Slashdot is powered by your submissions, so send in your scoop

 



Forgot your password?
typodupeerror
Security Worms

Wordpress.org Warns of Active Worm Hacking Blogs 103

Posted by timothy
from the in-this-case-the-worms-are-actually-human-beings dept.
Erik writes "Wordpress, the popular open-source Content Management System (CMS) for many thousands of bloggers worldwide, is under attack from a 'clever' worm that automatically compromises unpatched versions of the Wordpress system. The particularly nasty bug crawls the web for vulnerable Wordpress installations, installing malware, deleting content, and generally wreaking havoc wherever it can. Today, Wordpress founder Matt Mullenweg eloquently implored Wordpress bloggers to update more frequently. Originally, updating the Wordpress system was a rather laborious process; however, newer versions offer fast and simple one-click upgrades. The two most recent versions of Wordpress (2.8.3 and 2.8.4) cannot be attacked by the worm discovered this week, and blogs hosted at Wordpress.com are also apparently immune."
This discussion has been archived. No new comments can be posted.

Wordpress.org Warns of Active Worm Hacking Blogs

Comments Filter:
  • "Clever?" (Score:5, Insightful)

    by Solra Bizna (716281) on Saturday September 05, 2009 @06:04PM (#29327185) Homepage Journal

    There have been widespread worms that did this sort of thing before (phpBB comes to mind). Does this one do anything novel that makes it deserve the adjective "clever?"

    -:sigma.SB

    • by mysidia (191772)

      There was exactly 1 really clever worm of this nature. The internet worm created by Robert Morris Jr. [ryerson.ca] 21 years ago. And perhaps the first worm in a PHP/CGI app which was not this one.

      The rest have just been copycats, non-original. And the payload isn't even clever.

  • Hey Wordpress... (Score:5, Insightful)

    by pathological liar (659969) on Saturday September 05, 2009 @06:07PM (#29327203)

    Maybe you should stop putting the Wordpress version in meta tags on the page? Or at least make it opt(-in)ional?

    • Re: (Score:3, Informative)

      by zn0k (1082797)

      As outlined in TFA (yes, I know, I know) that's snake oil. You can run response tests to determine a version.

      • by StarHeart (27290) * on Saturday September 05, 2009 @06:32PM (#29327343)

        I wouldn't say it is snake oil. Putting versions in a page allows you to Google for it. Which makes the attack a lot easier. It also allows the attacker to do reconnaissance a lot less detectably a hold of time, and then spring it on everyone at once.

        • by siloko (1133863)

          It also allows the attacker to do reconnaissance a lot less detectably a hold of time

          You're at +3 Insightful so I guess this means something, but perhaps not in English . . .

      • by yawnmoth (534382)
        I suppose you also think salted passwords are snake oil? Sure, they're not going to stop someone who's brute forcing on-the-fly, but it does make life more complicated for people using rainbow tables.

        I only mention salted passwords because Wordpress uses them [openwall.com] (see wp-includes/class-phpass.php).
  • by Anonymous Coward on Saturday September 05, 2009 @06:26PM (#29327317)

    ...newer versions offer fast and simple one-click upgrades

    If wordpress.org is hacked, again [wordpress.org], their one-click upgrade feature means instant ownage for all Wordpress blogs everywhere.

    • Slightly better one-click system:
      - Open your favourite shell (click, sometimes)
      - wget the patch file
      - read through the patch file if you think it may be an ownage patch
      - apply patch file
      - ???
      - Profit. Too bad for all those that have to manually apply the patch for lack of patch (or something similar)
    • by jesser (77961) on Saturday September 05, 2009 @06:59PM (#29327517) Homepage Journal

      That problem isn't specific to 1-click updates. It exists equally with 0-click updates (like Firefox's minor updates) and 50-click updates (like WordPress used to have).

