INFRA
INFRA
INFRA
Almost 2M WordPress sites defaced thanks to security vulnerability
A serious content-injection vulnerability in the popular WordPress content management system, first discovered at the end of January, has been used to deface more than 1.9 million sites.
Seattle-based security firm WordFence Inc., which described it as “one of the worst WordPress related vulnerabilities to emerge in some time,” said in a blog post that the vulnerability had been used by hackers to post political messages in support of the Kurdish Peshmerga group fighting against both the Islamic State and the Turkish army in Northern Syria.
The hack uses a so-called unauthenticated privilege escalation vulnerability in a REST API endpoint that was introduced into WordPress versions 4.7 and 4.7.1. The new versions were intended to provide easier access to posts, comments, terms and other settings. Instead, the vulnerability resulted in a kind of “feeding frenzy where attackers are competing with each other to deface vulnerable WordPress websites,” said the company, which noted that so far it had tracked more than 20 different defacement campaigns.
WordPress.org, the company behind the open-source code, pushed a new patched version of the content management system on Jan. 26, but revealed the vulnerability Feb. 1 in an effort to encourage users to update their WordPress installs.
“We believe transparency is in the public’s best interest,” said Aaron D. Campbell, a contributor to WordPress who works at GoDaddy. “It is our stance that security issues should always be disclosed. In this case, we intentionally delayed disclosing this issue by one week to ensure the safety of millions of additional WordPress sites.”
Security firm Securi warned separately that some hacker groups had since moved on from defacement and were now attempting to use the bug to hijack sites for their own ends. “Attackers are starting to think of ways to monetise this vulnerability,” Sucuri founder Daniel Cid explained in a blog post. “Defacements don’t offer economic returns, so that will likely die soon.”
Users are encouraged to immediately update all their WordPress installations if they have not done so already.
(Editors Note: An earlier version of the article said “Automattic Inc., the company behind WordPress, pushed a new patched version of the content management system.” The note was actually from WordPress.org.)
Image: Wordfence/unknown creator
Since you’re here …
… We’d like to tell you about our mission and how you can help us fulfill it. SiliconANGLE Media Inc.’s business model is based on the intrinsic value of the content, not advertising. Unlike many online publications, we don’t have a paywall or run banner advertising, because we want to keep our journalism open, without influence or the need to chase traffic.The journalism, reporting and commentary on SiliconANGLE — along with live, unscripted video from our Silicon Valley studio and globe-trotting video teams at theCUBE — take a lot of hard work, time and money. Keeping the quality high requires the support of sponsors who are aligned with our vision of ad-free journalism content.
If you like the reporting, video interviews and other ad-free content here, please take a moment to check out a sample of the video content supported by our sponsors, tweet your support, and keep coming back to SiliconANGLE.
