Wordpress Under Attack!

Word­Press has recently come under attack from hack­ers exploit­ing the older ver­sions of Word­Press… I myself have been compromised!

If you are run­ning an older ver­sion of Word­Press (any­thing before ver­sion 2.8.4) please check your user panel, how many admin are show­ing? I have one admin, in the user panel and it was only list­ing me, how­ever above it showed “admin­is­tra­tors (2)”.

It occurred to me that some­thing may be wrong because in the past week 3 sub­scibers joined even though i dont give this oprtion on my blog.

To date, although Word­Press have admit­ted their is a prob­lem i have been unable to find a defin­i­tive def­i­n­i­tion of a “fix”. I have how­ever man­aged, after much delib­er­a­tion, to delete the extra admin­is­tra­tor. I deleted them like this:

I logged into my Cpanel, selected ‘php­myad­min’, selected the data­base that my instal­la­tion is using, selected users and then man­aged to delete the hid­den user. How­ever, i am still unsure as to whether their are other steps i should be tak­ing. I will keep my eyes peeled and let every­body else know as i find out.

As an extra step of security:

By default Word­Press will name the admin­is­tra­tor user account as “admin.” If you haven’t changed any­thing while installing Word­Press, that is prob­a­bly what you use to log in.

The prob­lem with this is evi­dent: if some­one wanted to gain access to your blog, all he would need to do is to keep using the “admin” user name with a bunch of pass­words com­bi­na­tions. This is called brute force attack, and with auto­mated tools it works quite often.

When­ever installing Word­Press from scratch, there­fore, remem­ber to use some other name for the admin­is­tra­tor user account. If you already have Word­Press installed, the fix is quite sim­ple. Just cre­ate a new user and set it as admin­is­tra­tor. Then log in with that new user and delete the “admin” user. Don’t worry if you have many posts writ­ten by that user, Word­Press will ask whether you want to delete them or re-assign them to a new user (choose the lat­ter obviously).

This par­tic­u­lar worm, like many before it, is clever: it reg­is­ters a user, uses a secu­rity bug (fixed ear­lier in the year) to allow eval­u­ated code to be exe­cuted through the perma­link struc­ture, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hid­den spam and mal­ware into your old posts.

The tac­tics are new, but the strat­egy is not. Where this par­tic­u­lar worm messes up is in the “clean up” phase: it doesn’t hide itself well and the blog­ger notices that all his links are bro­ken, which causes him to dig deeper and notice the extent of the damage.

Im sure after this lat­est attack many blog­gers will be look­ing for a new blog­ging soft­ware, how­ever i will remain on Word­Press until things get too hot to handle.