14 ms·
New attacks today against Wordpress (lots of sites hacked)
- tptacek 16y agoAvoid Wordpress. Sometimes a short comment is that's warranted.
- fseek 16y agoAvoid Wordpress and shared hosts. They mention that all the sites hacked were on shared hosts.
- ube 16y agoAvoid Wordpress...really? I can understand avoiding shared hosts because you have less control of the environment but going to an alternative blogging platform because it is more obscure than Wordpress seems to be a bad approach (and if you go with a vps solution you might have the headaches of maintaining a secure distro). This is like saying "you should use Linux or Mac because Windows gets attacked more". Any piece of software that is popular (I saw a recent statistic that wordpress powers %10 of the top 1 million sites as ranked by Alexa) will be much more vulnerable to attack than less popular software. At the same time, you get a bigger community and all the goodies that come along with that popularity (more plug-ins, themes, etc...). I don't think that getting rid of the software is the correct approach in this case. You need to approach it by assuming that your wordpress site will be attacked every day and you need to have a plan to remediate this. There is no perfect security unless you unplug your web server from the internet. For a one blogger site - one simple approach would be to: 1. Run something like open source tripwire (http://sourceforge.net/projects/tripwire/ http://sourceforge.net/projects/tripwire/) on a nightly basis so you can get alerted if any wordpress files get changed (HN peoplez: anyone have a better tripwire-ish solution that is free?) 2. Run a nightly backup of your files and db and mail it to an external account (like a gmail account) 3. have a script that can reload your files and database quickly from your backups (obviously - this needs to be tested) 4. subscribe to the wordpress security list and to a blog like http://www.wpsecuritylock.com/blog/ http://www.wpsecuritylock.com/blog/
- tptacek 16y agoI agree that Wordpress gets attacked more, and has more vulnerabilities uncovered, because it is popular. Unfortunately, that isn't the only reason. It is the same worst-of-both-worlds combination that WinXP SP 1 was in 2003.
- shadowsun7 16y agoYou seriously sure Wordpress is at fault here? http://wordpress.org/support/topic/396524#post-1506114 http://wordpress.org/support/topic/396524#post-1506114
- andrewvc 16y agoInfrequent bugs are a feature, they keep users from having to upgrade their software, which is annoying. That's why I avoid Wordpress. I've never looked at the WP codebase, but I'm just flabbergasted that a piece of blogging software that's been around this long has so many holes. Anyone who just wants to run a simple blog with minimum hassle on a VPS is terribly ill served by Wordpress.
- pronoiac 16y agoHN peoplez: anyone have a better tripwire-ish solution that is free? AIDE - http://sourceforge.net/projects/aide/ http://sourceforge.net/projects/aide/
- ube 16y agoThanks!
- kmano8 16y agoWordpress hosted on my linode vps seems just fine. Switching from godaddy to linode was more than worth the price increase.
- mitchellhislop 16y agoAgreed. Also, making small changes to some of the config helps too. This is why I laugh at people who know nothing about hosting, permissions, or php in general deciding that they know WP, put it on a shared box without doing the proper setup, and then blame wordpress when it gets hacked.
- tptacek 16y agoMost of the Wordpress breakins have been the fault of Wordpress' code, not admin incompetence.
- niyazpk 16y agoCan you please point out some reasons why you think WordPress code is faulty?
- tptacek 16y agoNote that you could tell me that Wordpress has changed drastically for the better since I stopped paying attention to it. I would concede that you might be right, but wouldn't change my recommendation at all. It's simply not worth arguing about. Here goes: * It's written in PHP, a platform on which "remote file inclusion" vulnerabilities --- where attackers can source code to run on the server from MySpace --- continue to be found. I hesitate to bring this up, since (for instance) the last public vBulletin flaw that would have cost you your site goes back to 2008. * It has an authentication design that uses the same database tables to track administrators who can run code on the site and anonymous Internet commenters. * It has a template language that allows graphic designers to write templates that run code on your server. * It hand-codes SQL statements largely out of concatenated queries. * It is internationalized but has no coherent strategy for dealing with character sets and input filtering, on which it relies heavily, resulting in relatively recent vulnerabilities enabled by for instance UTF-7 inputs. * It includes in the admin interface an editor for site templates that amounts to a remote login to the server, since, again, templates can run code. * It has a vibrant community of plugins implemented by people who know exactly enough PHP to get their code working, which means every one of these flaws is repeated for every plugin developer.
