Hacker Gains Access To WordPress.com Servers

http://techcrunch.com/2011/04/13/hacker-gains-access-to-wordpress-com-servers/

by gsharma • 15 years ago

90 42 15 years ago

dirtyaura• 15 years ago

TechCrunch indicates that hacker got access to source code of WordPress.com VIP sites and "only" Twitter and FB API keys are leaked.

Does anybody know how WordPress.com saves MySQL passwords? Does it differ from Wordpress installations? Vanilla Wordpress installations have them among the rest of the code and thus those might have leaked too.

nbpoole3• 15 years ago

The word "only" isn't appearing in the article right now. API keys are used as an example of what's contained in the code.

I wouldn't worry about MySQL passwords though: Automattic controls their database servers, so they can generate new credentials very easily.

skeltoac3• 15 years ago

Database access control is layers deep. Even if you had the MySQL passwords, you wouldn't be able to connect to the database servers.

bradleyland• 15 years ago

I'm not sure I follow. If you have root access on a machine that runs PHP web apps that connect to a MySQL server, you have, at a minimum, access to the databases those web apps relied upon. The web app MySQL credentials have to be supplied somewhere in the code.

nikcub3• 15 years ago

> Automattic had a low-level (root) break-in to several of our servers

how is root access 'low-level' ?

nbpoole3• 15 years ago

Low-level as in http://en.wikipedia.org/wiki/High-_and_low-level, not as in "very little access" (which I'm assuming is the impression you're getting: correct me if I'm mistaken)

nikcub3• 15 years ago

I see that meaning but the way it was written you would think the context was access

skeltoac3• 15 years ago

"Low" as in far down the stack; deep; not near the surface.

jjm2• 15 years ago

The concept is synonymous with how close you can get to 'system' where there is no additional abstraction.

A dinky example say is for instance you may need a password for X, but if you have access to disable the need for the password in X, you have lower level access. In the case at hand, with root level access you can read all the keys, passwords, settings in all the WP config files, otherwise you wouldn't be able to. You could also quietly add an additional password to the database allowing a bad application to run behind the scenes doing bad things with the data.

This makes for a very good simple CS test question.

_b8r07• 15 years ago

Well this is great. I'm doing a talk tomorrow at OWASP London[1] on Wordpress Security. Interestingly while sorting out google dorks for the presentation I found 27,000 references to PHP Shell backdoors. If you're going, I look forward to seeing you there. Please don't laugh at me every time I mention wordpress and security in the same sentence.

[1] https://www.owasp.org/index.php/London#Next_Meeting.2FEvent

wewyor3• 15 years ago

Is your talk going to be recorded?

If so I would very much like to see it.

_b8r07• 15 years ago

As far as I know (hope?) it isn't. I can put the slides up afterwards though if that helps.

jtchang• 15 years ago

These days it isn't just about making sure you have good passwords and a decent firewall.

If you run a site that has valuable information you will end up being a target. That's just a fact. How you respond to these types of security incidents is what will set you apart from the pack. Sadly most breaches are covered up. They are bad for PR and most people don't understand them.

Always make sure you have a plan in place. Even if it is just shutting down a list of servers incident response can go a long way.

cookiecaper• 15 years ago

Really sparse on the details. Were the servers accessed due to a vulnerability in WordPress, other PHP or world-accessible code, a server misconfiguration, an "inside job", or what? I think it's important to have a bit more information about the nature of the attack, so that we know if independent WordPress installations are vulnerable and if/when we should reset keys and passwords.

dustingetz2• 15 years ago

http://www.dustingetz.com/password-security-the-free--easy-w...

Joakal3• 15 years ago

This has a vulnerability of single point of failure as well as home attack (someone nicks computer/paper).

dustingetz2• 15 years ago

sure beats what i was doing before!

jacques_chester3• 15 years ago

As an off-topic request, I prefer links to the original source, not to intermediate sources. Yesterday TechCrunch got love for an announcement made on Google Blog; today for an announcement made at Wordpress. In neither case did they add any value.

abraham• 15 years ago

The original article was already submitted before this one was. It didn't get as many votes though.

http://news.ycombinator.com/item?id=2443165

jacques_chester3• 15 years ago

Upvoted; but perhaps "Security Incident" was a slightly too generic title.

odiroot2• 15 years ago

Considering few recent cases of this kind, what's the best way to store passwords/keys/other credentials? Can I avoid leaking sensitive information even if an attacker gains root access to my app machine?

Joakal3• 15 years ago

For passwords, my method is individually salted and one way hash will eliminate most attempts, pretty much leaving brute forcing the most efficient way. However, it's known that people use common passwords like 'password1'. For more paranoid security, read documentation, discussions and even black discussions regarding the technology you use if you really want to lock down everything. Eventually it'll be a performance/usability vs security compromise in some cases.

I suggest a failure plan to prepare for security failures including several PR messages depending on severity of failure even if you do not know if you're compromised.

It's highly unlikely that you will be able to avoid potential leaks.

odiroot2• 15 years ago

Hashed password are pretty obvious, but what if your app needs to talk with something that needs original password (database, external system of some sort)?

I guess, as always, there is no silver bullet.

udoprog• 15 years ago

Cracker, not hacker!

I can understand techcrunch getting it wrong, but we on HN should at least set the record straight.

Hacker Gains Access To WordPress.com Servers

Related Stories