7 ms·

WordPress sites getting hacked ‘within seconds’ of TLS certificates being issued

91 points by feross 5y ago

javchz 5y ago
TLDR: When you add a CA certificate, you're announcing to the world "hey look at me, I'm probably a new site, with probably not a lot of security practices covered" and if you use WordPress, you could be victim of automated attacks. In defence of WP this could happen to any CMS, but wp it's the most popular by far
- tialaramex 5y ago
  Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers. Passive DNS is the product e.g. https://www.circl.lu/services/passive-dns/ https://www.circl.lu/services/passive-dns/ https://www.farsightsecurity.com/technical/passive-dns/passive-dns-faq/ https://www.farsightsecurity.com/technical/passive-dns/passi... https://www.anomali.com/blog/introduction-to-passive-dns-usage-in-threatstream https://www.anomali.com/blog/introduction-to-passive-dns-usa... Unsurprisingly lots of outfits want to publicly advertise this as a white hat feature you can purchase from them, but it's just technology, it works fine for bad guys too.
  - mschuster91 5y ago
    > Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers. "Publish DNS records" does not exist. There is no sort of "firehose" where anyone can subscribe to a feed of newly registered domains.
    - blibble 5y ago
      companies running most zonefiles let you buy it, as well as various statistics
      - duskwuff 5y ago
        Access to zone files is relatively restricted (you have to give the registry a good reason you need the data), and is a daily report, not a real-time feed.
  - prepend 5y ago
    I run the prepend.com domain. I don’t think there’s any way for you, or anyone without admin access to my dns server, to know when I add a CNAME record for tialaramex.prepend.com. I guess someone could continuously request every possible entry over and over to see when I do that, but don’t think it’s likely.
    - tialaramex 5y ago
      Passive DNS doesn't request every possible entry. What happens is that when say, somebody uses their AT&T phone to ask A? tialaramex.prepend.com the AT&T DNS servers tell them that's 10.20.30.40 and the AT&T DNS servers tell a passive DNS outfit, "At 18:26 UTC the answer to A? tialaramex.prepend.com was apparently 10.20.30.40" Now, I'm sure that lots of HN readers have a local manually configured DNS resolver that of course isn't feeding passive DNS. And some of them might even have an upstream DNS resolver which is bootstrapped and that too does not feed passive DNS. It's not even difficult if you were insistent upon doing it. But, the design guy's iPhone which he used to take a quick screenshot? Probably just uses a public DNS resolver. The woman who trains front line support and asked for a sneak peak ready to start training on the new site? She probably has 8.8.8.8 set as her DNS resolver. So just like asking for the publicly trusted certificate, this is another way that your DNS names go from "Nobody would guess what that is" to public knowledge in seconds once they leave your hands.
sysadm1n 5y ago
I recall coming across some sites over the years where the site was just setup and someone uploaded a Wordpress install onto their server. I was able to go through the wizard and install a new Wordpress, adding credentials, giving it a name etc. It was a lulzy thing to do but I wouldn't do it again. Back in the day you got very bored. If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it.
- rahimnathwani 5y ago
  > If I was setting up my own Wordpress > I would go through the wizard as quickly as possible You might not be quicker than a bot.
- salawat 5y ago
  I don't understand ehy you would set up an in development website period as publically accessible until you had it locked down. That just seems like a poor idea.
  - UI_at_80x24 5y ago
    I agree, Step 1 for me has always been to add a rule to the firewall to block all connections except from my IP while I work on it.
  - db48x 5y ago
    Same here. It is trivial to keep it on a private network or behind an SSH tunnel or a SOCKS proxy or _anything_ that limits access to just yourself until it is actually ready for random visitors.
    - apocalyptic0n3 5y ago
      Many Wordpress sites are not set up by developers or technical people. A significant number of them are set up by marketing teams just spinning them up in a cPANEL or GoDaddy or something.
Tepix 5y ago
Ideally add basic authentication to the entire VirtualHost beforehand.
qwerty456127 5y ago
For at least a decade it baffles me why do people still use WordPress, self-hosted especially (a dedicated team of professional webmasters working 24x7 has at least some chance to manage protecting it). To me that seems suicidal behavior.
- blueflow 5y ago
  Many customers just don't want to spend much money. Wordpress is still one of the big players for small dynamic websites, probably because they have a good range of plugins to integrate with other services.
- _fat_santa 5y ago
  It really comes down to price and ease of use. If you are non-technical and want a website/blog without going to Wix, Squarespace, etc. WP is the best game in town.
- chomp 5y ago
  Is there a better CMS? WordPress has a huge plugin ecosystem, a huge developer talent pool, and is relatively straightforward to use. It also costs nothing, which is important for overseas developers, and can be extremely cheap to host. It also (can be) very easy to use. Plugins and theme bundles can make this more complex, but it's easy enough to hand a properly secured and deployed WordPress to a marketing or media team and have them do 90% of the work, which is a win for dev and ops teams.
  - sidewndr46 5y ago
    Are the developers really that talented? The only interesting news I see about WordPress is the latest vulnerability being exploited.
    - deleted 5y ago
      [deleted]
    - jraph 5y ago
