4 ms·

I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is all

I don't think linux has anything to do with it. It injects JS code into an existing wordpress site to redirect visitors to spam/scam etc. Any plugin that is allowed to write to disk and has a vulnerability is a problem. "Linux.Backdoor.WordPressExploit.1 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming language and executes attackers’ commands. Its main functionality is to attack websites based on the WordPress CMS by exploiting vulnerabilities in outdated versions of plugins and themes for this platform. If an attack is successful, the webpages of such sites are injected with a malicious JavaScript that redirects website visitors to other sites." https://vms.drweb.com/virus/?i=25604695 https://vms.drweb.com/virus/?i=25604695 "Linux.Backdoor.WordPressExploit.2 is a trojan application for 32-bit and 64-bit Linux operating systems that targets x86-compatible devices. The backdoor is written in the Go (Golang) programming language and executes attackers’ commands. Its main functionality is to attack websites based on the WordPress CMS by exploiting vulnerabilities in outdated versions of plugins and themes for this platform. If an attack is successful, the webpages of such sites are injected with a malicious JavaScript that redirects website visitors to other sites. This backdoor is a modification of the Linux.Backdoor.WordPressExploit.1 malicious application. It differs from it in the address of the C&C server, the address of the domain from which the malicious script is downloaded, and its additional list of vulnerabilities to exploit." https://vms.drweb.com/virus/?i=25604745 https://vms.drweb.com/virus/?i=25604745

dec0dedab0de 4y ago
I don't think linux has anything to do with it. I took that to mean it runs on Linux.
BirAdam 4y ago
Yeah, typically, a web server should be setup such that the web servers process runs as say: www-data:www-data, and then the web files should be: joe:www-data and those web files should be 644. In this manner, the web server process can read the files, but the files can neither be written to nor run. This very basic stuff that most of the world seems to ignore completely.
- snowwrestler 4y ago
  Wordpress typically has write access to itself so it can auto-install updates right away, which is also a good idea for security. But I t’s definitely a tradeoff in that it also increases the potential harm from bugs.
  - progval 4y ago
    Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't?
    - codetrotter 4y ago
      > Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't? In theory yes. In practice no. I think a big reason that PHP grew popular years ago was that basically all you needed in order to set up a PHP site on a host was FTP access, and in certain cases DB credentials. For example, case in point, for WordPress you only need FTP and DB access. Certainly it was the case for me back in the day, when I started learning to program with PHP. I was still using Windows back then and I knew nothing about Linux or any of the other Unix-likes at the time. All I had was my Windows XP computers with XAMPP, and free hosting which provided me with FTP access. Many free hosts would give you MySQL DB credentials also I think. Cron and things like that would have been beyond my abilities at the time, and beyond what I was given access to by the free hosting companies.
      - sgbeal 4y ago
        >> Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't? > In theory yes. In practice no. FWIW, after my one and only Wordpress installation was cracked via a vulnerability identical to the one reported in this thread (back in 2010-ish), i did exactly that: made all of the files and dirs read-only to the web user, and made the read/write only during upgrades. Since ditching that site, though, a couple of years later, WP has remained on my blacklist and i've neither touched it nor recommended its use (and actively recommend against it for anyone who asks because of its long, glorious history of being cracked). To this day, WP is still the only server-side software i've ever run which was cracked from the outside.
lucideer 4y ago
> I don't think linux has anything to do with it. The title is accurate, but I think a lot of people are objecting in comments here due to a general conflation of two separate concepts: 1) An exploit or vulnerability 2) A virus or trojan An exploit/vuln is a bug in software (Wordpress in this case) that allows unauthorized access - a virus/trojan is an app with malicious intent: one typically needs to take advantage of an exploit (or social engineering) to install & execute said app. Like any app, it's generally developed for a specific platform (in this case, Linux). --- TL;DR: The Wordpress exploits are known - the news in this article is about a specific Liunux app being deployed using those exploits. The bugs in Wordpress are not the news.
mort96 4y ago
This site is all over the place. It's not a trojan, and based on the description, it's not a backdoor.
worewood 4y ago
When a Virus targets I.E. or Office macros or other software, in general it all gets clumped up as Windows viruses and no one bats an eye. IMO I think the platform the binary payload is targeting is a valid criteria to characterize a threat, so no problem in calling it a Linux virus, just as we have no problem calling those "Windows viruses".
- cutemonster 4y ago
  Office and IE are from Microsoft too, so makes sense to clump them together with Windows. -- You could call them "Microsoft vulnerabilities". But if it was WP on Windows, that'd be different
barbariangrunge 4y ago
This is why I shy away from the Wordpress ecosystem. You end up relying on a mass on plugins and you have to just hope they work together and don’t do anything sketchy. I’ve always felt worried by that. With other open source systems, there are large active repositories involved so you can trust things a lot easier. Although the npm / react ecosystems make me a little worried too, since dependencies are added so causally

