9 ms·
WordPress sites under attack from newly found Linux trojan
- habibur 4y agoanswers, "why you should write your own framework, if you have the knowledge and time."
- dotty- 4y agoDefinitely not. Wordpress plugins are the source of exploits in the Wordpress ecosystem -- it's very very rarely the Wordpress core itself.
- bombcar 4y agoAnd it's almost always older versions of plugins that are vulnerable; however, at some point a plugin update will break the website and then you don't upgrade because there's more important things to do ...
- apercu 4y agoIt's the dependency loop of Wordpress really - people can't update the core because their plugins don't work with new core (yet, sometimes never), so their (outdated) core remains an exploit.
- SoftTalker 4y agoNot strictly a Wordpress issue, this happens with any CMS that allows third party modules (Drupal, for one, as I know from direct experience).
- tyingq 4y agoYes, though the plugin system itself has really no rails at all. Any plugin can do anything.
- n3storm 4y agoThe core main task is execute millions of actions/hooks offered without any control to be exploited by plugins. So "not hacking the core of wp" is really "hacking the core of wp"
- deleted 4y ago[deleted]
- BirAdam 4y agoWell, I would argue that one should write a web framework if he/she wants to do so. There is no other reason really. Running anything on the web has risks, some more than others. Likewise, there are tradeoffs to any given plan. Wordpress itself isn't some terrible thing, but an outdated version with 100+ plugins that is poorly administered is likely to be an unauthenticated root shell that happens to also function as a website. This is true of any web framework though.
- Neil44 4y ago"targets 32-bit versions of Linux and also can run on 64-bit versions of the platform." That narrows it down then.
- deleted 4y ago[deleted]
- mike_hock 4y agoInteresting choice of words at a time when you can't even rely on all major distributions to provide x86-32 builds anymore. Of course, there are still based distros that won't forcibly obsolesce hardware that isn't even a decade old, but you have to know them and can't just assume it's supported anymore.
- mdrzn 4y agoWebsite loads as a white page to me. Even the Google-cached version.
- deleted 4y ago[deleted]
- arprocter 4y agoSame. Supposedly this was the first reporting: https://news.drweb.com/show/?i=14646&lng=en&c=23 https://news.drweb.com/show/?i=14646&lng=en&c=23
- jmbwell 4y ago> It exploits 30 vulnerabilities in a number of plugins and themes for this platform. If sites use outdated versions of such add-ons, lacking crucial fixes, the targeted webpages are injected with malicious JavaScripts. As a result, when users click on any area of an attacked page, they are redirected to other sites. > (Long-ish list of relatively big-name plugins) /me reconsiders trying to relaunch a blog at all
- voytec 4y agoDo you need a cow the WordPress is, for a blog? Static Site Generators like Hugo or Jekyll work great.
- mschuster91 4y agoFor tech-oriented people, yes, static site generators can be quite great. For non-tech people? There's the reason why Wordpress is so popular: you can either use any of the tons of "hosted Wordpress" providers or throw it up on some cheap ass LAMP virtual server, hell even most providers' FTP space is usually enough. There are tons of themes, tons of plugins with integration to pretty much everywhere, and tons of anything from freelancers to huge media agencies to help you out. Like it or not, Wordpress is the equivalent of English. Almost everyone relevant sans the French speaks it.
- remram 4y agoMore like "Linux systems under attack from newly-found WordPress trojan"
- sschueller 4y agoI don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem. "Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming language and executes attackers’ commands. Its main functionality is to attack websites based on the WordPress CMS by exploiting vulnerabilities in outdated versions of plugins and themes for this platform. If an attack is successful, the webpages of such sites are injected with a malicious JavaScript that redirects website visitors to other sites." https://vms.drweb.com/virus/?i=25604695 https://vms.drweb.com/virus/?i=25604695 "Linux.Backdoor.WordPressExploit.2 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming language and executes attackers’ commands. Its main functionality is to attack websites based on the WordPress CMS by exploiting vulnerabilities in outdated versions of plugins and themes for this platform. If an attack is successful, the webpages of such sites are injected with a malicious JavaScript that redirects website visitors to other sites. This backdoor is a modification of the Linux.Backdoor.WordPressExploit.1 malicious application. It differs from it in the address of the C&C server, the address of the domain from which the malicious script is downloaded, and its additional list of vulnerabilities to exploit." https://vms.drweb.com/virus/?i=25604745 https://vms.drweb.com/virus/?i=25604745
- dec0dedab0de 4y agoI don't think linux has anything to do with it. I took that to mean it runs on Linux.
