6 ms·

Script kiddies have awesome tools

63 points by iamelgringo 18y ago

martey 18y ago
Most of the blog exploits on the web (including the one in the article) seem to be focused on WordPress. Are there are a large number of people exploiting vulnerabilities in other blogging platforms, like Movable Type?
- niels_olson 18y ago
  target platform is presumably based on the dominance of the platform in the market. http://www.google.com/trends?q=joomla%2C+wordpress%2C+drupal%2C+mediawiki%2C+django%2C+sakai%2C+moodle%2C+mambo%2C+movable+type http://www.google.com/trends?q=joomla%2C+wordpress%2C+drupal...
- mmagin 18y ago
  First, I assume this is for the same reason that most viruses are for Windows -- WordPress is one of the most common species in the ecosystem. Also, If I understand the architecture of Movable Type correctly, it renders much of the site into static pages. I would expect that this tends to reduce the number of points where vulnerabilities would be possible, at least as far as points where it might be exploited via causing it to execute with malicious parameters via an HTTP request. i.e. In Wordpress, every page you load is the result of the execution of some PHP scripts, while in a blog that is rendered to a bunch of static files, it's conceivable that the only thing that unauthenticated users can mess with is the comment system.
  - omouse 18y ago
    Yep, much of Movable Type is static. I think there is an option for dynamic pages but by default it's static.
timcederman 18y ago
Here's the script. http://madnet.name/eng/files/1/10.html http://madnet.name/eng/files/1/10.html
tptacek 18y ago
Wordpress has had a catastrophic history of insecure code, based on a number of basic design flaws: * Reliance on ad-hoc hand-coded SQL. * A system that registers psuedonymous Internet commenters in the same user table as Wordpress administrators. * Mishandling of internationalization. Yes, Wordpress is also the most popular blogging platform, and yes, it's also much more dynamic than its competitors, but phpBB and vBulletin seem to have had better track records than Wordpress have. It's just not very secure.
- Tichy 18y ago
  Isn't the basic design flaw being programmed in PHP?
  - tptacek 18y ago
    There are PHP programs with decent track records. PHP doesn't make it easy to write secure web apps, but it's not a lead weight either.
- thomasmallen 18y ago
  phpBB has an atrocious security record as well.
  - tptacek 18y ago
    I'd deploy phpBB in its default configuration before I'd deploy default Wordpress. (Our blog is Wordpress).
    - thomasmallen 18y ago
      phpBB has an atrocious security record. It's gotten much better since version 3.
      - tptacek 18y ago
        I think I could credibly dispute the record here, but I think we can also probably just agree that today, phpBB is hobbled by fewer design errors and better hygiene than Wordpress. Wordpress is just a scary glob of PHP code.
Haskell 18y ago
Anyone that have read Wordpress' source code should not be surprised that it is the most exploited piece of software on the web. It was not created by programmers. It was created by web designers (hence its great visual design). Wordpress was probably the only company that has migrated from Ruby to PHP (when they purchased Gravatar).
- axod 18y ago
  "Wordpress was probably the only company that has migrated from Ruby to PHP" This is just childish. Different tools and languages have different uses. End of story. Ruby isn't better than PHP, PHP isn't better than Ruby - That's like saying a screwdriver is better than a saw - It depends what you're trying to accomplish with the tool.
- ivank 18y ago
  Not just one. Derek Sivers: "I spent two years trying to make Rails do something it wasn’t meant to do, then realized my old abandoned language (PHP, in my case) would do just fine if approached with my new Rails-gained wisdom." http://www.oreillynet.com/ruby/blog/2007/09/7_reasons_i_switched_back_to_p_1.html http://www.oreillynet.com/ruby/blog/2007/09/7_reasons_i_swit...
alecco 18y ago
Now point-and-click kiddies are the rage. Scripts are so 90s. "No sympathy for the devil, keep that in mind. Buy the ticket, take the ride."
charlesju 18y ago
This happened to one of my old wordpress blogs, I had to delete the whole thing. That's why I just use blogspot through Google now, it's not worth the time to keep track of all the updates and stuff.

