4 ms·

How did they harden it? Anyone know?

by nodata 12y ago

josefresco 12y ago
Good question - the wp-login.pp is accessible, however that doesn't say too much: https://www.wired.com/wp-login.php https://www.wired.com/wp-login.php They left this up: https://www.wired.com/readme.html https://www.wired.com/readme.html - But again, now too telling. Site does not handle being secure: https://www.wired.com/ https://www.wired.com/ I would imagine most of the "hardening" is on the server level, and not the basic level WP security that most webmasters usually encounter.
- nodata 12y ago
  But server level hardening to prevent a defacement?
- eeeeeeeeeeeee 12y ago
  They are forcing SSL for /wp-login.php, though. Better than nothing as I'm sure Wired staff are logging in to this system from all over the place. Would be interesting to know more about how an article gets from written to published. Do the writers draft in WP and then have editors review it?
skywhopper 12y ago
I have no inside information, but there's a lot of things you could do by simply avoiding the built-in commenting system, and exposing the admin tools only to an internal network. You can pretty aggressively prune down the Wordpress install footprint/attack surface on your public-facing servers if you are willing to do some minor patching. Not to mention, a reverse-proxy layer in front of Wordpress can let you filter out the most obvious attacks and block lots of potential ones without touching the code itself.
- at-fates-hands 12y ago
  You might add in there testing your plugins as well. Pretty much all of the WP security warnings are due to vulnerable plugins people are using without testing and leaving themselves exposed.
falcolas 12y ago
As someone who has just gone through this process, it consists of a number of steps: - Whitelisting URL access in Nginx (though this can be circumvented since everything is ultimately executable through the root index.php, and there are a lot of intermediate URLs) - Preventing writes to any portion of the WP install directory save uploads. Note - this breaks the option of automatic upgrades, but it prevents a lot of potential hacks. - Overwriting theme portions you don't want to exist - for example even if never linked to, you can frequently access the comment page and get the default one. However, if you put in a comment theme PHP file and leave it more-or-less blank, you limit the potential harm coming from there. - Disable many things in the settings.php file, like the cron, debug output, file_mod, etc. - Cache as much of the output as possible. - Block a bunch of the informational headers set by WordPress (though this only helps a bit; you can still identify the exact version of a WordPress site using fingerprinting) - Run WPScanner against your site and plug those leaks. - Limit what plugins you install to the bare minimum - Keep everything up to date. This is not comprehensive, and we're probably still at risk, but it's a start.
snowwrestler 12y ago
I don't know what Wired did, but for general hardening advice the WP community has a pretty good page: http://codex.wordpress.org/Hardening_WordPress http://codex.wordpress.org/Hardening_WordPress
korzun 12y ago
First step would be disabling wp-login functionality and putting CMS on an isolated cluster that sits behind VPN. Looks like it's wide-open; that should tell you all you need to know.

How did they harden it? Anyone know?

by nodata 12y ago

How did they harden it? Anyone know?

Good question - the wp-login.pp is accessible, however that doesn't say too much: https://www.wired.com/wp-login.php https://www.wired.com/wp-login.php They left this up: https://www.wired.com/readme.html https://www.wired.com/readme.html - But again, now too telling. Site does not handle being secure: https://www.wired.com/ https://www.wired.com/ I would imagine most of the "hardening" is on the server level, and not the basic level WP security that most webmasters usually encounter.

nodata 12y ago
But server level hardening to prevent a defacement?
eeeeeeeeeeeee 12y ago
They are forcing SSL for /wp-login.php, though. Better than nothing as I'm sure Wired staff are logging in to this system from all over the place. Would be interesting to know more about how an article gets from written to published. Do the writers draft in WP and then have editors review it?

skywhopper 12y ago

I have no inside information, but there's a lot of things you could do by simply avoiding the built-in commenting system, and exposing the admin tools only to an internal network. You can pretty aggressively prune down the Wordpress install footprint/attack surface on your public-facing servers if you are willing to do some minor patching. Not to mention, a reverse-proxy layer in front of Wordpress can let you filter out the most obvious attacks and block lots of potential ones without touching the code itself.

at-fates-hands 12y ago
You might add in there testing your plugins as well. Pretty much all of the WP security warnings are due to vulnerable plugins people are using without testing and leaving themselves exposed.

falcolas 12y ago

As someone who has just gone through this process, it consists of a number of steps: - Whitelisting URL access in Nginx (though this can be circumvented since everything is ultimately executable through the root index.php, and there are a lot of intermediate URLs) - Preventing writes to any portion of the WP install directory save uploads. Note - this breaks the option of automatic upgrades, but it prevents a lot of potential hacks. - Overwriting theme portions you don't want to exist - for example even if never linked to, you can frequently access the comment page and get the default one. However, if you put in a comment theme PHP file and leave it more-or-less blank, you limit the potential harm coming from there. - Disable many things in the settings.php file, like the cron, debug output, file_mod, etc. - Cache as much of the output as possible. - Block a bunch of the informational headers set by WordPress (though this only helps a bit; you can still identify the exact version of a WordPress site using fingerprinting) - Run WPScanner against your site and plug those leaks. - Limit what plugins you install to the bare minimum - Keep everything up to date. This is not comprehensive, and we're probably still at risk, but it's a start.

snowwrestler 12y ago

I don't know what Wired did, but for general hardening advice the WP community has a pretty good page: http://codex.wordpress.org/Hardening_WordPress http://codex.wordpress.org/Hardening_WordPress

korzun 12y ago

First step would be disabling wp-login functionality and putting CMS on an isolated cluster that sits behind VPN. Looks like it's wide-open; that should tell you all you need to know.