      You can improve the security of updates by using multiple layers of software protection (e.g. https AND code-signing). You can't improve security by increasing human involvement in the update process and then blaming users who update while the site is hacked. Increasing human involvement just makes it slower and limits the kinds of software protection you can use.

      • by mysidia (191772)

        No, when you click the "auto upgrade" button, WP prompts you to enter the hostname, FTP username, and FTP password, to apply the upgrades.

        Now, this does pose a security risk if your site is compromised (unbeknownst to you), and the attacker manages to use SQL injection to redirect you to a 'fake upgrade page'

        When you click the upgrade button, and provide your credentials... the attacker has co-opted the web-ui, and you're sending the FTP username and password directly to the kiddie, giving them the me

        • by PReDiToR (687141)
          My WP install doesn't ask me for those details.

          But then, I'm running it on my own LAMP.
        • by JSlope (1180805)
          You don't have the correct permissions on your files, if it asks you for ftp login and passwords. With correct permissions it can modify everything by itself.
          • by mysidia (191772)

            Au Contraire. I think if it can modify itself, the site clearly has incorrect file permissions. It's intended behavior that scripts can't modify themselves.

            Actually, I use SELinux configurations to make sure Apache can never write to files in web content directories.

            • by JSlope (1180805)
              Actually I think that the ability to easy upgrade the system to latest version (without vulnerabilities) outages the risk of self modifying scripts. I've seen old sites un-updated because it takes 20 minutes instead of one to update them. It's the same risk as turning on autoupdate in your OS.
              • by JSlope (1180805)
                outages = outweighs
              • by mysidia (191772)

                I actually don't think it does outweigh the risk... it's not that much harder to enter credentials to update the files.

                There are a lot of good ways to implement auto-update that don't require self-modifying scripts. A good example, would be to have a yum repository, and deploy updates with "yum update"

                Or even to have the user setup a daemon during install that checks for and applies updates.

                If the script can modify files in the web folder, there is much more serious damage a script kiddie can do if

                • by JSlope (1180805)
                  Actually they'll be able to modify content of the site by having admin, at least with wordpress most of the content is stored in database.

                  So they'll be able to upload malicious js files.
                  They will be able to serve fishing sites form your web server to some degree.
                  And anyway usually you can update php code easily: remove everything and update a new version from development site. But the most difficult task is to clear the database, so that to keep useful content and to remove malicious changes. Usually it
    • by jo42 (227475)

      The problem with "simple one-click upgrades" is that the web server, usually Apache, requires full read/write privileges to the directories and files that Wordpress lives in. Talk about a massive gaping security hole.

    • by mysidia (191772)

      Haven't they ever heard of signed patches?

      Why can't they make the one-click upgrade verify a GPG signature before performing the installation of the code contained in the upgrade file?

  • From TFA: "This particular worm, like many before it, is clever: it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts."

    So let me get this straight. If I have a blog that doesn't allow other people to
    • It registers a user? I wonder if this why my Wordpress blog, which generally is not of interest to anyone, suddenly has had several requests for new user registrations.
      • This interests me because I've seen the same thing in the last couple of days. Normally the only reason anyone registers on my blog is to post a comment. I have my settings so I have to approve the first comment and after that they're good to go - so it was odd to see a couple of registrations with no comment approval coming straight after.

        Now I've gone to check... they're all gmail accounts. *suspicious*

  • by Anonymous Coward

    http://wordpress.org/download/ [wordpress.org]

    When you download Wordpress, you're asked for your email address for release notifications. Shame they don't actually use it:

    http://wordpress.org/support/topic/230558 [wordpress.org]

    What's the point of offering it if they don't use it? Also, their blog has such a terrible noise-to-quality ratio that it's absolutely useless in this regard. All I care about is whether a new version is available or not - I couldn't care less about what new "awesome" features they've added or are trying to

    • Re: (Score:3, Informative)

      by Zancarius (414244)

      What's the point of offering it if they don't use it? Also, their blog has such a terrible noise-to-quality ratio that it's absolutely useless in this regard. All I care about is whether a new version is available or not - I couldn't care less about what new "awesome" features they've added or are trying to add - I just want to update my blog when new versions are released and leave it at that.

