Wordfence Blog

I run http://www.wordfence.com - We provide customer support via Freshdesk for our paid customers (a ticketing system) and on the wordpress.org forums for our free customers that use our open source product. I initially did CS myself along with my co-founder and it is tough work. The hardest is the context switching overhead. One minute you're coding or marketing, and then you have to switch into doing 2 or 3 hours of customer support. What is really tough is at the end of the 3 hour stretch, a customer with a real gnarly issue comes along and you have to do 30 to 45 minutes of actual work researching it to help them. You have to dig deep to go that extra distance. Once our revenue scaled we could hire our first full time customer support engineer and wow. It was so awesome to have someone offload this and let us focus on all the other stuff (which we would eventually have to hire for too!). We have a team now, some permanent and some contractors. So there's no easy way to do it and because it's a human intelligence task, it's super time consuming and super expensive. But I can't overstate the importance of great customer service. We are known for it in our space and it has really paid off. Competitors have dropped the ball in a big way and we have picked up the slack through excellence in customer service. A few things I learned: - Reply early, reply often. It's very important to most customers to simply be acknowledged. - Everyone has a bad day and 90% of the time, a…

Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP space is making my head spin. There are a dozen competing 'security' plugins, with some saying 'you don't need any of them, WP is secure enough by default', and others saying 'you actually need ModSecurity [1] / Jeff Starr's nG firewall [2] on your server'. The agency that (shoddily...) built the webshop installed Wordfence Free [3], so I've just kept that for now, though I feel it's kind of slow (but that might just be caused by the bottom-of-barrel performance of the shared webhost it's currently running on). [1] https://github.com/SpiderLabs/ModSecurity [2] https://perishablepress.com/7g-firewall/ [3] https://www.wordfence.com/

The follow up [1] identified "Mason Soiza" as a spammer/malware distributor who did the same with many plugins on many sites for many years, and the author did a great job tracking everything down. -- [1] https://www.wordfence.com/blog/2017/09/man-behind-plugin-spam-mason-so…

With a follow-up post too: https://www.wordfence.com/blog/2016/08/will-always-put-customers-commu…

It's even worse. Why can someone just keep trying to login on default WP installation? Why can they try to guess usernames? First thing I install is: https://www.wordfence.com

You can have a look at WordFence as well which comes free of charge (and there are paid plans). It does checksumming and guards your login page. https://www.wordfence.com

Indeed a massive pain. I've been getting alerts from dreamhost regarding increased memory usage. I have http://www.wordfence.com/ installed and my blocklist only increases.

This is build by the company: https://www.wordfence.com

The comment made about domain names not being trustworthy is why I like EV-certificates. Some people (notably google) argue that EV-certificates add very little of value because the user can just as easily check the domain name. Thing is, I could probably get some paypal or google like domain. Even if I can't, I could use a data URI as in [1] to put https://google.com in the address bar. Compare that to EV. To get a browser to display google (or googel, or paypal), I'd need to convince a CA to issue such an EV cert. Whilst that might not be impossible, it takes something close to a state-level actor. A lot of phishers operate below that level. What EV gives over the domain name is a fully CA controlled part of the UI. Whilst the address bar is the 'zone of death by phisher' the EV bar is the 'zone of death by CIA/KGB'. [1] https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/

My mind immediately went to chaining this with another recent vulnerability in the Ninja Forms - File Upload plugin [0] > This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. So, upload and execute a script that loads Copy Fail and even if you're only executing as www-data or another restricted user that "can't" sudo -- suddenly, uid=0! To repeat the refrain... I'm so tired. [0] https://www.wordfence.com/blog/2026/04/attackers-actively-exploiting-c…

Here is an example: https://www.wordfence.com/blog/2020/05/nearly-a-million-wp-sites-targe… That is what happens if you are the WP admin and think that you don't need to update your plugins because "it's just XSS, nothing major".

Remedy according to https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-core/… : Remediation - No known patch available, uninstall the affected software!

ThriveThemes still hasn't released a disclosure on an attack from March 2021.[0] This seems to be par for the course among theme developers. 0. https://www.wordfence.com/blog/2021/03/recently-patched-vulnerability-…

There's a summary here, which seems to be reporting on the OP: https://www.wordfence.com/blog/2021/11/godaddy-breach-plaintext-passwo… (Via https://news.ycombinator.com/item?id=29311286, but no comments there)

Only type your Google password if the site is accounts.google.com. https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/ Better yet, use FIDO.

Wait... so if I write a WP plugin, I'm entitled to disable other plugins I don't like when people install mine? Of course not. That endurance cache is not the only one, there's a list of "plugins we disagree with" which are disabled: https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular… As for hosting providers: GoDaddy, BlueHost, etc - yes, they're all bad. But that doesn't justify moves like these. Serious question though, on the technical part: WP needs an advanced-cache.php file, which needs to be in wp-content in order for the cache to work; this will list as dropin. Are you sure the endurance cache is MU and not dropin? (Genuine question).