      WordPress is huge, it represents a big chunk of the web. I've read from a quarter to a third, or even more. It's a good target. Of course we are going to hear about security vulnerabilities more for WordPress than for any other CMS. There is nothing specific to WordPress about the issue this post relates IIUC apart from the fact it is a privileged target. And there's no news when everything is fine, which is most of the time.
asplake 5y ago
It baffles me that it comes insecure by default, if that’s what’s happening. How hard can it be for a standard install to come protected with a unique password, user-provided or otherwise?
johnklos 5y ago
The Wordpress project people have more often than not prioritized "ease" over security. This is no different. Should there obviously be a unique, temporary password encoded in the wp-config.php that prevents this? Of course. Would it diminish "ease"? Yes, and therefore it won't happen. They're deathly afraid of making anything more difficult to the lowest common denominator, and, by extension, the scammers of the world.
mistrial9 5y ago
Q. what do people think of using a (correctly) self-signed cert for Wordpress self-hosting, in 2022.. ? (hosted in the USA if that matters)
- perlgeek 5y ago
  Don't do it if you want people other than yourself visiting the blog.
- AnonC 5y ago
  Visitors, including yourself, will get browser warnings and will have to explicitly bypass the scary prompts to go ahead and trust the self-signed certificate. Many visitors may not even figure it out with the state of the warning messages now. For a site that’s on the Internet, it should be a lot easier to get a free certificate from LetsEncrypt and also have it renew frequently (automated).
- snowwrestler 5y ago
  Totally fine to use during development. We did that a bunch of times before Let’s Encrypt. But in production, your visitors will likely be scared off by the browser warning on a self-signed cert.
wnevets 5y ago
is this still an issue if you use wordpress.com to host?
- advisedwang 5y ago
  No. wordpress.com takes care of security updates.
Tijdreiziger 5y ago
Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP space is making my head spin. There are a dozen competing 'security' plugins, with some saying 'you don't need any of them, WP is secure enough by default', and others saying 'you actually need ModSecurity [1] / Jeff Starr's nG firewall [2] on your server'. The agency that (shoddily...) built the webshop installed Wordfence Free [3], so I've just kept that for now, though I feel it's kind of slow (but that might just be caused by the bottom-of-barrel performance of the shared webhost it's currently running on). [1] https://github.com/SpiderLabs/ModSecurity https://github.com/SpiderLabs/ModSecurity [2] https://perishablepress.com/7g-firewall/ https://perishablepress.com/7g-firewall/ [3] https://www.wordfence.com/ https://www.wordfence.com/
- deleted 5y ago
  [deleted]
- mpol 5y ago
  The blog of WordFence has been quite informative over the years. Many plugins, and even WordPress Core, have had security issues. Some really bad ones get used from a very early stage. So I do think there is some merit in being more on top of it. Updates and backups are also part of your strategy, being hacked and having to comb through the live database for 'eval()' and 'base64()' and other scary stuff is not that great. The thing about mod_security is that it is server based. If you are on a shared host you have no control over this and every shared host has a different setup. And if you maintain the server, well, mod_security is not that easy to get right and to stay on top of things. Wordfence adds its own weaknesses ofcourse, it is more code that needs to be vetted. But for recognizing an intrusion or hack, it can work quite well I think. (haven't been hacked in years). This thing about server or account based is similar when it comes to caching of generated html pages, Varnish is server wide, a plugin is WP wide.
  - Tijdreiziger 5y ago
    Thanks, I'll check out the Wordfence blog! I'm definitely trying to stay on top of updates and backups (nobody had been maintaining it before I took over, so the update situation was dire). Yeah, since the performance on the current host is dire, I've been debating whether to go with another shared host or to just go the VPS route. The company wants to get into Microsoft 365 for e-mail/files, so maybe Azure is another option. I'm okay with spending some time setting things up, but I definitely don't want to have to put a lot of effort into ongoing maintenance.
specto 5y ago
Fun story. I helped someone with a wordpress site recently where I provided an internal address for development. Once they were done with development I moved the site to the public url and found that most of the pages were broken. Turns out multiple plugins make changing URLs a feature behind a monthly paywall as a monetization strategy. The sobering thing is that the fix is to update tables in the database. There are various examples in github for these things, however most people just use a plugin that literally does a find and replace for the old URI and replaces with the new. Frightening...
- orev 5y ago
  Yes, that’s a thing with Wordpress. Any change to the URL requires some sort of migration to the new URL, as they are statically added to pages. This was done to avoid the performance hit of dynamically generating the late every time. Wordpress has been around a long time, and that decision probably did have a performance improvement at the time. Theoretically it’s not really that bad, as URLs are defined as unique, so doing a migration shouldn’t be a big deal. But conceptually it just seems “incorrect”.
raffraffraff 5y ago
Free automatic TLS is now the noob standard. Do any of those automatic cert bots support "not_before" dates in the past, or pre-ordering and delayed rotation of certs?

