Forgot your password?
typodupeerror
Security News

30K WordPress Blogs Infected With the Latest Malware Scam 104

Posted by Unknown Lamer
from the check-your-versions dept.
alphadogg writes with an excerpt from an article over at Network World: "Almost 30,000 WordPress blogs have been infected in a new wave of attacks orchestrated by a cybercriminal gang whose primary goal is to distribute rogue antivirus software, researchers from security firm Websense say. The attacks have resulted in over 200,000 infected pages that redirect users to websites displaying fake antivirus scans. The latest compromises are part of a rogue antivirus distribution campaign that has been going on for months, the Websense researchers said."
This discussion has been archived. No new comments can be posted.

30K WordPress Blogs Infected With the Latest Malware Scam

Comments Filter:
  • Re:McAfee? (Score:4, Informative)

    by tepples (727027) <tepples AT gmail DOT com> on Wednesday March 07, 2012 @12:02PM (#39275389) Homepage Journal
    It might be hard to believe, but there are antivirus companies even less scrupulous than McAfee and Norton. Wikipedia explains [wikipedia.org].
  • Re:Analysis (Score:5, Informative)

    by WankersRevenge (452399) on Wednesday March 07, 2012 @12:21PM (#39275625)

    From the fine article:

    Many of the blogs compromised in these recent attacks were running outdated WordPress versions, had vulnerable plug-ins installed or had weak administrative passwords susceptible to brute force attacks, said David Dede, a security researcher with website integrity monitoring firm Sucuri Security. "It seems the attackers are trying everything lately."

  • Re:wordpress, again? (Score:4, Informative)

    by nick.sideras (836787) on Wednesday March 07, 2012 @12:41PM (#39275879)

    Some of that is Wordpress' fault for not having an easy way to run mass upgrades. My employer has 15 different sites running on Wordpress and the fact that I have to log in to each one manually after upgrading the files and click a link to handle the database update is annoying.

    This drove me nuts at my current job for about 2 months - you need Wordpress Network [wordpress.org].

    There's the easy way and the hard(er) way to do this:

    This [wordpress.org] is the official easy way, but it's never worked for me (last tried in Spring of 2011). The nice thing is that it's all stuff built into WordPress, so you should be able to do it without any problems. I'd say it's probably worth giving this a try with one site, and if it works, run with it.

    This [bavatuesdays.com] is more down and dirty way that will definitely work, and is more or less how I did it. A little SQL editing never hurt anyone.
    Also, this [sillybean.net] is a great companion to the bavatuesdays link. He goes on about his DNS in the first few paragraphs, but the second half of that post has some good details about where files need to be, and how links and such need to be updated.

    Once you have a network, you a fantastic "Update Network [wordpress.org]" button. Boom. Take the rest of the day off.

  • by X0563511 (793323) on Wednesday March 07, 2012 @01:05PM (#39276213) Homepage Journal

    Are you an idiot? The article is talking about WORDPRESS - a web application! Windows isn't involved!

  • Re:Analysis (Score:5, Informative)

    by drobety (2429764) on Wednesday March 07, 2012 @01:09PM (#39276273)
    For what it's worth, looking at the recent 404 errors on my site, I've notice many (failed fortunately) requests related to Ajax File And Image Manager 1.0 Final Code Execution [packetstormsecurity.org]
  • by dgrotto (2588895) on Wednesday March 07, 2012 @01:45PM (#39276675)

    Most of my WP installs were infected because I am a slack ass. Here are the high level steps I took to solve the problem:

    • 1) Backup sites.
    • 2) Fix all world-writable directories in your WP install (what the hell WP?!). This seems to be the primary vector for getting in.
    • 3) Clean up infected PHP files with this script from php-beginners.com [php-beginners.com]. Thank you Paolo.
    • 4) Inspect all .htaccess configs for errant redirects and fix.
    • 5) Install and run the timthumb vulnerability scanner [wordpress.org]. Possible secondary vector. Thank you Peter Butler!
    • 6) Update your WP install to latest and greatest.
    • 7) Remove any unused plugins and themes.
    • 8) Backup sites.

    I may be missing something - again, I'm a slackass. Anyone else have other advice for our admin-challenged friends besides "get a real software package"?

    By the way, I was trying to lock down one of my WP installs to only allow authed users access to posts. However, WP does not put the assets for post - usually in wp-content/uploads - behind the auth wall. It's just out there for the whole world to see. It was a simple fix to rewrite the .htaccess config for this directory to redirect to an auth script, but still it still shocks me how insecure this app is.

  • by ThatsNotPudding (1045640) on Wednesday March 07, 2012 @02:27PM (#39277193)
    BTW: why is Adobe allowed to - by default - check the box on their flash updates to also install Norton on the victims computer? How many trusting civilians (think: grandmothers) end up with borked computers with conflicting AV programs solely due to corporate greed? I'm willing to bet this check box (if it even appears) is NOT checked by default in the EU market. Man, I miss government FOR the people...

From Sharp minds come... pointed heads. -- Bryan Sparrowhawk

Working...