4 ms·

Timthumb is how Wordfence came about because my own site was hacked via the vulnerability when it was an 0day and that's how I got involved in WP security. htt

Timthumb is how Wordfence came about because my own site was hacked via the vulnerability when it was an 0day and that's how I got involved in WP security. http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/ http://markmaunder.com/2011/08/02/technical-details-and-scri... Props to Ben. When I worked with him to fix timthumb I don't recall him mentioning that it was someone else who wrote the bug. There have been plenty of vulnerabilities just as bad or worse since - and it keeps our site cleaning team busy. Besides Timthumb, the other top WP vulnerabilities/exploits are Revolution slider, Mailpoet and Gravity Forms. You rarely see a site hacked via an old timthumb these days but it still shows up. Most hacked sites are from the other three newer remote code exec vulns I mentioned.

OSButler 10y ago
One big problem with Timthumb was that several themes came pre-bundled with it and to make matters worse, they often changed the name of the file, so that it wasn't enough to just scan for the filename but also for variants and file contents. At the time it was the exploit that kept on giving, since you would suddenly find another timthumb related file on the server that was being targeted, followed by another, ... In the end, a lot of the hosts simply blocked requests to timthumb related files, in order to try and stop it on the server level and not the individual account level. As you mentioned, these days the sites that I'm being contacted about that have been defaced or were hosting abusive content, are usually related to severely outdated plugins. I haven't seen a timthumb issue in quite some time, but had to restore a site that was affected by the original(!) Revolution slider exploit recently, due to having a several years old version of it installed.
bigiain 10y ago
Hey, thanks for Wordfence man! That was right near the top of the list of "must instal plugins" when I used to do WordPress...
jermaustin1 10y ago
3 plugins that are on everyone's "must install before you write a single post" lists. I never spoke to Ben outside of the comments thread for timthumb to introduce my modifications, but in 2009-2010 (then I lost my site to a bad host who didn't do backups), I know I hosted my cross-domain timthumb and it received tens of thousands of downloads before the exploit was found. If I recall correctly, the 0day patch was just a list of approved external domains that you had to open the code to add, but it was 5 or 6 years ago, so it is hard for me to remember everything perfectly.

OSButler 10y ago

One big problem with Timthumb was that several themes came pre-bundled with it and to make matters worse, they often changed the name of the file, so that it wasn't enough to just scan for the filename but also for variants and file contents. At the time it was the exploit that kept on giving, since you would suddenly find another timthumb related file on the server that was being targeted, followed by another, ... In the end, a lot of the hosts simply blocked requests to timthumb related files, in order to try and stop it on the server level and not the individual account level. As you mentioned, these days the sites that I'm being contacted about that have been defaced or were hosting abusive content, are usually related to severely outdated plugins. I haven't seen a timthumb issue in quite some time, but had to restore a site that was affected by the original(!) Revolution slider exploit recently, due to having a several years old version of it installed.

bigiain 10y ago

Hey, thanks for Wordfence man! That was right near the top of the list of "must instal plugins" when I used to do WordPress...

jermaustin1 10y ago

3 plugins that are on everyone's "must install before you write a single post" lists. I never spoke to Ben outside of the comments thread for timthumb to introduce my modifications, but in 2009-2010 (then I lost my site to a bad host who didn't do backups), I know I hosted my cross-domain timthumb and it received tens of thousands of downloads before the exploit was found. If I recall correctly, the 0day patch was just a list of approved external domains that you had to open the code to add, but it was 5 or 6 years ago, so it is hard for me to remember everything perfectly.