory and hit that URL to download. An attacker might have gotten a partial dump and then gone OMG and gone back for seconds... and thirds, and fourths...
      - truthfinder007 11y ago
        I think the use of "reporting" is a stretch.. you're speculating and twisting information in your favor. You're right, data was exfiltrated... Do we know if the portal was on the same server as the website? You seem to be making that connection, but that hasn't been illustrated. So if you're opinion is that it was either a Drupal or WordPress attack vector, why not highlight that in your article or subsequent email? Based on your email, you imply it was WordPress but fail to make this point...
        mmaunder 11y ago
        OK "truthfinder007" whose account was created 2 hours ago and has karma of 2. I think I've had about enough of what's going on here. Tell your boss I say hi and that he owes me a beer at the next wordcamp. ;-) Edit: And then I looked at your comment history. Seriously? http://i.imgur.com/HBqJ8vV.png http://i.imgur.com/HBqJ8vV.png
deleted 11y ago
[deleted]