0

I've deployed a few dozen Wordpress sites over the last 10 years across a variety of hosts. I have a single client on a particular host I've never used before whose Wordpress site has been hacked twice in the last year. The cause of the first breach is unclear due to lack of evidence (suspect lateral movement from another tenant) but it appears the attacker this time is external and taking advantage of code injection via the user agent string (yes, on Wordpress).

GET /about-us/ HTTP/1.1" 200 23527 "-" "}__test|O:21:\"JDatabaseDriverMysqli\":3:{s:2:\"fc\";O:17:\"JSimplepieFactory\":0:{}s:21:\"\0\0\0disconnectHandlers\";a:1:{i:0;a:2:{i:0;O:9:\"SimplePie\":5:{s:8:\"sanitize\";O:20:\"JDatabaseDriverMysql\":0:{}s:8:\"feed_url\";s:3738:\"eval(base64_decode('JGNoZWNrID0g...

After the first incident, I pared everything down to stock WP+akismet+cloudflare with a custom theme to eliminate most app-side variables. No other plugins; all stock themes deleted.

Obviously this is a Wordpress/possible theme bug that needs to be addressed but beyond code review and slapping Cloudflare on it to try to weed out bad agents, should I expect the host to be more proactive in filtering out known vulnerabilities at the network level or is that solely the tenant's problem?

Or does this vary by host? Based on their business model I really, really, don't get good vibes from this one at all.

Assume abandoning shared hosting is not an option.

  • best security practice is not to use wordpress or drupal if security is important; too many levers to pull and not enough responsibility being taken for updates. – dandavis Nov 11 '16 at 21:44
  • Yeah, but their use case called for a WYSIWYG CMS and I wasn't about to write my own. – Ivan Nov 14 '16 at 16:47
1

On most shared hosting:

  • it's the responsibility of the host to configure their machine so that one tenant can't interfere with another tenant
  • it's the responsibility of the host to update any shared infrastructure, like the OS, routers, etc. If the shared hosting have shared web server or database, it's also the host's responsibility to keep them up to date.
  • it's the responsibility of the tenant to keep their web applications (e.g. Wordpress) up to date.
  • it's generally the responsibility of the tenant to implement WAF rules when necessary
  • it's usually the tenant's responsibility to set their file permissions correctly, for instance if you set your PHP files chmod 777 or if you write sensitive data to shared directory like /tmp, then you're just asking for a lateral attack. Some better configured host configure each tenant to have their own /tmp, but you shouldn't rely on this being the default.
0

In your post, you asked:

Should I expect the host to be more proactive in filtering out known vulnerabilities at the network level or is that solely the tenant's problem?

The answer:

The host is required, by law, to meet standards of security, especially when personal information is involved. For more information, visit this website. However, this does not mean you can rely on hosts to fix security vulnerabilities. You, as a tenant, are partially responsible for ensuring visitors are safe in your site from security issues.

0

It appears that while there is no standard for who is responsible for security, it seems that I have lucked out in choosing hosts to date who exhibit some amount of concern for their own infrastructure by proactively maintaining things like basic mod_security rules.

In this case, I have since learned that this web host does not offer anything of the sort. No WAF, no mod_security, nothing. They also advertise heavily through SEO spam and cost 2x the competition, so go figure...

  • 1
    Generally, the responsibility of shared hosting is only to ensure that tenants don't endanger/disturb each other. Shared hosting that implements WAF/mod_security for tenant's websites are exceptional. The security of the application layer is usually the responsibility of the tenant. – Lie Ryan Dec 15 '16 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.