91 points by feross 5y ago

TLDR: When you add a CA certificate, you're announcing to the world "hey look at me, I'm probably a new site, with probably not a lot of security practices covered" and if you use WordPress, you could be victim of automated attacks. In defence of WP this could happen to any CMS, but wp it's the most popular by far

tialaramex 5y ago
Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers. Passive DNS is the product e.g. https://www.circl.lu/services/passive-dns/ https://www.circl.lu/services/passive-dns/ https://www.farsightsecurity.com/technical/passive-dns/passive-dns-faq/ https://www.farsightsecurity.com/technical/passive-dns/passi... https://www.anomali.com/blog/introduction-to-passive-dns-usage-in-threatstream https://www.anomali.com/blog/introduction-to-passive-dns-usa... Unsurprisingly lots of outfits want to publicly advertise this as a white hat feature you can purchase from them, but it's just technology, it works fine for bad guys too.
- mschuster91 5y ago
  > Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers. "Publish DNS records" does not exist. There is no sort of "firehose" where anyone can subscribe to a feed of newly registered domains.
  - blibble 5y ago
    companies running most zonefiles let you buy it, as well as various statistics
    - duskwuff 5y ago
      Access to zone files is relatively restricted (you have to give the registry a good reason you need the data), and is a daily report, not a real-time feed.
- prepend 5y ago
  I run the prepend.com domain. I don’t think there’s any way for you, or anyone without admin access to my dns server, to know when I add a CNAME record for tialaramex.prepend.com. I guess someone could continuously request every possible entry over and over to see when I do that, but don’t think it’s likely.
  - tialaramex 5y ago
    Passive DNS doesn't request every possible entry. What happens is that when say, somebody uses their AT&T phone to ask A? tialaramex.prepend.com the AT&T DNS servers tell them that's 10.20.30.40 and the AT&T DNS servers tell a passive DNS outfit, "At 18:26 UTC the answer to A? tialaramex.prepend.com was apparently 10.20.30.40" Now, I'm sure that lots of HN readers have a local manually configured DNS resolver that of course isn't feeding passive DNS. And some of them might even have an upstream DNS resolver which is bootstrapped and that too does not feed passive DNS. It's not even difficult if you were insistent upon doing it. But, the design guy's iPhone which he used to take a quick screenshot? Probably just uses a public DNS resolver. The woman who trains front line support and asked for a sneak peak ready to start training on the new site? She probably has 8.8.8.8 set as her DNS resolver. So just like asking for the publicly trusted certificate, this is another way that your DNS names go from "Nobody would guess what that is" to public knowledge in seconds once they leave your hands.

