The Tech Herald

Outdated WordPress installations hijacked by crime kits

by Steve Ragan - Jan 31 2012, 16:30

Outdated WordPress installations hijacked by crime kits. (IMG: J. Anderson)

Hundreds of websites developed with the WordPress platform were hijacked recently, and used to compromise systems leveraging a recently patched Java vulnerability. In each case, the compromised domain was using an outdated version of WordPress.

WordPress has been downloaded more than 60 million times since the 3.0 release in 2010. Since that time, there have been several fixes and patches to the blogging platform, including version 3.3.1, which was released on January 3. Over the weekend, Websense Security and M86 Labs discovered hundreds of domains running an outdated release of WordPress that were hosting malicious content. The hijackings were possible due to the exploitation of recently patched vulnerabilities.

It’s unknown if the compromised domains serving exploits taken from a recently updated Phoenix Exploit Kit, or something entirely new. Neither one of the security firms could agree on the kit itself, with M86 tagging it as Phoenix and Websense reporting that the exploits were part of the Incognito Kit.

What is known is that the hijacked domains were serving an individual page that was unrelated to the rest of the site’s content.

“In fact, accessing any page on these compromised WordPress sites, other than the uploaded page, will not infect the user’s machine. The general motivation of attackers to compromise websites is mainly to bypass URL reputation mechanisms, spam filters and certain security policies,” commented Daniel Chechik of M86.

That the page was using embedded code to target the Java Rhino vulnerability and of the PDF Libtiff vulnerability, each one recently patched by Oracle and Adobe respectively.

Each of the hijacked domains were using WordPress version 3.2.1, which was initially released in July 2011. Since that time, dozens of plugins for WordPress have been singled out as being vulnerable to a range of issues including Cross Site Scripting, SQL Injection, Remote Code Execution, and Remote File Inclusion. This includes the Tim Thumb plugin, which led to scores of compromises last summer.

WordPress can be updated from within the administration dashboard. Moreover, this area will allow plugins to be updated, as well as themes. Users are strongly encouraged to update their installations as soon as possible.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

Chevrolet shows off the 2015 Colorado with digital experience

Chevrolet has launched a new website to show buyers all the bells and whistles available on ...

Mazda to debut CX-3 and MX-5 at Los Angeles Auto Show

Mazda has announced plans to premiere the new Mazda CX 3, its new compact crossover SUV, at ...

Ford issues safety recall for 204,448 Ford Edge and Lincoln MKX

Ford has issued a safety recall for 204,448 of the 2007-2008 Ford Edge and Lincoln MKX in No...

Mopar Previews SEMA Custom Rides

We have added a set of pictures released by Mopar ahead of the SEMA Show. Mopar are bri...

Audi R8 Competition – The Most Powerful Production Audi Ever

Audi has revealed details of their new super-fast Audi R8 Competititon — the most powerful a...