- elidourado 16y agoEntrepreneurs take note. This is a problem that is not being solved. There are lots of smallish bloggers out there who want more customization than Blogger/Wordpress.com/Tumblr/Posterous allow, whose best option is Wordpress and shared hosting. This is a sucky best option. Do something about this; make some money solving this problem.
- llimllib 16y agoWell, at the risk of derailing the conversation... I've extensively customized tumblr. I have beefs about some other elements of their service, but what sort of customization are you talking about that's not possible with tumblr?
- elidourado 16y agoAs I understand it, with Tumblr you can't customize your URL structure, you need to use external commenting systems, and your themes can't run non-js code. Also, many people use Wordpress as a hybrid CMS/blog; the ability to have pages (again with a defined url structure) is important.
- llimllib 16y agoIn order: 1) your blog will have to use their URL structure, /post/:id/:slug . But who is really bugged by that? Seems a sane structure to me. 2) fact. If disqus comments are a showstopper for you, you've got to find a different service. 3) fact, but I see that as a positive, not a negative. Why in the world do you want your themes running native code? 4) Tumblr has static pages with arbitrary URLs. Here's a screenshot of the interface: http://img.skitch.com/20100507-edeg31uwc25t9hkumww2j9hk4b.jpg http://img.skitch.com/20100507-edeg31uwc25t9hkumww2j9hk4b.jp... Tumblr has a great bookmarklet, a good iphone app, a good community, reasonable uptime, and a good admin and customization interface. I don't recommend their group blogs, though I have several, but I highly recommend their service for one person.
- elidourado 16y agollimllib, thanks for the reply. I can think of a number of reasons that you might want to have dynamic elements in your theme. I understand the concern over themes running code, but if you want things like breadcrumbs and your CMS doesn't come with them as a native function then you need to be able to run native code. Ideally, the CMS would include a wide and extensible array of native functions that themes could take advantage of, but tumblr certainly isn't that CMS. Good to know about the pages. One other issue is file uploads. Say I want to host my CV at domain.com/CV.pdf. I don't think I could do that with Tumblr. Is that too much to ask?
- aw3c2 16y agoSuggest a free php alternative please. I need categories, comments, human-readable urls.
- tptacek 16y agoWeigh PHP, categories, comments, human-readable URLs, and convenience against retaining control of your content or (potentially) the server it lives on. The people running Sendmail in the '90s went through all these arguments too. It's hard to understand how a blog package could have created a worse track record than Sendmail (though I can tell you how). But it did.
- aw3c2 16y agoThat is not a solution to the problem. If there was only sendmail, should one stop sending mail?
- tptacek 16y agoI rejected your premise. I didn't try to solve your problem. Your need for PHP, categories, and whatever else doesn't make any difference. Wordpress will be as, insecure as it will be independent of your need for it not to be. Again: avoid Wordpress. If you can't, you have my sympathy.
- chaosmachine 16y agoDrupal has those features, and a pretty reasonable security record. It's not as user friendly as WP, though.
- hkuo 16y agoAs I mentioned in my other comment, I give a thumbs up to Movable Type, particularly in regards to security. The only database access is done on the admin side. When you publish anything, it generates pure html pages. So only you access the database. Users only access html. There are no complexities between these two arrangements. Movable Type takes just a little longer to set up than WordPress, but hey, many of us here are hackers right? Plus you can tweak the code to your heart's content.
- zzzmarcus 16y agoI have 2 Wordpress blogs that get comparable amounts of traffic. They're both on the same shared hosting (MediaTemple), they're both updated at the same time. One never seems to be touched, the other seems to have gotten a high spot on some l44t hax0r's list and is exploited just about every time there a security flaw is discovered. It's annoying to say the least. Slowly over the years I've been moving everything that I don't absolutely have to host off shared hosting or VPS's and onto hosted services (I love Tumblr) that allow backups/exports. In my experience, it's just not worth the headaches to self-host things like blogs.