      The admin dashboard alerts you whenever a new version is available. You don't even need to register with/check thei

      • by EnglishTim (9662)

        Yes, but that assumes you regularly visit your admin panel.

        • Whenever you login as an admin to post, or do something else, that is your default landing spot.

          If you choose not to do anything, because some precious widget might break, or you have a hair appointment in 20 minutes, and continue doing so through numerous point releases, you get what you paid for eh?

          Or as Duncan Chalk said:
                    "Pain is instructive"

  • aghhhh!!! (Score:4, Funny)

    by stokessd (89903) on Saturday September 05, 2009 @06:44PM (#29327433) Homepage

    Now even my own blog says that I need to enlarge my Penis!

    • Re: (Score:1, Funny)

      by Anonymous Coward

      A clever worm, regardless the interpretation.

    • Re: (Score:2, Informative)

      by reboot246 (623534)
      And isn't it about time you took the hint? :)
  • Scobilizer has been tweeting about the same problem this afternoon.
    • by maxume (22995)

      Hey, he can't spend all day on the toilet.

    • by Swampash (1131503)

      Scoble's blog was hosted by Wordpress.com for about four years. During that time he wasn't hacked once. When Scoble was hired to pimp Rackspace, his blog moved to a box at Rackspace, and evidently no-one at Rackspace keeps up with security patches. Not a good look for a hosting company.

  • by Anonymous Coward

    The reason most siteowners are slow or never update is because it's a huge pain in the butt.

    This applies to almost all CMS's, forums, and similar software.

    While a one-click solution sounds nice, the real problem is that almost any large board has a number of plug-ins and modifications to get it where it needs to be.

    Once those mods/plugins are installed, the one-click updates no longer work.

    SEO URL's?
    Custom themes?
    Anti-bot measures?

    All of these things can completely render an "easy update" useless.

    The people

    • Re: (Score:2, Interesting)

      by Anonymous Coward
      The WordPress "one click update" is annoying, too. Instead of fetching the package it needs from a URL, unpacking it in a temporary directory, and copying the files it needs locally, it requires an FTP login and password.
      • by zonky (1153039)
        No, that is a very good idea, because apache shouldn't have write permissions to your core wordpress files- using a seperate ftp account login means you're elevating to overwrite files a good idea indeed.
        • by ukyoCE (106879)

          Yep, this. I tried to do the upgrade and was a little surprised when it asked for FTP login information. I had never even tried the "automatic upgrade" because I knew making my entire wordpress install modifiable by apache was a blatantly bad idea.

          The use of the FTP account to do it makes a good deal of sense, and is about the best they can do.

          Honestly the manual upgrade is so easy as to be laughable anyway, but for the frequency of WP updates, anything that makes it easier is still a good thing.

    • by phoebe (196531) on Saturday September 05, 2009 @09:33PM (#29328391)

      There is also a interesting point regarding software repository support. I have a server running Ubuntu 8.04 LTS Server which is supposed to be supported till April 2011, however Wordpress is in the Universe repository and not updated since November 2008 and is vulnerable to a few attacks that delete content.

      If these packages are not going to be updated should there not be at least a warning, or method to bar such packages from being installed after security issues have been raised?

      Wordpress 2.3.3 [ubuntu.com] in 8.04 LTS Universe repository.

      • Packages are aren't actively maintained for security fixes should be removed from the repositories.
        • by choongiri (840652) on Saturday September 05, 2009 @10:30PM (#29328685) Homepage Journal

          *sigh* I don't think you understand how package management and security fixes in debian / ubuntu works. New releases of software almost invariably introduce new features, as well as bug fixes. For that reason, important fixes for security issues are backported, and the version number stays the same. (Introducing new features to a LTS / stable release wouldn't be acceptible.)

