This Blog Is Not For Reading

A blog, just like any blog, only more so

  • Subscribe

  • Categories

  • RSS Bob Jonkman’s Microblog

    • New note by bobjonkman 4 January 2022
      According The Register's forum, this is the patch: "The current fix: Represent 2022-01-02 as 2021-12-33."https://forums.theregister.com/forum/all/2022/01/03/exchange_servery2k22_flaw/#c_4389861
    • Favorite 4 January 2022
      bobjonkman favorited something by lxo: what's most incredible about this date representation is that it was introduced after Y2K. it wouldn't have worked up to [19]99 think about it. someone implemented that after all the many years of preparation and patching decades-old systems for Y2K, knowing (or, worse, without realizing) that it had at most […]
    • bobjonkman repeated a notice by lxo 4 January 2022
      RT @lxo what's most incredible about this date representation is that it was introduced after Y2K. it wouldn't have worked up to [19]99 think about it. someone implemented that after all the many years of preparation and patching decades-old systems for Y2K, knowing (or, worse, without realizing) that it had at most a couple of […]
    • New note by bobjonkman 3 January 2022
      From what I can tell, they were using the decimal digits of the 32-bit number as a sort of BCD, with the base10 digits representing portions of the date. The example used is "the new date value of 2,201,010,001 is over the max value of 'long' int32 being 2,147,483,647". So, YY MMDDHHMM ? What an […]
    • New note by bobjonkman 17 December 2021
      Some days I'm glad my instance of #GNUsocial doesn't support #ActivityPub and isolates me from the idiocy on Mastodon of which I already get plenty from #Birdsite.
    • New note by bobjonkman 8 December 2021
      And, of course, Wikipedia knows everything: https://en.wikipedia.org/wiki/Foundation_series#Adaptations #Foundation
    • New note by bobjonkman 8 December 2021
      Happily, it's been about 50 years since I read the first three novels, and about 20 years since I started on the sequels (which never did finish, got about halfway through the third sequel book). So my foggy memories of the storyline in the original trilogy shouldn't detract from the TV series. I recall there […]
    • Favorite 8 December 2021
      bobjonkman favorited something by clacke: @Bob Jonkman It is highly character-driven.It uses key characters, the Empire, the exile, Terminus, Psychohistory, two kingdoms instead of the Four Kingdoms and some echoes of half of the first book and fainter echoes from other parts of the series, while the main story maps roughly to half the first […]
    • bobjonkman repeated a notice by clacke 8 December 2021
      RT @clacke @Bob Jonkman It is highly character-driven. It uses key characters, the Empire, the exile, Terminus, Psychohistory, two kingdoms instead of the Four Kingdoms and some echoes of half of the first book and fainter echoes from other parts of the series, while the main story maps roughly to half the first book. It […]
    • New note by bobjonkman 7 December 2021
      Don't get me wrong, I think Foundation is one of the greatest SF stories ever written. And I hadn't heard there was a series, must find out when and where it airs... !SciFi @clacke

Recovering from a WordPress hack

Posted by Bob Jonkman on 29th October 2013

WordPress logo cleaved by axe

WordPress Hacked!

Last Friday I was finally getting around to upgrading the WordPress installations on the SOBAC server from v3.6 to v3.6.1. Surprise! WordPress v3.7 had just been released the night before!

WordPress upgrades are famous for their ease of installation. Surprise! After upgrading the first installation most of the plugins were missing, and the theme was broken. A quick look at a directory listing showed that the plugins and themes were still installed. A quick look with a text editor showed some peculiar PHP code at the top of every .php file in the plugins folders. Surprise! This WordPress installation had been hacked! Fortunately, of the five instances of WordPress on this server, only two appeared to be affected. This Blog Is Not For Reading was not one of them.

Each .php file started with something like this:

<?php $zend_framework="\x63\162\x65(…)\x6e"; 
@error_reporting(0); 
zend_framework("", "\x7d\7(…)

Injected, obfuscated PHP code at the top of every .php file, referencing the zend_framework

Searching the Internet for “wordpress plugin invalid header zend_framework” I found a reference that makes me think this may have been possible because of a flaw in an earlier version of the WordPress code that handles comments. Most likely one of the comment fields (user name, e-mail, web address or the comment text itself) wasn’t properly sanitized, and allowed some kind of code injection (probably PHP injection, not a MySQL injection; the contents of the databases appeared to be untouched).

