The Tech Herald

Outdated WordPress installations hijacked by crime kits

by Steve Ragan - Jan 31 2012, 16:30

Outdated WordPress installations hijacked by crime kits. (IMG: J. Anderson)

Hundreds of websites developed with the WordPress platform were hijacked recently, and used to compromise systems leveraging a recently patched Java vulnerability. In each case, the compromised domain was using an outdated version of WordPress.

WordPress has been downloaded more than 60 million times since the 3.0 release in 2010. Since that time, there have been several fixes and patches to the blogging platform, including version 3.3.1, which was released on January 3. Over the weekend, Websense Security and M86 Labs discovered hundreds of domains running an outdated release of WordPress that were hosting malicious content. The hijackings were possible due to the exploitation of recently patched vulnerabilities.

It’s unknown if the compromised domains serving exploits taken from a recently updated Phoenix Exploit Kit, or something entirely new. Neither one of the security firms could agree on the kit itself, with M86 tagging it as Phoenix and Websense reporting that the exploits were part of the Incognito Kit.

What is known is that the hijacked domains were serving an individual page that was unrelated to the rest of the site’s content.

“In fact, accessing any page on these compromised WordPress sites, other than the uploaded page, will not infect the user’s machine. The general motivation of attackers to compromise websites is mainly to bypass URL reputation mechanisms, spam filters and certain security policies,” commented Daniel Chechik of M86.

That the page was using embedded code to target the Java Rhino vulnerability and of the PDF Libtiff vulnerability, each one recently patched by Oracle and Adobe respectively.

Each of the hijacked domains were using WordPress version 3.2.1, which was initially released in July 2011. Since that time, dozens of plugins for WordPress have been singled out as being vulnerable to a range of issues including Cross Site Scripting, SQL Injection, Remote Code Execution, and Remote File Inclusion. This includes the Tim Thumb plugin, which led to scores of compromises last summer.

WordPress can be updated from within the administration dashboard. Moreover, this area will allow plugins to be updated, as well as themes. Users are strongly encouraged to update their installations as soon as possible.

Comment on this Story

comments powered by Disqus

From Autosaur.com

Average Guys With Average Cars. #average

Great new video from up-and-coming clothing brand the Average Squad. The short was posted by...

This Man Was Too Poor To Buy A Car. How He Treats Them Now Is So Touching

This is one of the most touching videos about cars in a long time. It tells the story of a m...

Lucky Escape from Out of Control Truck

This man had a lucky escape on a New Jersey Turnpike when he had to stop on the road du...

Concept Car Videos from Detroit Auto Show

As at every big car show manufacturers at the Detroit Auto Show 2015 were keen to give us th...

Concept Car Pictures from Detroit Auto Show

Well we still had a few pics from the in Detroit Auto Show to put up. These are some of...