          Now, what you said is technically true - if it's not being actively maintained for security fixes it *should* be removed - but the fact that Ubuntu's universe package of wordpress is still at 2.3.3 doesn't in and of itself mean that it hasn't been patched with the latest security fixes.

          • by palegray.net (1195047) <philip.paradis@pa3.14legray.net minus pi> on Saturday September 05, 2009 @11:32PM (#29328973) Homepage Journal
            I've verified that the OP's assessment of the situation is valid with respect to WordPress (a fresh install from the repos exposes unpatched vulnerabilities long after patches are released to correct the situation).

            I understand the Debian/Ubuntu package management and security release system quite well; I happen to work or a certain "Large Virtual Server Company" and I've been using Debian almost exclusively on my systems for almost ten years.
      • From Ubuntu's website [ubuntu.com]. This was the first result from googling for ubuntu universe.

        Canonical does not provide a guarantee of regular security updates for software found in universe but will provide these where they are made available by the community. Users should understand the risk inherent in using packages from the universe component.

        Unlike Ubuntu, Debian does support anything in their repository. There was a security update for wordpress last month. They also do remove packages in which security supp

      • by xdroop (4039)

        Why don't people upgrade? Well in my case, I didn't upgrade because I knew that upgrading would immediately kill both the aftermarket theme and several of the aftermarket plugins that I was using, some of which had a huge amount of non-trivial data stored in them. All the plug-ins and theme bits came from WordPress-blessed sites, which made the time-bomb nature of their unsupportedness even more frustrating. After fighting through several minor updates and then looking at a major one, I just gave up, exp

  • I personally use www.SimpleScripts.com for this exact reason. I use a ton of open source software for my websites and it is hard to keep track of all the updates made to them. SimpleScripts emails me every time an update comes out and it provides me a one click upgrade to the latest version for Wordpress, phpBB and Drupal which are the 3 systems I use the most.
    • by Swampash (1131503)

      Yeah, but you actually CARE. Anyone who runs a Wordpress blog is greeted, in mile-high-flaming letters, with "YOUR WORDPRESS VERSION IS OUT OF DATE, CLICK HERE TO UPDATE" whenever he logs in to the CMS when it's running a version other than current. The hole being exploited by this worm was fixed about six months ago.

      In other words, the people who are getting hit by this worm have been ignoring the reminders to upgrade for at least half a year.

      • by teraph (147902)

        And if you're really lazy, or don't regularly update your blog, you can even enter your email on the Downloads page of Wordpress.org and they will email you whenever a stable version comes out.

  • Thanks for posting. I finally upgraded from version 2.3 to 2.8.4 for my [lowtechtimes.com] blogs [olddominionwildlife.com].
  • That's a good information. Most of the serious bloggers keep updated their wordpress versions. The users also have option to update their blog by just one click. If you have not done so, please do it right now.
  • ... how about he makes a passionate plea to the PROGRAMMERS to say 'Guys, let's STOP PUTTING SECURITY HOLES IN OUR SOFTWARE?'

    Just a thought.

    It shouldn't be any user's problem to need to 'upgrade or get hacked'. If you're writing web software that's hackable, you're the one doing it wrong., not your users.

  • Does anybody have any technical details about this worm ?

    Some people can't upgrade immediately and it would be nice to be able to block the request strings (or user-agent, IP address, whetever) that the worm uses.

    I have looked around the various blogs reporting this and on full-disclosure lists but I can't find any better advice than "Upgrade. Now."

  • Matt Mullenweg eloquently implored Wordpress bloggers to update more frequently.

    If only Matt stopped breaking backwards compatibility, I would be up to date constantly. In the last few years I've seen several things breaking as matty decided to rename hooks and stuff. Therefore, all important functions of my sites must be checked before actually upgrading...

Mediocrity finds safety in standardization. -- Frederick Crane

Working...