4 ms·
Did I miss it, or did none of the investigating and none of the hiring of 3rd party firms lead to tracking down the attack vector?
by dangrossman 14y ago
Did I miss it, or did none of the investigating and none of the hiring of 3rd party firms lead to tracking down the attack vector?
- Estragon 14y agoWow, I missed that when I read it. Jason is an excellent writer/marketer.
- snowwrestler 14y agoI came away with the same impression--they have no idea how it happened. In their defense though, Wordpress by default lets site administrators directly edit PHP template files through a browser textarea. That means a lot of security is riding on user-set passwords. Normally I'd say that could be mitigated by denying apache write access on the core files. But doing so would break the ability for users to initiate core updates via the web browser. So if you can break/guess an admin password, you can upload arbitrary PHP code which has full write access to the appplication files. There's not really any way to secure that. I'm sure that's why Wordpress.com does not run individual full instances of Wordpress--it's the world's largest multisite installation of Wordpress and site owners can't touch the core files.