Mysterious Malware Is Infecting 100k Wordpress Sites

It might be a good idea to avoid any Wordpress sites you normally visit until they get this whole malware thing worked out.

Google has already blocked 11,000 domains to try to curb the damage. According to security firm Sucuri, the malware uses a vulnerability in a slideshow plug-in called Slider Revolution. The Slider Revolution team has known about the vulnerability since September, but it looks like they failed to fix it before the security hole got crammed with steaming hot malware.

Click to expand...

I wonder if the blog I pretend to write is infected. I've always imagined it would be a Wordpress one if it actually ever existed.

Something isn't adding up .. This is pretty wide-spread, the article is claiming ThemePunch knew about the exploit back in September. ThemePunch claims they patched it back in February.

So ... Which is it? Is it that old?

Queue Wolf Blitzer blaming North Korea in 5..4..3..2..

not running wordpress but I'll take this opportunity to backup my website now.

Fuck Wordpress. For my company's blog (that we update like 2x a year), I spent two days writing a mostly static replacement for wordpress; best two days investment ever.

toast0 said:

Fuck Wordpress. For my company's blog (that we update like 2x a year), I spent two days writing a mostly static replacement for wordpress; best two days investment ever.

Click to expand...

I am thinking to do the same thing. Much easier...

Spidey329 said:

Something isn't adding up .. This is pretty wide-spread, the article is claiming ThemePunch knew about the exploit back in September. ThemePunch claims they patched it back in February.

So ... Which is it? Is it that old?

Click to expand...

The exploit came out a while ago, it's surprising that there were still 100k+ websites were out there that were vulnerable. I checked a few weeks ago after reading about it and a bunch of sites showed up with a basic Google dork for a theme that was bundled with the slider. Most of them wouldn't return the contents of wp-config but a few did. I'm assuming someone probably made a comprehensive list of themes that came with the slider and wrote a script to automate the pwning process.

Was the website telling about this exploit also a wordpress blog?

wait, I thought wordpress was malware to start with.

that would explain dulfy.net I thought it was my flash that was broke.

90% of wordpress "hacks" are actually plugin hacks, sooooo don't run any plugins, problem solved

Wordpress is great...as long as you keep on top of it. One of the reasons Wordpress is 'sold' and is so popular is that the owner can update and mange it themselves without having to go back to the web designer to do it.

Many website owners ask for that very functionality.

However, in reality very few ever actually do maintain and update their sites once handed over. So their version of Wordpress gets out of date and usually hacked as a result.

The web designer who monitors such things just in case will notice this, sigh or smile and wait for the customer to call back begging them to fix it all once they notice (if they ever do).

Once again the weak link is the human one.

I had an inception dream on this last night. I yelled at my wife for having this slideshow on my wordpress blog and she told me it was just a dream. Then I had another dream where it was on my website.

Lol.

Oh my god this is getting ridiculous and the misinformation about Wordpress is amazing.

A) The problem was with a specific plug-in that is extremely popular and well maintained. Unless someone had not updated their site for a long time, the vulnerability was patched ages ago (many months) but news spread out now.

B) The fact that it is so easy to keep a WP installation up to date but still, there were so many sites affected makes me believe that some people wanted that to happen (i.e. web authors vs clients). The vast majority of those sites' designers had received notifications on freaking time to update the plug in and they seemed to ignore it deliberately or not. I did not, although I was already up to date.

C) There is a huge library of security tools (free and paid) for wordpress yet most people don't use them.

I currently building a site for example that aside the fact that it does not look like wordpress at all, visitiors won't be able to see it is Wordpress even by inspecting the source code. Yes you can hide that too.

Honestly, this has nothing to do with Wordpress but with the way some people manage their sites.


Finally, I am using Wordpress + plugins + JS scripts + html + CSS to build very powerful web sites that can do things costing 10s of thousands if going the custom development route. So basically, there is no way one can replace it on their own with any home made solution unless they want to do the most basic stuff and it will still be lacking in a million ways compared to what Wordpress is capable of. It's not easy to compete with the huge library of plug-ins and add-ons the WP has to offer and no other CMS comes even close to that.




BTW - the Irony - Sony uses Wordpress in several of their sites and although most of their systems have been hacked in every possible way, I am not aware of any hack to their Wordpress Sites. If anyone is aware of such incidents I would be glad to know.

westrock2000 said:

Queue Wolf Blitzer blaming North Korea in 5..4..3..2..

Click to expand...

Who the hell is Wolf Blitzer?