Scribd Logo
Upload

Welcome to Scribd!

  • 38 views

    Hack Wordpress Echosyst

    Uploaded by

    RESISKOM21M.FATHURRAHMAN
    The document discusses hacking vulnerabilities in the WordPress ecosystem, including the platform, plugins, themes and users. It outlines common attacks and provides recommendations to secure WordPress sites by fixing issues with infrastructure, updating software, reviewing code, and increasing user awareness.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Hack Wordpress Echosyst

    Uploaded by

    RESISKOM21M.FATHURRAHMAN
    38 views34 pages
    The document discusses hacking vulnerabilities in the WordPress ecosystem, including the platform, plugins, themes and users. It outlines common attacks and provides recommendations to secure WordPress sites by fixing issues with infrastructure, updating software, reviewing code, and increasing user awareness.

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document discusses hacking vulnerabilities in the WordPress ecosystem, including the platform, plugins, themes and users. It outlines common attacks and provides recommendations to secure WordPress sites by fixing issues with infrastructure, updating software, reviewing code, and increasing user awareness.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    38 views34 pages

    Hack Wordpress Echosyst

    Uploaded by

    RESISKOM21M.FATHURRAHMAN
    The document discusses hacking vulnerabilities in the WordPress ecosystem, including the platform, plugins, themes and users. It outlines common attacks and provides recommendations to secure WordPress sites by fixing issues with infrastructure, updating software, reviewing code, and increasing user awareness.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 34

    Hacking the

    Wordpress Ecosystem
    About Me

    Dan Catalin VASILE


    • Information Security Consultant
    • Researcher / Writer / Presenter
    • OWASP Romania Board Member

    • Online presence
    – http://www.pentest.ro
    – [email protected] / @DanCVASILE
    About the talk

    Hacking the Wordpress Ecosystem


    WHY?
    About the talk

    More numbers
    About the talk

    Finding Wordpress!
    Scope
    Scope

    TO SCARE!!!!

    Attacks on:

    - The Worpress platform


    - Plugins
    - Themes
    - Infrastructure
    - Humans
    Scope

    and TO REPAIR.

    Focus on:

    - Infrastructure
    - Installation process
    - Protective server side measures
    - Protective client side measures
    - Reviewing source code
    - Maintenance
    Wordpress Ecosystem

    Infrastructure

    Users
    Base platform
    Themes Plugins
    Hacking the infrastructure

    Physical security
    Hacking the infrastructure

    Common web server vulnerabilities

    • Overflows
    • DoS
    • Remote command execution
    • XSS in internal tools
    • Security Misconfiguration

    … just no name a few


    & more
    http://httpd.apache.org/security/vulnerabilities_22.html
    Hacking the infrastructure

    PHP vulnerabilities

    • DoS
    • Overflows
    • Remote command execution

    • SQL injection
    • XSS
    • Source code disclosure
    • RFI
    • CSRF

    &more
    Hacking the Wordpress platform

    One example from the CVE Database


    Hacking the plugins

    How many plugins are there?


    27,596 PLUGINS, 536,317,915 DOWNLOADS
    (as of October 2013)

    How many of them are vulnerable? ☺


    Not as many as you’ve expected. CVE lists ‘only’ 164
    vulnerabilities (not all related to plugins)

    Fear not! New plugins everyday & new disclosures


    on old plugins.
    Hacking the themes

    Themes can be vulnerable!

    They sometimes come up with other plugins


    necessary to get the functionality needed

    Think about TimThumb vulnerability!


    Hacking the themes

    What is TimThumb?
    A small php script for cropping, zooming and resizing web images (jpg,
    png, gif). Perfect for use on blogs and other applications.

    The problem!
    “TimThumb” essentially, caches even remote files locally, without
    doing any proper sanitization.

    The problem for hackers


    The file “timthumb.php” does however, check if to see if the target file
    is actually an image or not. This timthumb file is also quite often
    renamed to something else and is used in many themes.
    TimThumb hack

    The easiest way to trick TimThumb into believing a remotely stored image
    (that also contains evil PHP code) is an actual image (with timthumbcraft)
    TimThumb hack

    Uploading the file


    TimThumb hack

    Additional problems with the TimThumb hack


    - When uploading the image, the php script will be located in
    the cache directory with a ‘random’ name
    TimThumb hack

    We’re IN!
    Hacking the users

    Last but not least, hacking the human element:

    - Social engineering
    - Phishing
    - Exploiting bad habits
    Let’s fix it

    Let’s start fixing the Wordpress Ecosystem

    Short recap:
    - Infrastructure
    - Wordpress base platform
    - Wordpress plugins
    - Wordpress themes
    - Users
    Fixing the Infrastructure

    INFRASTRUCTURE

    - Choose a decent data-center


    - Use encryption for physical disks
    - Use secure communication channels with the
    server (SSH, SFTP); do you still use FTP? You should be banned from the world.
    - Keep the Web Server, PHP and Database updated
    to the latest version
    - Secure configurations (disable directory listing,
    secure php.ini configuration, etc.)
    - Log and analyze
    Fixing the Wordpress platform

    WORDPRESS PLATFORM - INSTALLATION

    - Always download the platform from a trusted


    source; use https://wordpress.org/download/
    - Change the default ‘admin’ username
    - Set a strong password
    - Change the default ‘wp_’ table prefix
    - Set an insane database password
    - Move wp-config.php outside /public_html
    Fixing the Wordpress platform

    WORDPRESS PLATFORM - MAINTENANCE

    - BACKUP!!! (BackWPup plugin)


    - Update!
    - Use SSL for authentication
    - Use CAPTCHA for logging in (Captcha on Login
    plugin)
    - Limit the access to /wp-admin (form .htaccess)
    - Source code audit
    Fixing the themes

    THEMES

    - Update
    - Review the code
    Fixing the plugins

    PLUGINS

    - Delete unused plugins


    - Update
    - Review ratings and user comments
    - Source code audit
    Fixing the users

    USERS

    - Awareness
    - Set user roles and give only the privileges they
    need
    - Log & audit user actions (ARYO Activity Log
    plugin)
    - Personal computer security
    - Enforce the use of strong passwords (Minimum
    Password Strength plugin)
    Further actions

    Install one or more security plugins

    • Login Security Solution


    • AntiVirus
    • WP Security Scan
    • WordPress File Monitor Plus
    • OSE Firewall Security
    • Block Bad Queries
    • Wordfence
    Further actions

    Monitor the website from an external party

    • WebsiteDefender
    • Pingdom
    • Change Detection
    Further actions

    Source code audit


    What to do

    If you know what you’re doing, do the whole


    ecosystem yourself.

    Otherwise go with a managed solution:


    • Wordpress.org
    • Wpengine.com
    • Godaddy.com
    Etc.
    Goal

    Wordpress Security Checklist project on OWASP


    https://www.owasp.org/index.php/OWASP_Wordpress_Security_Checklist_Project

    My part:
    - Establish the structure
    - Contribute with content

    I need help for:


    - Content
    - Plugin suggestions and reviews
    - Source code audits
    Questions

    Thank you!

    You might also like