sysadm1n 5y ago

I recall coming across some sites over the years where the site was just setup and someone uploaded a Wordpress install onto their server. I was able to go through the wizard and install a new Wordpress, adding credentials, giving it a name etc. It was a lulzy thing to do but I wouldn't do it again. Back in the day you got very bored. If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it.

rahimnathwani 5y ago
> If I was setting up my own Wordpress > I would go through the wizard as quickly as possible You might not be quicker than a bot.
salawat 5y ago
I don't understand ehy you would set up an in development website period as publically accessible until you had it locked down. That just seems like a poor idea.
- UI_at_80x24 5y ago
  I agree, Step 1 for me has always been to add a rule to the firewall to block all connections except from my IP while I work on it.
- db48x 5y ago
  Same here. It is trivial to keep it on a private network or behind an SSH tunnel or a SOCKS proxy or _anything_ that limits access to just yourself until it is actually ready for random visitors.
  - apocalyptic0n3 5y ago
    Many Wordpress sites are not set up by developers or technical people. A significant number of them are set up by marketing teams just spinning them up in a cPANEL or GoDaddy or something.

Tepix 5y ago

Ideally add basic authentication to the entire VirtualHost beforehand.

qwerty456127 5y ago

For at least a decade it baffles me why do people still use WordPress, self-hosted especially (a dedicated team of professional webmasters working 24x7 has at least some chance to manage protecting it). To me that seems suicidal behavior.

blueflow 5y ago
Many customers just don't want to spend much money. Wordpress is still one of the big players for small dynamic websites, probably because they have a good range of plugins to integrate with other services.
_fat_santa 5y ago
It really comes down to price and ease of use. If you are non-technical and want a website/blog without going to Wix, Squarespace, etc. WP is the best game in town.
chomp 5y ago
Is there a better CMS? WordPress has a huge plugin ecosystem, a huge developer talent pool, and is relatively straightforward to use. It also costs nothing, which is important for overseas developers, and can be extremely cheap to host. It also (can be) very easy to use. Plugins and theme bundles can make this more complex, but it's easy enough to hand a properly secured and deployed WordPress to a marketing or media team and have them do 90% of the work, which is a win for dev and ops teams.
- sidewndr46 5y ago
  Are the developers really that talented? The only interesting news I see about WordPress is the latest vulnerability being exploited.
  - deleted 5y ago
    [deleted]
  - jraph 5y ago
    WordPress is huge, it represents a big chunk of the web. I've read from a quarter to a third, or even more. It's a good target. Of course we are going to hear about security vulnerabilities more for WordPress than for any other CMS. There is nothing specific to WordPress about the issue this post relates IIUC apart from the fact it is a privileged target. And there's no news when everything is fine, which is most of the time.

asplake 5y ago

It baffles me that it comes insecure by default, if that’s what’s happening. How hard can it be for a standard install to come protected with a unique password, user-provided or otherwise?

johnklos 5y ago

The Wordpress project people have more often than not prioritized "ease" over security. This is no different. Should there obviously be a unique, temporary password encoded in the wp-config.php that prevents this? Of course. Would it diminish "ease"? Yes, and therefore it won't happen. They're deathly afraid of making anything more difficult to the lowest common denominator, and, by extension, the scammers of the world.

