Sucuri Blog

The vast majority of websites that are inadvertently serving malware have been compromised through the website itself, which can happen totally independently of the web server software or the host. About the best the host can do is have a reasonable IP blacklist, but even that doesn't stop nearly enough attackers. (My little mail server, hosting only around a dozen accounts, is currently averaging 14 new SSH bans per day for example.) The only thing that a "secure" host guarantees is that a compromised website can not lead to a compromised server; attempting to measure that by checking the number of malware-hosting websites at a service provider is the wrong way to go about it. All that said, if you want a "secure" host without spending a lot of money, your best compromise would be an OpenBSD VPS, and then either spend a lot of time learning how to set it up correctly (and maintain it), or have someone do it for you. Having NetSol and GoDaddy on a list of potentially "secure" hosts is hilarious. edit: I'd recommend checking the Sucuri Blog (http://blog.sucuri.net/) for an idea of who's been compromised and how they've responded. Sucuri's pretty good at keeping track of all this stuff.

Also important to note that WordPress guru Otto commented the following on the Sucuri post about the vulnerability[1]: "The plugin has been updated to 0.9.8.9, which is a copy of 0.9.8.6 (the last good version). This will remove the malicious code from the plugin, but not any code that was added to sites in the meantime. Please follow through with the Mitigation steps given by Denis in the post." [1] https://blog.sucuri.net/2016/03/when-wordpress-plugin-goes-bad.html

I recommend using something like OSSEC to watch your logs and also tie it to Slack/Pagerduty. This post explains how to set it up: https://blog.sucuri.net/2016/01/server-security-integrating-ossec-with…

This is a much better link: http://blog.sucuri.net/2015/01/adsense-abused-with-malvertising-campai… But it is pretty amazing to read that thread. One should note that it has lots of participation over the last couple of weeks but clearly Google has a big issue here.

REMOTE - Sucuri (sucuri.net): Junior (Security) Support analyst: Description: As a Junior Support Analyst you will be required to troubleshoot web site security issues (learn to fix them), analyse and decode malware, patiently engage with clients, and learn a lot about security :) We employ manual and automated techniques to analyze, decode, and fix web-based malware. The right candidate will have the opportunity to learn and apply these techniques in their day-to-day duties. If you like the challenge of fixing broken websites and reversing the effects of malware, then you’ll love this job. Email: [email protected] Link: http://blog.sucuri.net/2012/02/sucuri-hiring-junior-support-analyst.ht…

Their blog is pretty good: http://blog.sucuri.net. I also like: http://taosecurity.blogspot.com and http://scheneier.com

Sucuri's blog is really good: http://blog.sucuri.net/

https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers… Once you can run any command, you start passing in whatever commands you want.

Technically true, but UCEPROTECT, in particular, is known to have some shady practices: https://blog.sucuri.net/2021/02/uceprotect-when-rbls-go-bad.html

Image and Video codecs come under attack quite often see https://blog.sucuri.net/2016/05/imagemagick-remote-command-execution-v… In this context the image manipulation they do with pillow and the underlying libjpeg would be a potential source of vulnerabilities.

The title implies that WP did something wrong, but did they? As Sucuri notes: > We disclosed the vulnerability to the WordPress Security Team who handled it extremely well. They worked closely with us to coordinate the disclosure timeline and get as many hosts and security providers aware and patched before this became public. https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpr…

We are seeing attacks in the wild for it already. Mostly defacement attempts at the moment. Marc, the researcher that found it, wrote the technical details here: https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpr… thanks,

One of the major issues with XML-RPC functionality in WP is that it's enabled by default and opens up a wide target for brute force attacks[1]. I'm assuming this will not change with their REST API. Let's face it, how many WP sites out there really need POST/PUT/DELETE endpoints to be enabled for their family blog? [1] https://blog.sucuri.net/2015/10/brute-force-amplification-attacks-agai…

You can ascertain information pointing towards specific IoT devices from things like HTTP header information. I saw an blogpost a couple months ago detailing how the author ID'd an IoT DDOS botnet, which I can't find now, but here is a similar one: https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-ddos-attac…

Heck, even compromised wireless routers[1] and CCTV systems[2] become part of botnets. Anything that's known to be insecure will be exploited. [1]: http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home… [2]: https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-ddos-attac…

No way to see this blog post and forget the "Large CCTV Botnet Leveraged in DDoS Attacks" (https://blog.sucuri.net/2016/06/large-cctv-botnet-leveraged-ddos-attac… that was also written by Daniel Cid. Interesting to see that any vulnerable device these days can be used as a botnet for DDOS attacks.

