New attacks today against Wordpress (lots of sites hacked)

http://blog.sucuri.net/2010/05/new-attack-today-against-wordpress.html

by sucuri2 • 16 years ago

66 74 16 years ago

blog.sucuri.net

tptacek10• 16 years ago

Avoid Wordpress.

Sometimes a short comment is that's warranted.

fseek• 16 years ago

Avoid Wordpress and shared hosts. They mention that all the sites hacked were on shared hosts.

ube2• 16 years ago

Avoid Wordpress...really? I can understand avoiding shared hosts because you have less control of the environment but going to an alternative blogging platform because it is more obscure than Wordpress seems to be a bad approach (and if you go with a vps solution you might have the headaches of maintaining a secure distro). This is like saying "you should use Linux or Mac because Windows gets attacked more".

Any piece of software that is popular (I saw a recent statistic that wordpress powers %10 of the top 1 million sites as ranked by Alexa) will be much more vulnerable to attack than less popular software. At the same time, you get a bigger community and all the goodies that come along with that popularity (more plug-ins, themes, etc...).

I don't think that getting rid of the software is the correct approach in this case. You need to approach it by assuming that your wordpress site will be attacked every day and you need to have a plan to remediate this. There is no perfect security unless you unplug your web server from the internet. For a one blogger site - one simple approach would be to:

1. Run something like open source tripwire (http://sourceforge.net/projects/tripwire/) on a nightly basis so you can get alerted if any wordpress files get changed (HN peoplez: anyone have a better tripwire-ish solution that is free?)

2. Run a nightly backup of your files and db and mail it to an external account (like a gmail account)

3. have a script that can reload your files and database quickly from your backups (obviously - this needs to be tested)

4. subscribe to the wordpress security list and to a blog like http://www.wpsecuritylock.com/blog/

kmano8• 16 years ago

Wordpress hosted on my linode vps seems just fine. Switching from godaddy to linode was more than worth the price increase.

mitchellhislop2• 16 years ago

Agreed. Also, making small changes to some of the config helps too. This is why I laugh at people who know nothing about hosting, permissions, or php in general deciding that they know WP, put it on a shared box without doing the proper setup, and then blame wordpress when it gets hacked.

elidourado4• 16 years ago

Entrepreneurs take note. This is a problem that is not being solved. There are lots of smallish bloggers out there who want more customization than Blogger/Wordpress.com/Tumblr/Posterous allow, whose best option is Wordpress and shared hosting. This is a sucky best option. Do something about this; make some money solving this problem.

llimllib3• 16 years ago

Well, at the risk of derailing the conversation... I've extensively customized tumblr. I have beefs about some other elements of their service, but what sort of customization are you talking about that's not possible with tumblr?

jerf4• 16 years ago

This is a Turing Tarpit; the only infinitely customizable blog platform is "PHP" (or your choice of other actual language). And as your customization possibility space increases, the customization inevitably starts to look like a language. Because it is.

That's why nobody's "solved" this problem in the last ten years; you can't have programming language flexibility without programming language complexity.

drusenko3• 16 years ago

Weebly is solving this problem -- you just may not have noticed.

We have rich blogging features that are on par or better than most blog systems: create posts, edit your side bar, set catgories, human-readable (and adjustable) URLs, commenting, comment moderation (open/moderate/closed), close commenting after x days, post in the past, set time zones, post drafts, private drafts, etc.

Even better, a blog doesn't have to be the focus of your site -- it can be just a page. You can create other pages to put things like pictures, videos, photo galleries, slide shows, maps -- by just dragging and dropping them on. You can even create custom forms and surveys by dragging on the form elements (name, address, phone number, drop downs, etc)

While you can't upload PHP, you do have full customizability over your theme CSS and HTML.

To top it off, your site is hosted free of charge on our robust infrastructure that's machine and geographically redundant. We serve sites that hit the front page of Digg or the NYT every day and don't even see a blip in our traffic graphs :)

joshu2• 16 years ago

http://joshua.schachter.org/2009/12/blogging-tools.html

gtt• 16 years ago

IMHO there is a decent alternative called Byteflow http://byteflow.su/

based on django btw

aw3c22• 16 years ago

Suggest a free php alternative please. I need categories, comments, human-readable urls.

tptacek10• 16 years ago

Weigh PHP, categories, comments, human-readable URLs, and convenience against retaining control of your content or (potentially) the server it lives on.