- BirAdam 4y agoYeah, typically, a web server should be setup such that the web servers process runs as say: www-data:www-data, and then the web files should be: joe:www-data and those web files should be 644. In this manner, the web server process can read the files, but the files can neither be written to nor run. This very basic stuff that most of the world seems to ignore completely.
- sourcecodeplz 4y agoWordpress is great for rapid prototyping but as history has shown, relying on third parties for additional functionalities in production environments, comes with great risks. Most usage of Wordpress today are definably not blogs, but full blown websites with many functionalities not found on a blogging software.
- claudiulodro 4y agoIt's the same tradeoff with any package ecosystem: improved convenience but less control over the codebase. Leave any JS project alone for a couple months and as soon as you `npm install` you'll see something like "30 vulnerabilities (4 low, 8 moderate, 14 high, 4 critical)" The core WordPress is one of the most secure software in the world: there are thousands of people trying all the time to find exploits and the codebase is public. Go take a look at what CMS whitehouse.gov (one of the highest-profile hacking targets out there) is using.
- bzzzt 4y ago> The core WordPress is one of the most secure software in the world: there are thousands of people trying all the time to find exploits and the codebase is public. Go take a look at what CMS whitehouse.gov (one of the highest-profile hacking targets out there) is using. While I believe the core is reasonably secure, lots of plugins and webhosts aren't. Simply making the website code read-only would take care of a lot of issues, but then your auto-update won't work.
- angst_ridden 4y agoYou can make the the code read-only (from the web-server's perspective) and have auto update if you use a tool like WP-CLI and a cron job. I've had a few customer's sites on WP for decades without any hacks. But I also carefully restrict their plug-ins, and disable PHP in any of the upload directories.
- jeroenhd 4y agoI wasn't surprised to read that once again the plugins were the cause of the security issues. I don't know what the dynamics are for WordPress plugin developers to write this much vulnerable code, but WordPress itself has had very few vulnerabilities over the years. Even still, the vulnerabilities this plugin exploits have CVE numbers starting with 2016 and 2019. I'd say that you can use WordPress for websites perfectly fine as long as you maintain your web server platform like any web server platform: with regular security updates and migration or mitigation plans if those updates are breaking anything. Running a website under your own control is not the one-time setup that many WordPress hosting sites promise customers. It usually doesn't take much time to hit the update button, but if you can't spend an hour a week/month making sure your website is still up to date, you shouldn't host your own stuff. Pay someone to manage it for you instead.
- porker 4y agoIn the "network indicators of an attack" [1] what's the significance of some periods being in square brackets and others not? 1. https://github.com/DoctorWebLtd/malware-iocs/tree/master/Linux.Backdoor.WordPressExploit.1#network-indicators https://github.com/DoctorWebLtd/malware-iocs/tree/master/Lin...
- jeroenhd 4y agoI think it's to prevent virus scanners from detecting the IP listed in the web page. If your (super aggressive) AV engine has been updated to include these IoCs and you're just trying to read more about this virus, you don't want it to trigger a block.
- whodev 4y agoIt's to defang the IP addresses https://defang.me/why.php https://defang.me/why.php
- fortran77 4y agoWhy does all this open source stuff have so many problems? Aren’t there a lot of eyes looking at the code?
- yjftsjthsd-h 4y agoDo you think the proprietary alternatives have less problems?
- BirAdam 4y agoThis is a valid question, but the answer is somewhat simple. The open source code is both widely used and easily studied. Because of this, it gets targeted. As it can be studied, the vulnerabilities are both known and talked about. In the case of proprietary software, the owners are neither going to be quick to admit a problem exists, nor quick to allow study of their system(s) to discover the cause (in most cases, exceptions to this obviously exist). Security vulnerabilities are everywhere, but only in widely-used open source code is the discovery of a vulnerability likely to be both known and discussed.
- IceWreck 4y agoThe problem is with plugins not wordpress itself. And those plugins may or maynot be open source. Lots of them aren't.
- forgotpwd16 4y agoThat's one shitty title.