mistrial9 5y ago

Q. what do people think of using a (correctly) self-signed cert for Wordpress self-hosting, in 2022.. ? (hosted in the USA if that matters)

perlgeek 5y ago
Don't do it if you want people other than yourself visiting the blog.
AnonC 5y ago
Visitors, including yourself, will get browser warnings and will have to explicitly bypass the scary prompts to go ahead and trust the self-signed certificate. Many visitors may not even figure it out with the state of the warning messages now. For a site that’s on the Internet, it should be a lot easier to get a free certificate from LetsEncrypt and also have it renew frequently (automated).
snowwrestler 5y ago
Totally fine to use during development. We did that a bunch of times before Let’s Encrypt. But in production, your visitors will likely be scared off by the browser warning on a self-signed cert.

wnevets 5y ago

is this still an issue if you use wordpress.com to host?

advisedwang 5y ago
No. wordpress.com takes care of security updates.

Tijdreiziger 5y ago

Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP space is making my head spin. There are a dozen competing 'security' plugins, with some saying 'you don't need any of them, WP is secure enough by default', and others saying 'you actually need ModSecurity [1] / Jeff Starr's nG firewall [2] on your server'. The agency that (shoddily...) built the webshop installed Wordfence Free [3], so I've just kept that for now, though I feel it's kind of slow (but that might just be caused by the bottom-of-barrel performance of the shared webhost it's currently running on). [1] https://github.com/SpiderLabs/ModSecurity https://github.com/SpiderLabs/ModSecurity [2] https://perishablepress.com/7g-firewall/ https://perishablepress.com/7g-firewall/ [3] https://www.wordfence.com/ https://www.wordfence.com/

deleted 5y ago
[deleted]
mpol 5y ago
The blog of WordFence has been quite informative over the years. Many plugins, and even WordPress Core, have had security issues. Some really bad ones get used from a very early stage. So I do think there is some merit in being more on top of it. Updates and backups are also part of your strategy, being hacked and having to comb through the live database for 'eval()' and 'base64()' and other scary stuff is not that great. The thing about mod_security is that it is server based. If you are on a shared host you have no control over this and every shared host has a different setup. And if you maintain the server, well, mod_security is not that easy to get right and to stay on top of things. Wordfence adds its own weaknesses ofcourse, it is more code that needs to be vetted. But for recognizing an intrusion or hack, it can work quite well I think. (haven't been hacked in years). This thing about server or account based is similar when it comes to caching of generated html pages, Varnish is server wide, a plugin is WP wide.
- Tijdreiziger 5y ago
  Thanks, I'll check out the Wordfence blog! I'm definitely trying to stay on top of updates and backups (nobody had been maintaining it before I took over, so the update situation was dire). Yeah, since the performance on the current host is dire, I've been debating whether to go with another shared host or to just go the VPS route. The company wants to get into Microsoft 365 for e-mail/files, so maybe Azure is another option. I'm okay with spending some time setting things up, but I definitely don't want to have to put a lot of effort into ongoing maintenance.

specto 5y ago

Fun story. I helped someone with a wordpress site recently where I provided an internal address for development. Once they were done with development I moved the site to the public url and found that most of the pages were broken. Turns out multiple plugins make changing URLs a feature behind a monthly paywall as a monetization strategy. The sobering thing is that the fix is to update tables in the database. There are various examples in github for these things, however most people just use a plugin that literally does a find and replace for the old URI and replaces with the new. Frightening...

orev 5y ago
Yes, that’s a thing with Wordpress. Any change to the URL requires some sort of migration to the new URL, as they are statically added to pages. This was done to avoid the performance hit of dynamically generating the late every time. Wordpress has been around a long time, and that decision probably did have a performance improvement at the time. Theoretically it’s not really that bad, as URLs are defined as unique, so doing a migration shouldn’t be a big deal. But conceptually it just seems “incorrect”.

raffraffraff 5y ago

Free automatic TLS is now the noob standard. Do any of those automatic cert bots support "not_before" dates in the past, or pre-ordering and delayed rotation of certs?