The people running Sendmail in the '90s went through all these arguments too.

It's hard to understand how a blog package could have created a worse track record than Sendmail (though I can tell you how). But it did.

chaosmachine• 16 years ago

Drupal has those features, and a pretty reasonable security record. It's not as user friendly as WP, though.

hkuo2• 16 years ago

As I mentioned in my other comment, I give a thumbs up to Movable Type, particularly in regards to security. The only database access is done on the admin side. When you publish anything, it generates pure html pages. So only you access the database. Users only access html. There are no complexities between these two arrangements.

Movable Type takes just a little longer to set up than WordPress, but hey, many of us here are hackers right? Plus you can tweak the code to your heart's content.

zzzmarcus• 16 years ago

I have 2 Wordpress blogs that get comparable amounts of traffic. They're both on the same shared hosting (MediaTemple), they're both updated at the same time.

One never seems to be touched, the other seems to have gotten a high spot on some l44t hax0r's list and is exploited just about every time there a security flaw is discovered. It's annoying to say the least.

Slowly over the years I've been moving everything that I don't absolutely have to host off shared hosting or VPS's and onto hosted services (I love Tumblr) that allow backups/exports. In my experience, it's just not worth the headaches to self-host things like blogs.

modoc• 16 years ago

Do you have an alternative you recommend?

mattwdelong• 16 years ago

Sunlight labs blogdor is suiting my needs perfectly. I will be forking and adding my contributions in the near future.

http://github.com/sunlightlabs/django-blogdor

sucuri23• 16 years ago

Details of the code are here:

http://sucuri.net/malware/entry/MW:MROBH:1

I am wondering what google will do if they keep doing malware to hide from them. Their blacklist will become useless.

tptacek10• 16 years ago

That code doesn't really say anything about how the blogs were compromised, or anything interesting about what the attackers did with it (yup, they added js to the page via PHP, like every other WP attack).

sucuri23• 16 years ago

I agree. I wish I knew how they were getting in. All the sites we got access so far had no logging enabled.

nuclear_eclipse• 16 years ago

Surreptitiously browse sites using a standard user-agent string/IP, and just see if something different shows up?

shadowsun72• 16 years ago

Question: is there any way to make Wordpress more secure? Otherwise, why're most people here recommending a move away from Wordpress?

(Not saying they're wrong, just ... curious.)

steveklabnik• 16 years ago

The problem stems from a history of flaws in Wordpress' code, not its administration.

ericz• 16 years ago

I wonder if Wordpress is especially poor security-wise or simply it's popularity attacts too much bad attention.

jerf4• 16 years ago

I wanted to snark "yes", but truthfully, the problem is that Wordpress' security has been average, not especially bad. The problem is that average is terrible. Most average products don't get hit with this level of scrutiny, but certainly the sort of errors that Wordpress makes with frightening regularity are made by numerous other commercial and open source projects as well.

tptacek10• 16 years ago

There are unforced errors in Wordpress. Every web application will have a cross-site scripting mistake. It takes a special one to have "anonymous commenter" -> "admin" privilege escalation, or executable style templates.

hkuo2• 16 years ago

I've been using Movable Type for years, the differentiating factor being that it generates html pages. No worries about database load. No worries about database hacking, the only access to the data or files being through the admin login. The additional ability to customize the code at any depth is a plus too.

sandGorgon• 16 years ago

Hey guys - this is a serious question : what is the alternative.

Is there anything that provides 80% of the features of Wordpress at significantly higher security ? What about Textpattern ( php), Movable Type (perl+php), Expression Engine (php), Mephisto (ror), Type (ror)... what ?

aaronbrethorst• 16 years ago

Static HTML files driven off a system like Jekyll or Webby, coupled with comments from Disqus would be significantly more secure. It's also much less convenient.

mccutchen• 16 years ago

Or run a local WordPress installation and use `wget` to generate a static HTML mirror suitable for uploading to your server: http://www.idlewords.com/2009/09/using_wordpress_to_generate...

neurotech1• 16 years ago

One thing that was mentioned in the linked page is Fantastico, the auto-installer for cPanel. I checked and currently they are including WP 2.9.2(latest) but there is sometimes a delay updating Fantastico. On top of that, the hosting clients may not know how to update their WP install anyway.

nym• 16 years ago

How can one identify if they've been compromised?