- bilekas 4y agoThis article is written so badly.. I suspect it could be a ChatGPT or some variant.. > which targets 32-bit versions of Linux and also can run on 64-bit versions of the platform. I don't fully understand what they mean by this.. > Vulnerabilities are not uncommon. Pointing out the obvious here. But in general Wordpress has a high surface area of attack sure, but it allows bad 'developers' to publish websites which are connected to sensitive services all without needing even the first comprehension of security. This is its worst feature.
- Avamander 4y agoThe original article would probably be a better thing to link to https://news.drweb.com/show/?i=14646&lng=en&c=23 https://news.drweb.com/show/?i=14646&lng=en&c=23
- pwdisswordfish9 4y ago> I suspect it could be a ChatGPT or some variant Either that, or someone who is absolutely clueless. Would be nice to not have such drivel on the HN frontpage.
- shever73 4y agoAgreed, it told me precisely nothing.
- anotherevan 4y agoThis may be a better write-up: https://arstechnica.com/information-technology/2023/01/hundreds-of-wordpress-sites-infected-by-recently-discovered-backdoor/ https://arstechnica.com/information-technology/2023/01/hundr...
- this_steve_j 4y agoThere is a nice writeup about the exploit which includes more information about the indicators of compromise (IOCs) on the (drweb) site: https://vms.drweb.com/virus/?i=25604695 https://vms.drweb.com/virus/?i=25604695 For example, the binary file has a SHA1 of 215a4470063080696630fb6015378938e8c16a15. It reaches out to a C2 server with the IP address 109[.]234.38[.]69. It injects a script called "lone.js" which contacts another server. Etc. Someone has also submitted it to Virustotal very recently, and there is additional information available to explore. https://www.virustotal.com/gui/file/7ab779b39a7ff2a8e4e4957e91be885e3b193959ff19f7d57f7befd8e6ce39b4 https://www.virustotal.com/gui/file/7ab779b39a7ff2a8e4e4957e... Yara is among the tools which can be used to search a system for these IOCs provided a set of rules written in the appropriate syntax.
- mort96 4y agoHow is that a nice write-up? It's describing the malware as both a backdoor and a trojan, but it's not a trojan and nothing in the description indicates that it's a backdoor. And after reading the write-up it's not even clear to me whether the Go program is running on the same machine as the WordPress (if it is, why does it need to exploit plug-in vulnerabilities? If not, how does the Go program itself spread? Is this where the "trojan horse" part comes in?)
- this_steve_j 4y agoI would agree that the author of the write-up took some creative liberties in applying certain malware category terms like "trojan" and "backdoor" and that it lacks the polish and depth found in other reports from malware reverse engineers. However it contains enough basic information for a site operator to search their logs and filesystem to see if they have those indicators of compromise. It's "nice" in the sense that someone published the details of an attack quickly and provided some key details to the community, who can expand on these findings or use them in signature-based antivirus detection tools. I also linked to the Virustotal report which has more information about the go executable including headers, exported symbols and debug information that you can see for free, and which has more detailed analysis for security researchers who have an enterprise subscription.
- deleted 4y ago[deleted]
- mort96 4y agoI'm not understanding how this is a trojan. Is it a plug-in which the admin has to install? Is it some other unrelated application which the admin has to download from the web and run which infects WordPress sites? How do the 30 vulnerabilities fit into this? And what part of it is a backdoor? It looks like the C&C server can only tell the software what page to redirect to? That's not the sort of access I generally associate with a "backdoor"...
- kitsunesoba 4y agoAfter my experience running a WordPress blog back in the mid-late 2000s, I swore off of it. Even with the meager traffic I got I saw a constant barrage of linkfarm exploits and the like that occurred with even the most brief lapses in keeping WP up to date. Haven't had a blog in about a decade, but when I spin one back up it'll be with a static generator like Zola[0] running on a provider like Netlify[1]. Comments are nice to have but not worth the hassle that comes with a dynamic app or the moderation overhead required to keep comment spam at bay. [0]: https://www.getzola.org/ https://www.getzola.org/ [1]: https://www.netlify.com/ https://www.netlify.com/
- mjfl 4y agoI had a similar experience, Wordpress seems like a terribly exploited system.
- jollyllama 4y agoIs there any good literature discussing the rise of server malware? It seems to me it's much more common now and PC malware (regardless of OS) is more rare.