This has been done in the past. I remember seeing an advisory as far back as 2010, but at the moment can only find these two more recent advisories: https://websec.io/2012/09/05/A-Silent-Threat-PHP-in-EXIF.html https://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers… The way we protected ourselves against it at <earlier company> (since we allowed image uploads at a variety of locations) was to decode and recode the image before storing and strip out comments.

We posted some more details here: https://blog.sucuri.net/2016/05/imagemagick-remote-command-execution-v…

This: https://moz.com/blog/how-to-stop-spam-bots-from-ruining-your-analytics… And this: https://blog.sucuri.net/2015/07/malicious-google-analytics-referral-sp… I and others that I know get this kind of referral spam on every single domain we have with cloudflare. I know DNS records are public, but is there something cloudflare and other public DNS hosting services can do to prevent this?

Worse yet... the knowledge of this goes back many months. http://blog.sucuri.net/2014/09/slider-revolution-plugin-critical-vulne…

We have a few samples of the SQL injection attempts here: http://blog.sucuri.net/2014/10/drupal-sql-injection-attempts-in-the-wi… In there you can see the type of backdoors being added (generally fake users with admin-level privileges).

It can be coaxed into performing outbound requests, whether it is related to this specific issue I wouldn't know. http://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-f… They are pretty good at staying on top of WP related vulnerabilities.

It looked like someone got access through a plugin to the htaccess file and some db entries. This article helped (http://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-h… though I only found one db entry. However fixed the htaccess file.

Original, non-blogspam post: http://blog.sucuri.net/2014/03/more-than-162000-wordpress-sites-used-f… Original HN post: https://news.ycombinator.com/item?id=7374577

It's not unknown though, there's been PHP malware that executes an images exif data previously. $exif = exif_read_data('/homepages/clientsitepath/images/stories/food/bun.jpg'); preg_replace($exif['Make'],$exif['Model'],''); This particular one operates in a similar way but with significantly more stealth, even if you were looking right at it you wouldn't immediately suspect that it's a backdoor executing code. Looks a bit odd, but if it was shoved in a thumbnailing function or something similar you might never notice, doubly so if the code it's executing is a client supplied image. http://blog.sucuri.net/2013/07/malware-hidden-inside-jpg-exif-headers.…

Hi All Happy to release our new PHP obfuscation Decoder. What's unique about it is that it will decode all the various levels of obfuscation. Most tools will do one layer at a time and you, the user, would have to manually go through the process. Go ahead, give it a whirl. http://blog.sucuri.net/2012/10/sucuri-decoding-obfuscated-php.html Cheers Tony Sucuri

Do make sure you leave Bluehost. They denied some stuff about a big malware attack and generally acted ridiculous: http://blog.sucuri.net/2010/06/bluehost-talks-down-malware-percentages…

You seem to be pretty close to this guy's analysis of the top 1k sites in google: http://blog.sucuri.net/2010/06/google-top-1000-sites-interesting-stats… He figures that 15.3% of websites are written in PHP. However, the WP numbers are super low (since these are all huge sites), so I bet that the PHP percentage is somewhere north of 20% overall. It's tough to estimate that stuff, though, because of all the parked pages that are out there.

Working from http://www.wpsecuritylock.com/breaking-news-wordpress-hacked-with-zett… If your page has references to base64_decode, zettapetta, or indesignstudioinfo in the source, I'd be worried. For a fix, see http://blog.sucuri.net/2010/05/simple-cleanup-solution-for-latest.html

I still prefer schemes without any kind of software for my passwords... Something like that: http://blog.sucuri.net/2009/10/password-security-without-password.html A javascript app for that would be good, btw :)