> It sounds like they got a little overaggressive fighting with the company that had hijacked their themes and were selling them last year. Some of this might be explainable in this fashion, but not all. https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular… > Firstly, the plugin includes a content filter that automatically replaces references to Blogerize, a service which claims to be a beginner’s blogging course, with references to Pipdig’s own services.

Here's a second writeup, which also contains a response from pipdig: https://www.wordfence.com/blog/2019/03/peculiar-php-present-in-popular…

WP auto update is nice...until a WP update breaks the functionality! Lol. https://www.wordfence.com/blog/2018/02/broken-auto-update/

It's not red yet. It will look like this eventually.: https://www.wordfence.com/wp-content/uploads/2017/01/blog-image-2.png , which will be a stronger negative signal.

Yeah, I read articles calling it sophisticated. This is a super simple and straight forward worm. Disguise yourself as a known app and ask for more permission than you should. IDN exploits [0] and attachment faking [1] are more sophisticated if anything. [0] https://www.wordfence.com/blog/2017/04/chrome-firefox-unicode-phishing… [1] http://fortune.com/2017/01/18/google-gmail-scam-phishing/

Here is some support for the claim that WordPress is insecure: https://www.wordfence.com/blog/2016/03/attackers-gain-access-wordpress…

Will this also apply to data URIs? Thinking of the recent data URI phishing exploits [1] [1]: https://www.wordfence.com/blog/2017/01/gmail-phishing-data-uri/

About that. https://www.wordfence.com/blog/2016/11/hacking-27-web-via-wordpress-au…

Not quite. They just require that you adequately protect PII. Since that is very expensive to do, only large companies tend to do it. Smaller companies probably just ignore it... https://www.wordfence.com/blog/2015/10/european-data-on-usa-servers-sa…

PHPMailer is also used by wordpress: https://www.wordfence.com/blog/2016/12/phpmailer-vulnerability/

Not your OP and this seems very searchable, but here you go: https://premium.wpmudev.org/blog/wordpress-security-exploits/ https://www.wordfence.com/learn/how-to-protect-yourself-from-wordpress…

> As I understand it, signifiers included command and control servers known to be under Russian state control. If you could be more specific, we could address this. However, you cannot, because the allegations are all this vague. If it's the assertion that I think it is, the "command and control servers" were asserted by Crowdstrike to be under Russian control, and its evidence for this, again, were somewhere deep in a rabbit warren of cross- and circular references[1]. > Do you work in this field? I've basically only seen lay people suggest this. I have seen journalists claim that only lay people suggest this. To your vague and amorphous allegations of "state actors", I reply with this specific analysis of the few concrete indicators of compromise supplied by the departments of the government making the allegation. It's farcical. If Russiagate were to be true, the Russian hackers are no better than script kiddies, using outdated PHP malware as they do. https://www.wordfence.com/blog/2016/12/russia-malware-ip-hack/ [1] Furthermore, IP addresses change constantly. Again, if you're referring to the assertion I think you are, that IP address had been defunct for over 2 years before the attack See https://www.wordfence.com/blog/2017/01/election-hack-faq/ An IP that was being used by Russian Intelligence today to hack a target may be used by another attacker to hack a different target a few days later. This can happen for several reasons: - A hacked IP can be used by one…

https://mobiforge.com/news-comment/no-https-then-bye-bye-geolocation-i… https://www.wordfence.com/blog/2017/01/chrome-56-ssl-https-wordpress/ https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-ht… http://stackoverflow.com/questions/32106849/getcurrentposition-and-wat… https://konklone.com/post/were-deprecating-http-and-its-going-to-be-ok… http://forums.whirlpool.net.au/archive/2598616 Just some random places to start to see why the major web browsers are not going to spend any time on non-encrypted protocols. A lot of devs need to help themselves and move to encrypted to connections before they are forced at browser-point.

Here's a short list I compiled just for you Aaron, but you have to do your own reading. http://www.theguardian.com/technology/2015/may/01/encryption-wont-work… http://reason.com/blog/2016/02/18/4-reasons-to-fear-encryption-back-do… https://www.servint.net/university/article/keep-the-back-doors-to-encr… https://pando.com/2013/12/19/the-nsa-review-panel-says-encryption-back… http://www.techrepublic.com/article/why-government-mandated-encryption… http://www.newsweek.com/why-we-need-encryption-even-nsa-cant-decipher-… https://www.wordfence.com/blog/2016/02/wordfence-supports-strong-encry… https://www.rt.com/usa/319236-no-encryption-backdoor-apple-ceo/ http://www.techrepublic.com/article/encryption-you-cant-put-the-genie-… http://www.theguardian.com/commentisfree/2015/mar/04/backdoors-encrypt… https://www.yahoo.com/tech/defense-secretary-favors-strong-encryption-… http://www.freerepublic.com/focus/f-news/3395743/posts BTW Aaron, a sidedoor is just a backdoor on an adjacent wall...