63 points by iamelgringo 18y ago

Most of the blog exploits on the web (including the one in the article) seem to be focused on WordPress. Are there are a large number of people exploiting vulnerabilities in other blogging platforms, like Movable Type?

niels_olson 18y ago
target platform is presumably based on the dominance of the platform in the market. http://www.google.com/trends?q=joomla%2C+wordpress%2C+drupal%2C+mediawiki%2C+django%2C+sakai%2C+moodle%2C+mambo%2C+movable+type http://www.google.com/trends?q=joomla%2C+wordpress%2C+drupal...
mmagin 18y ago
First, I assume this is for the same reason that most viruses are for Windows -- WordPress is one of the most common species in the ecosystem. Also, If I understand the architecture of Movable Type correctly, it renders much of the site into static pages. I would expect that this tends to reduce the number of points where vulnerabilities would be possible, at least as far as points where it might be exploited via causing it to execute with malicious parameters via an HTTP request. i.e. In Wordpress, every page you load is the result of the execution of some PHP scripts, while in a blog that is rendered to a bunch of static files, it's conceivable that the only thing that unauthenticated users can mess with is the comment system.
- omouse 18y ago
  Yep, much of Movable Type is static. I think there is an option for dynamic pages but by default it's static.

timcederman 18y ago

Here's the script. http://madnet.name/eng/files/1/10.html http://madnet.name/eng/files/1/10.html

tptacek 18y ago

Wordpress has had a catastrophic history of insecure code, based on a number of basic design flaws: * Reliance on ad-hoc hand-coded SQL. * A system that registers psuedonymous Internet commenters in the same user table as Wordpress administrators. * Mishandling of internationalization. Yes, Wordpress is also the most popular blogging platform, and yes, it's also much more dynamic than its competitors, but phpBB and vBulletin seem to have had better track records than Wordpress have. It's just not very secure.

Tichy 18y ago
Isn't the basic design flaw being programmed in PHP?
- tptacek 18y ago
  There are PHP programs with decent track records. PHP doesn't make it easy to write secure web apps, but it's not a lead weight either.
thomasmallen 18y ago
phpBB has an atrocious security record as well.
- tptacek 18y ago
  I'd deploy phpBB in its default configuration before I'd deploy default Wordpress. (Our blog is Wordpress).
  - thomasmallen 18y ago
    phpBB has an atrocious security record. It's gotten much better since version 3.
    - tptacek 18y ago
      I think I could credibly dispute the record here, but I think we can also probably just agree that today, phpBB is hobbled by fewer design errors and better hygiene than Wordpress. Wordpress is just a scary glob of PHP code.

Haskell 18y ago

Anyone that have read Wordpress' source code should not be surprised that it is the most exploited piece of software on the web. It was not created by programmers. It was created by web designers (hence its great visual design). Wordpress was probably the only company that has migrated from Ruby to PHP (when they purchased Gravatar).

axod 18y ago
"Wordpress was probably the only company that has migrated from Ruby to PHP" This is just childish. Different tools and languages have different uses. End of story. Ruby isn't better than PHP, PHP isn't better than Ruby - That's like saying a screwdriver is better than a saw - It depends what you're trying to accomplish with the tool.
ivank 18y ago
Not just one. Derek Sivers: "I spent two years trying to make Rails do something it wasn’t meant to do, then realized my old abandoned language (PHP, in my case) would do just fine if approached with my new Rails-gained wisdom." http://www.oreillynet.com/ruby/blog/2007/09/7_reasons_i_switched_back_to_p_1.html http://www.oreillynet.com/ruby/blog/2007/09/7_reasons_i_swit...

alecco 18y ago

Now point-and-click kiddies are the rage. Scripts are so 90s. "No sympathy for the devil, keep that in mind. Buy the ticket, take the ride."

charlesju 18y ago

This happened to one of my old wordpress blogs, I had to delete the whole thing. That's why I just use blogspot through Google now, it's not worth the time to keep track of all the updates and stuff.