From the backups of the server it appeared that the breach occurred in or before August — either just before the release of WordPress 3.6 on 1 August 2013 or just before the release of WordPress 3.6.1 on 11 September 2013. If I had not been slack in upgrading to WP v3.6.1 then this breach might have been identified much sooner.

The upgrade to WordPress identified the modified files because the injected code preceded (and corrupted) the WP headers, and so WP v3.7 disabled any affected plugins and themes.

The Fix Is In

I renamed the directory containing the WordPress code, installed a fresh copy of WP3.7, cleaned and copied the wp-config.php and .htaccess files, uploaded a small image to create the wp-content/uploads hierarchy, then copied the upload folder (which didn’t contain any .php files), and then re-installed and re-configured the themes and plugins directly from the WordPress site.

Aside from the additional PHP code, there didn’t appear to be any other damage to the system. So I used the original wp-config.php (but cleaned, and with the “Authentication Unique Keys and Salts” section refreshed), and the new installation just used the existing databases. If there’s any malcode in the databases then that could re-infect the system, so I’m keeping an eye on it.

I have no idea what the malcode was intended to do. It didn’t corrupt the databases or anything else, but it’s possible it was acting as a keylogger or phoning home some other way. If I feel inclined I might try to de-obfuscate the injected code, but right now I don’t really feel like doing forensics.

Someone suggested using AppArmor to make the WordPress directories read-only. I’m not sure that locking down the WP directory is a good idea. The big new feature in WordPress 3.7 is its automatic update feature. If the WordPress directories are locked down then future security updates won’t be applied automatically. If there is an exploit and WordPress issues a new release to fix it, then a locked-down site will experience a delay in upgrading until the SysAdmin notices and upgrades manually (which is what used to happen before v3.7, but it seems a bad idea to delay upgrades when that’s no longer necessary). Also, the plugin and themes directories would be locked down, and they still require fairly frequent manual upgrades.

I sent the users on the affected sites this message:

While doing upgrades on WordPress yesterday I saw that your blog had been hacked sometime during or before August. I’ve fixed it (re-installed the code, copied your media library, re-installed themes and plugins). I don’t think any damage was done beyond the insertion of malicious code in some of the WordPress files. I don’t know what the action of that code was intended to be, but you should change your WordPress password just in case the bad guys captured it. You can change your password on the “Users, Your Profile page” once you’ve logged in.

After spending some time on Saturday fixing the two hacked WordPress sites I’m a little paranoid, and making sure to implement updates quickly. But a little paranoia is good — it’ll ensure I won’t become complacent again.

–Bob.

WordPress Hacks by Rafael Poveda is used under a CC BY-NC-SACreative Commons — Attribution-NonCommercial-ShareAlike — CC BY-NC-SA license.

Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,
Posted in code, How To, security, System Administration | Comments Off on Recovering from a WordPress hack

Charming comment spam

Posted by Bob Jonkman on 6th July 2012

Smoke curls up

Genie in the bottle

This blog may not have many readers who leave comments, but it sure does have a lot of commenters who leave spam! Still, I make sure to go through the list of pending comments in case there’s a real one in there. Today, I came across one comment that was obviously spam, but charming with its fractured English and a punch line I hadn’t heard before:

AftequeAlew:
A houseman was walking on the beach harmonious day and he bring about a bottle half buried in the sand. He irrefutable to provide it. Stomach was a genie. The genie said,” I resolve agree to you three wishes and three wishes only.” The gentleman prospect there his beginning demand and decided, “I think I be deficient in 1 million dollars transferred to a Swiss bank account. POOF! Next he wished after a Ferrari red in color. POOF! There was the transport sitting in van of him. He asked in search his settled hanker, ” I wish I was irresistible to women.” POOF! He turned into a box of chocolates.

Genie in the bottle by zenoka is used under a CC BY-NC 2.0CC BY-NC 2.0 license.

Tags: , , , , , , ,
Posted in blogging, spam | 3 Comments »

 
Better Tag Cloud