Is there any kind of fix?

pronoiac2• 16 years ago

Working from http://www.wpsecuritylock.com/breaking-news-wordpress-hacked... If your page has references to base64_decode, zettapetta, or indesignstudioinfo in the source, I'd be worried. For a fix, see http://blog.sucuri.net/2010/05/simple-cleanup-solution-for-l...

bcl• 16 years ago

I have seen no evidence that recent problems are anything other than shared hosting sites getting cracked. Note to admins -- running your system with all the virtual host files owned by apache is asking for trouble. Use something like the itk patch for Apache (http://mpm-itk.sesse.net/) where each virtual owns its files and uses normal permission restrictions to control access to the rest of the system.

Although this won't help those of you who are bone-headed enough to chmod 0777 all of your files...

whimsy• 16 years ago

More alternatives:

Bloxsom (perl): http://www.blosxom.com/

Jekyll (rb): http://jekyllrb.com/

Hyde (py): http://ringce.com/hyde

mattwdelong mentioned blogdor (django): http://github.com/sunlightlabs/django-blogdor

bravura suggested blogophile (py): http://www.blogofile.com/

bravura2• 16 years ago

Not to mention pybloxsom

mgrouchy• 16 years ago

I use hyde, its pretty nice(unlike my blog).

sucuri23• 16 years ago

Hey,

For anyone having problem cleaning it up, we have a simple script to do it for you: http://blog.sucuri.net/2010/05/simple-cleanup-solution-for-l...

lkrubner• 16 years ago

WordPress is easy to learn. Technologies that are easy to learn tend to attract a lot of people. Once the people learn enough that they are no longer beginners, then they want more features, more abilities. Rewind the clock to 1999 and you could say the same thing about PHP. It did well because it was easy for beginners to learn.

I think a lot of the people who read Hacker News are people with considerable experience in the tech world. As such, it is easy for them to underestimate the importance of having some technologies that are easy for beginners to learn. It is easy to make fun of a beginner. But everyone starts off as a beginner. More so, technologies that are easy to learn tend to have a resilience that complicated technologies lack. There will always be some version of BASIC out there, even as other, better languages are forgotten.

I do most of my development with Symfony. As such, there is a part of me that thinks application frameworks (Symfony, Ruby On Rails, Django) should be used for all projects. But the application frameworks are only for experienced programmers. I would have felt overwhelmed if my first exposure to computer programming had been Symfony, or Ruby on Rails, or Django.

WordPress does a fantastic job enabling relative beginners to achieve a lot. It deserves praise for that. It offers people a smooth path to move deeper into programming, should they wish to move that way. I've had friends who first learned PHP dealing with WordPress, and later became good PHP programmers overall, and more recently I see them learning other technologies. In another era they might have learned with Visual Basic or Hypercard or Applescript or any of the previous attempts to build systems that enabled beginners to program. But for the last few years, WordPress has occupied that niche in the world of programming.

More so, WordPress is a great platform for web designers to work from. For the intelligent designer who does not want to become a programmer, WordPress lets them do a lot of customization, without knowing much of the technical details of what they are doing.

It is easy to curse WordPress for its security flaws. For that reason, it is important to remember how good it is at the things it gets right.

I agree with elidourado: this is an opportunity for entrepreneurs. The popularity of WordPress, and its occasional problems, provides a good market for services that help designers and other programmers achieve what they wish. Darren Hoyt and I started one such service, a paid question and answer site focused on WordPress:

http://www.wpquestions.com/

It is also worth noting that WordPress is one of the larger categories on eLance:

http://www.elance.com/skills_directory

It is appropriate to complain about the security flaws in WordPress, but entrepreneurs will also think hard about what kind of services can help all the people who need help with it.

New attacks today against Wordpress (lots of sites hacked)

Related Stories