Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Yesterday my WordPress website got hacked. I thought I had done all necessary things to make it secure. One of my colleagues said that with Greasemonkey we can easily hack sites. Is it true? How can I protect my site secure against it?

share|improve this question
add comment

3 Answers

GreaseMonkey (or Tampermonkey for Chrome) is a browser addon that allows you to inject custom JavaScript code in the browser on the client side. You have little to no control over it.

The good news is that none of these changes will affect the contents on the server side, or the contents for other users. So if you rely on the server for your validation/verification/signing in/e.t.c., then you have nothing to worry about. If, however, you rely on the client-side code to provide input validation and other kinds of restrictions, then you have deeper problems than GreaseMonkey. Almost all modern browsers contain features to allow the modification of client-side contents, they're mostly called Developer Tools.

My advice to you is to get a competent individual to assess the security situation of your website, and to help you protect it from future attacks.

share|improve this answer
add comment

Reading your question and the related description, I can only say that I disagree with your colleagues "Greasemonkey" theory. Greasemonkey only allows client-side javascripts to be run (to modify the client-side behavior of websites or to automate some things). Yet, client-side javascript can't corrupt your server-side directly. The only thing I could think of what Greasemonkey could be usefull for, is brute-forcing login forms. That's about it.

Potential Attack Vectors

  1. What most probably is the origin of your "was hacked" problem, is the use of insecure passwords and - what can be even worse - the use of the login-name "admin", because that leaves only one guess open for a hacker... the password. If the hacker needs to guess both the name AND the password, he'll lose time and resources and most probably also interest in trying to hack your site.

    Therefore a tip you should embrace: good login-names and login-passwords are at least 8 characters long, and should include a combination of letters, numbers, and punctuation characters (like dots, brackets, dashes, etc.).

    In case you missed the news: most recently there was a wide-spread brute-force attack on wordpress-based websites which targetted the wp_login.php file (your login form). Many sites got hacked that way and I can imagine your webiste was one of them (although I can not be sure without taking a look at the server access logs).

    The issue was so wide-spread that it even got a dedicated page at the wordpress website ([http://codex.wordpress.org/Brute_Force_Attacks][1]) where they posted some potential fixes to the problem. You might want to check that page for further information.

  2. If it wasn't your login form, check your wordpress plugins.

    It wouldn't be the first time that a wordpress plugin introduces a major security hole that enables even the dumbest script-kid to compromise your wordpress install. Just remember (or search for) that "timthumb" security disaster that made the wordpress community run in circles a good while ago. Yet, I personally suspect that you've become a victim of the recent brute-force attack mentioned in #1.

Last but not least, let me echo the advice given by @Adnan:

My advice to you is to get a competent individual to assess the security situation of your website, and to help you protect it from future attacks.

If you don't know "what" happened, you can't prevent it from happening again. In case you don't know everything about securing a website and server, time has now come to hire a professional...

share|improve this answer
add comment

There's a few things to consider. With Greasemonkey (GM), users (client-side) need to accept the installation of a GM script or write a GM script themselves. Since, the client user has full access to any page the server can download (with that user's authorizations and authentication), the GM script can modify this content or use the content in combination with other pages from the same server or other unrelated servers to present the web page data in any way desired. An example would be a real estate site (RES) that has sale homes' details and pictures on different pages. The RES pages can be acquired with a GM script and put together as one page. Furthermore, the square footage (or square meters) or tax information can be pulled from the Assessor's website and mashed together as one page with the RES info. Alone, this is not sinister. However, if you've blocked right click or have block protected content on your page, a clever script writer may be able to bypass the protections (as is possible by simply adjusting the elements in the HTML via developer tools).

Here's where there can be some more issues. A lot of websites do not protect their assets and APIs very well. By leaving permissions open to more assets, the script writer may be able to reverse engineer the page's scripts and pull more assets. With the APIs, this is another story. By not restricting APIs on the site, a GM script can make extra requests to the APIs. For example, say the username was part of an API. The script could change the hard-coded username and put another username in the script that would pull the info of someone else. Maybe the site sells some sort of service for searching and the user can only do a search by geographical locations or interests but not both. If the API is not properly locked down, this search can be extended to both with a GM script.

As for brute force attacks, one browser alone is probably not a great army. If the desire is to make attacks or even hit the site many times to try passwords, there are many other tools that are suitable for attacking.

So is Greasemonkey a cracker's tool? Yes, but it only allows the client to see what is already there due to bad website security. If there is a GM script installed without a current user's knowledge, the script can spy on current user's actions by trapping passwords or other information from pages that are familiar to the script.

Again, the advice given by @Adnan:

My advice to you is to get a competent individual to assess the security situation of your website, and to help you protect it from future attacks.

share|improve this answer
2  
It's important to note that none of these threats (for the scenarios you've presented that even qualify as threats in the first place) are specific to GreaseMonkey. –  Xander Jan 22 at 21:35
    
Duly noted. Except ... Greasemonkey can be used to expose poorly designed APIs to get at protected data ... a server weakness. GM script are available to bypass blocks on content saving. If these scenarios do not qualify, perhaps the definition of security is tighter than I think. I refer to the original question, can GM be used to hack sites? The answer is still yes. There are lots of tools that are better for other sorts of attacks, but at least GM provides some nice help with thinks like cookies and avoiding cross site scripting. Comments were informational not for debate or discredit. –  Stephan Warren Jan 24 at 0:20
    
Per the book XSS Attacks: Cross Site Scripting and Attacks - x3n0n.com/wp-content/uploads/2014/02/… it's stated: GreaseMonkey is so powerful that you can write exploits as user scripts and call them when needed. Let’s have a look on the following example, which detects Wordpress 2.0.6 blogs and asks you to run the wp-trackback.php SQL Injection exploit against them ... In previous sections of this book we discussed how to use GreaseMonkey as an attack tool. –  Stephan Warren Mar 6 at 6:18
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.