- modoc 16y agoDo you have an alternative you recommend?
- mattwdelong 16y agoSunlight labs blogdor is suiting my needs perfectly. I will be forking and adding my contributions in the near future. http://github.com/sunlightlabs/django-blogdor http://github.com/sunlightlabs/django-blogdor
- bravura 16y agoHow does this compare to Blogofile, http://www.blogofile.com/ http://www.blogofile.com/, a Python blog compiler that has a lot of blog features?
- sucuri2 16y agoDetails of the code are here: http://sucuri.net/malware/entry/MW:MROBH:1 http://sucuri.net/malware/entry/MW:MROBH:1 I am wondering what google will do if they keep doing malware to hide from them. Their blacklist will become useless.
- tptacek 16y agoThat code doesn't really say anything about how the blogs were compromised, or anything interesting about what the attackers did with it (yup, they added js to the page via PHP, like every other WP attack).
- nuclear_eclipse 16y agoSurreptitiously browse sites using a standard user-agent string/IP, and just see if something different shows up?
- shadowsun7 16y agoQuestion: is there any way to make Wordpress more secure? Otherwise, why're most people here recommending a move away from Wordpress? (Not saying they're wrong, just ... curious.)
- steveklabnik 16y agoThe problem stems from a history of flaws in Wordpress' code, not its administration.
- ericz 16y agoI wonder if Wordpress is especially poor security-wise or simply it's popularity attacts too much bad attention.
- deleted 16y ago[deleted]
- jerf 16y agoI wanted to snark "yes", but truthfully, the problem is that Wordpress' security has been average, not especially bad. The problem is that average is terrible. Most average products don't get hit with this level of scrutiny, but certainly the sort of errors that Wordpress makes with frightening regularity are made by numerous other commercial and open source projects as well.
- tptacek 16y agoThere are unforced errors in Wordpress. Every web application will have a cross-site scripting mistake. It takes a special one to have "anonymous commenter" -> "admin" privilege escalation, or executable style templates.
- jerf 16y agoAlas, I could (but won't) name fairly equivalent errors made at a place that I may or may not work. (If not worse than the ones you mention.) I think the only place we differ here is our exact level of cynicism. "More cynical than tptacek" probably means I need to tone it down.
- tptacek 16y agoThat is my favorite Hacker News comment sentence of the year. Thanks.
- hkuo 16y agoI've been using Movable Type for years, the differentiating factor being that it generates html pages. No worries about database load. No worries about database hacking, the only access to the data or files being through the admin login. The additional ability to customize the code at any depth is a plus too.
- sandGorgon 16y agoHey guys - this is a serious question : what is the alternative. Is there anything that provides 80% of the features of Wordpress at significantly higher security ? What about Textpattern ( php), Movable Type (perl+php), Expression Engine (php), Mephisto (ror), Type (ror)... what ?
- jimmyrcom 16y agoBuild your own CMS and have it generate static pages. Original texts are still stored in local database for editing. It rebuilds locally and uploads a 7zip archive of the modified files (eg article,rebuilt category index) via ssh and extracts. That's what I did, and for a moderate sized shitty blog like mine this works at no risk and minimal overhead. Besides the pleasure of having used your own software you'll laughing when competitor sites that used cookie cutter software and are going into panic, and public relations damage control mode when the chinese and russians wiped their shit, stole their passwords and flooded enlarge your dick emails to half the world from their servers.
- aaronbrethorst 16y agoStatic HTML files driven off a system like Jekyll or Webby, coupled with comments from Disqus would be significantly more secure. It's also much less convenient.
- mccutchen 16y agoOr run a local WordPress installation and use `wget` to generate a static HTML mirror suitable for uploading to your server: http://www.idlewords.com/2009/09/using_wordpress_to_generate_flat_files.htm http://www.idlewords.com/2009/09/using_wordpress_to_generate...
- neurotech1 16y agoOne thing that was mentioned in the linked page is Fantastico, the auto-installer for cPanel. I checked and currently they are including WP 2.9.2(latest) but there is sometimes a delay updating Fantastico. On top of that, the hosting clients may not know how to update their WP install anyway.
