The Tech Herald

Outdated WordPress installations hijacked by crime kits

by Steve Ragan - Jan 31 2012, 16:30

Outdated WordPress installations hijacked by crime kits. (IMG: J. Anderson)

Hundreds of websites developed with the WordPress platform were hijacked recently, and used to compromise systems leveraging a recently patched Java vulnerability. In each case, the compromised domain was using an outdated version of WordPress.

WordPress has been downloaded more than 60 million times since the 3.0 release in 2010. Since that time, there have been several fixes and patches to the blogging platform, including version 3.3.1, which was released on January 3. Over the weekend, Websense Security and M86 Labs discovered hundreds of domains running an outdated release of WordPress that were hosting malicious content. The hijackings were possible due to the exploitation of recently patched vulnerabilities.

It’s unknown if the compromised domains serving exploits taken from a recently updated Phoenix Exploit Kit, or something entirely new. Neither one of the security firms could agree on the kit itself, with M86 tagging it as Phoenix and Websense reporting that the exploits were part of the Incognito Kit.

What is known is that the hijacked domains were serving an individual page that was unrelated to the rest of the site’s content.

“In fact, accessing any page on these compromised WordPress sites, other than the uploaded page, will not infect the user’s machine. The general motivation of attackers to compromise websites is mainly to bypass URL reputation mechanisms, spam filters and certain security policies,” commented Daniel Chechik of M86.

That the page was using embedded code to target the Java Rhino vulnerability and of the PDF Libtiff vulnerability, each one recently patched by Oracle and Adobe respectively.

Each of the hijacked domains were using WordPress version 3.2.1, which was initially released in July 2011. Since that time, dozens of plugins for WordPress have been singled out as being vulnerable to a range of issues including Cross Site Scripting, SQL Injection, Remote Code Execution, and Remote File Inclusion. This includes the Tim Thumb plugin, which led to scores of compromises last summer.

WordPress can be updated from within the administration dashboard. Moreover, this area will allow plugins to be updated, as well as themes. Users are strongly encouraged to update their installations as soon as possible.

Around the Web

Comment on this Story

comments powered by Disqus

From Autosaur.com

New Mercedes-Benz S63 AMG 4MATIC Coupe (Pictures)

Mercedes have revealed details and pictures of their new S63 AMG 4MATIC Coupe — and it’s a b...

Shelby GT350 Mustang Pictures

We have added a bunch of pictures of the all-new Shelby GT350 Mustang from Ford. The ne...

All-new Shelby GT350 Mustang

Ford have revealed details of the new Shelby GT350 Mustang. First introduced in 1965 the new...

Best Cars To Buy In 2015

Leading vehicle research company Kelley Blue Book has released its list of the best cars to ...

A.C. Milan Take On Audi R8

Five A.C. Milan stars take on an Audi R8 in a game of street soccer in a new ad for Toyo Tir...