dec0dedab0de 4y ago

I don't think linux has anything to do with it. I took that to mean it runs on Linux.

BirAdam 4y ago

Yeah, typically, a web server should be setup such that the web servers process runs as say: www-data:www-data, and then the web files should be: joe:www-data and those web files should be 644. In this manner, the web server process can read the files, but the files can neither be written to nor run. This very basic stuff that most of the world seems to ignore completely.

snowwrestler 4y ago
Wordpress typically has write access to itself so it can auto-install updates right away, which is also a good idea for security. But I t’s definitely a tradeoff in that it also increases the potential harm from bugs.
- progval 4y ago
  Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't?
  - codetrotter 4y ago
    > Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't? In theory yes. In practice no. I think a big reason that PHP grew popular years ago was that basically all you needed in order to set up a PHP site on a host was FTP access, and in certain cases DB credentials. For example, case in point, for WordPress you only need FTP and DB access. Certainly it was the case for me back in the day, when I started learning to program with PHP. I was still using Windows back then and I knew nothing about Linux or any of the other Unix-likes at the time. All I had was my Windows XP computers with XAMPP, and free hosting which provided me with FTP access. Many free hosts would give you MySQL DB credentials also I think. Cron and things like that would have been beyond my abilities at the time, and beyond what I was given access to by the free hosting companies.
    - sgbeal 4y ago
      >> Could it have a cron that runs as a user with write access to perform upgrades, while publicly-accessible processes don't? > In theory yes. In practice no. FWIW, after my one and only Wordpress installation was cracked via a vulnerability identical to the one reported in this thread (back in 2010-ish), i did exactly that: made all of the files and dirs read-only to the web user, and made the read/write only during upgrades. Since ditching that site, though, a couple of years later, WP has remained on my blacklist and i've neither touched it nor recommended its use (and actively recommend against it for anyone who asks because of its long, glorious history of being cracked). To this day, WP is still the only server-side software i've ever run which was cracked from the outside.

lucideer 4y ago

> I don't think linux has anything to do with it. The title is accurate, but I think a lot of people are objecting in comments here due to a general conflation of two separate concepts: 1) An exploit or vulnerability 2) A virus or trojan An exploit/vuln is a bug in software (Wordpress in this case) that allows unauthorized access - a virus/trojan is an app with malicious intent: one typically needs to take advantage of an exploit (or social engineering) to install & execute said app. Like any app, it's generally developed for a specific platform (in this case, Linux). --- TL;DR: The Wordpress exploits are known - the news in this article is about a specific Liunux app being deployed using those exploits. The bugs in Wordpress are not the news.

mort96 4y ago

This site is all over the place. It's not a trojan, and based on the description, it's not a backdoor.

worewood 4y ago

When a Virus targets I.E. or Office macros or other software, in general it all gets clumped up as Windows viruses and no one bats an eye. IMO I think the platform the binary payload is targeting is a valid criteria to characterize a threat, so no problem in calling it a Linux virus, just as we have no problem calling those "Windows viruses".

cutemonster 4y ago
Office and IE are from Microsoft too, so makes sense to clump them together with Windows. -- You could call them "Microsoft vulnerabilities". But if it was WP on Windows, that'd be different

barbariangrunge 4y ago

This is why I shy away from the Wordpress ecosystem. You end up relying on a mass on plugins and you have to just hope they work together and don’t do anything sketchy. I’ve always felt worried by that. With other open source systems, there are large active repositories involved so you can trust things a lot easier. Although the npm / react ecosystems make me a little worried too, since dependencies are added so causally