- nym 16y agoHow can one identify if they've been compromised? Is there any kind of fix?
- pronoiac 16y agoWorking from http://www.wpsecuritylock.com/breaking-news-wordpress-hacked-with-zettapetta-on-dreamhost/ http://www.wpsecuritylock.com/breaking-news-wordpress-hacked... If your page has references to base64_decode, zettapetta, or indesignstudioinfo in the source, I'd be worried. For a fix, see http://blog.sucuri.net/2010/05/simple-cleanup-solution-for-latest.html http://blog.sucuri.net/2010/05/simple-cleanup-solution-for-l...
- bcl 16y agoI have seen no evidence that recent problems are anything other than shared hosting sites getting cracked. Note to admins -- running your system with all the virtual host files owned by apache is asking for trouble. Use something like the itk patch for Apache (http://mpm-itk.sesse.net/ http://mpm-itk.sesse.net/) where each virtual owns its files and uses normal permission restrictions to control access to the rest of the system. Although this won't help those of you who are bone-headed enough to chmod 0777 all of your files...
- whimsy 16y agoMore alternatives: Bloxsom (perl): http://www.blosxom.com/ http://www.blosxom.com/ Jekyll (rb): http://jekyllrb.com/ http://jekyllrb.com/ Hyde (py): http://ringce.com/hyde http://ringce.com/hyde mattwdelong mentioned blogdor (django): http://github.com/sunlightlabs/django-blogdor http://github.com/sunlightlabs/django-blogdor bravura suggested blogophile (py): http://www.blogofile.com/ http://www.blogofile.com/
- sucuri2 16y agoHey, For anyone having problem cleaning it up, we have a simple script to do it for you: http://blog.sucuri.net/2010/05/simple-cleanup-solution-for-latest.html http://blog.sucuri.net/2010/05/simple-cleanup-solution-for-l...
- lkrubner 16y agoWordPress is easy to learn. Technologies that are easy to learn tend to attract a lot of people. Once the people learn enough that they are no longer beginners, then they want more features, more abilities. Rewind the clock to 1999 and you could say the same thing about PHP. It did well because it was easy for beginners to learn. I think a lot of the people who read Hacker News are people with considerable experience in the tech world. As such, it is easy for them to underestimate the importance of having some technologies that are easy for beginners to learn. It is easy to make fun of a beginner. But everyone starts off as a beginner. More so, technologies that are easy to learn tend to have a resilience that complicated technologies lack. There will always be some version of BASIC out there, even as other, better languages are forgotten. I do most of my development with Symfony. As such, there is a part of me that thinks application frameworks (Symfony, Ruby On Rails, Django) should be used for all projects. But the application frameworks are only for experienced programmers. I would have felt overwhelmed if my first exposure to computer programming had been Symfony, or Ruby on Rails, or Django. WordPress does a fantastic job enabling relative beginners to achieve a lot. It deserves praise for that. It offers people a smooth path to move deeper into programming, should they wish to move that way. I've had friends who first learned PHP dealing with WordPress, and later became good PHP programmers overall, and more recently I see them learning other technologies. In another era they might have learned with Visual Basic or Hypercard or Applescript or any of the previous attempts to build systems that enabled beginners to program. But for the last few years, WordPress has occupied that niche in the world of programming. More so, WordPress is a great platform for web designers to work from. For the intelligent designer who does not want to become a programmer, WordPress lets them do a lot of customization, without knowing much of the technical details of what they are doing. It is easy to curse WordPress for its security flaws. For that reason, it is important to remember how good it is at the things it gets right. I agree with elidourado: this is an opportunity for entrepreneurs. The popularity of WordPress, and its occasional problems, provides a good market for services that help designers and other programmers achieve what they wish. Darren Hoyt and I started one such service, a paid question and answer site focused on WordPress: http://www.wpquestions.com/ http://www.wpquestions.com/ It is also worth noting that WordPress is one of the larger categories on eLance: http://www.elance.com/skills_directory http://www.elance.com/skills_directory It is appropriate to complain about the security flaws in WordPress, but entrepreneurs will also think hard about what kind of services can help all the people who need help with it.