Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have got a blog running Wordpress. The last time I visited my blog I realized it was hacked. The website redirects to a phishing page of paypal meanwhile other links a opening fine. I want to know how that attack was made, how to fix this problem and what security measures I must adopt so that it should not happen in future.

share|improve this question
    
startover, update wordpress and all of its plugins. If you can't fix the problem, hire a professional. –  Rook Nov 15 '12 at 1:13
    
Please do not post links to websites while they are in a compromised state. –  Iszi Nov 15 '12 at 1:51
    
I'd be interested in how it got hacked. I see a lot of (apparently) WordPress vulnerability scanning in my access_log file, but I can't lure anyone into sending me their payloads, no matter what weak plugin I try to emulate. Actually, I think that a good proportion of the scanning for WordPress vulnerabilities just won't work - the skiddies involved got duped into running bad code. –  Bruce Ediger Nov 15 '12 at 2:00
1  
You shouldn't host your own Wordpress site unless you're prepared to spend the time necessary to administer your installation (e.g., applying security updates for the OS, applying security updates for Wordpress, and correctly securing the OS). Wordpress offers hosting for exactly this reason. –  Stephen Touset Nov 15 '12 at 4:19
add comment

1 Answer

I will try to explain how such and similar hacks happens. They are really prevalent and at some point of time I was puzzled with something like this: who can possibly reply to an email that claim that some nigerian king wants to share his 5mln$ and needs your help, and in such a case why spammers are sending these spam.

First of all one have to understand that this attack was not tracking particular user or particular site. Most probably the person who decided to do the attack had no clue about the site beforehand.

He googles something like this: vulnerability in wordpress, and gets tons of results. For example this is the list of vulnerabilities, but this is too much text and I do not have time too read it. So let's see something easier. Ok, this sounds like a deal and the threat looks amazing:

The utility only does a partial match on hostnames allowing hackers to upload and execute arbitrary PHP code in your timthumb cache directory

http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/

It has even some ideas how to exploit it, but lets just look at the google query: how to exploit timthumb.php . The link with a title technical details sounds like it can give you a technical detail (actually it is not, but I will stop writing here so that it will not look like I am telling how to break something).

The ability for a site visitor to load content from a remote website and to make the web server write that remote content to a web accessible directory is the cause of the vulnerability in timthumb.php

amazingly convenient.

So the person is testing vulnerability on his machine and after it gives him a possibility to upload an arbitrary file on your machine it will upload something bad. And than run it. Ok he has done it on his machine, but how he found this guy?

Answer is simple: attacker was not looking for it, he was just looking for every site that used timthumb.php. After getting them he tries every site and chances are big that one of 10 sites would have this exploit.

I am not claiming that the writer's site was hacked in such a way but most probably in similar way.

I have written this with one thing in mind - give the idea how is it done, not to tell how you can do it (in this case it is written really badly)

Another reason for writing it is to tell what can you do - update your core as often as possible. Check for bugs and exploits.

The good thing is this sort of attacks is done by people who has no idea how to do create it. Nevertheless I am a programmer, but I have never even used wordpress and it took me less then an hour to write the post and search for exploit.

So most of the people like I have just describe are like monkeys - they have no idea what are they doing (they just copypaste something). They see something on site, they want to look like hackers and they are really proud if they will be able to do. And if they will not succeed with simple instructions - they will just move to next possible victim.

Sorry if my answer looks unstructured and stupid. If you think you can improve it - I would be glad

EDIT: Please patch your website ASAP. If you feel the desire to show the community what the page exactly is; save the html file as a txt file. This way it doesn't execute anything on more computers. Your blog has been marked as a phishing website, firefox prompts and suggests "getting out of here".

share|improve this answer
    
Dear Mr Dali: I love your painting "Geopoliticus Child Watches the Birth of the New Man". –  Bruce Ediger Nov 15 '12 at 4:21
    
@BruceEdiger glad to here that there are still people who appreciate my creation –  Salvador Dali Nov 15 '12 at 11:31
    
Why so skittish about details? Clearly, someone has figured these things out, and clearly they get used in the wild. Why bother concealing the details, if they make your explanation less clear, and more confusing? –  Bruce Ediger Nov 15 '12 at 17:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.