WordPress Websites Frequent Target Of Attacks

WordPress websites are this year more often been the target of attacks than in previous years and are attacked more frequently than other applications. According to a report (pdf) from security firm Imperva. Researchers at the company looked at attacks against websites and web applications. Then it appears that content management systems (CMS) are attacked three times more often than non-CMS applications.

However, when it came to WordPress 3.5 more attacks. Furthermore, WordPress was seven times more often the target of spam and Remote File Inclusion- (RFI) attacks than non-CMS applications. The problem of WordPress is according to Imperva that all plug-ins and extensions for CMS are developed without security to play a role there. This creates ever new vulnerabilities. In addition, WordPress also based on the PHP programming language, according to the security company.

Researchers Crack Linux Ransomware By Design Flaw

Researcher managed to crack the Linux.Encoder-ransomware for Linux so that victims without paying their files to recover. The ransomware was last week announced by the anti-virus company Doctor Web. At the time, it was unknown how the ransomware spreading.

It was known that it was mostly web servers that were infected. Now the Romanian anti-virus company said Bitdefender attackers use a vulnerability in the popular content management system magento to access servers. Then they install the ransomware, which looks a lot like Windows ransomware. Like Windows-based ransomware encrypts Linux.Encoder files with AES. The symmetric key is then encrypted with an asymmetric encryption algorithm (RSA).

When designing the ransomare the creators have made ​​a big mistake, allowing researchers Bitdefender can identify the AES key without that first with the RSA private key must be decrypted. The ransomware does not use any keys and initialisation vectors for encryption, but leads these two pieces of information on a specific feature in combination with the time of the encryption. This information is easily retrieved and, according to the researchers, a major design flaw. They now have a tool(zip) has been developed which automatically encrypted files can decrypt.

Magento: Hacked Websites Have Not Installed Update

Monday warned security for thousands of hacked Magento sites used to distribute malware. According Magento websites are not adopted by an unknown vulnerability, but the administrators have not installed an important update.

This update was published in February this year and fixed the so-called "Shop Elevator Bug". Through this vulnerability, attackers execute arbitrary code remotely and gain administrator access. In February Magento warned that webmasters should install the update immediately, but eight months later turn out thousands of merchants to have given no answer to this.

In addition, some merchants have been taken over possible because administrators used a weak password. Owners get a Magento site advised to check their website for the presence of malicious code and malware, rename all administrators in the system and install all available updates immediately.

Thousands Hacked Magento Sites Spread Malware

In recent days, thousands of Magento sites are hacked and include malicious scripts that attempt to infect visitors with malware. How websites are hacked exactly is still unknown, so let security firm Sucuri in an analysis know.

According to the company, Google has been hacked 7000 Magento sites blocked. Magento is a popular open source content management system for web shops. Anti-malware company Malwarebytes reports that the attackers script on the hacked websites sites visitors unnoticed to a page with the Neutrino-exploitkit. This exploitkit uses a known vulnerability in Adobe Flash Player to put the Andromeda malware on the system. This malware can steal login details for internet banking and make your computer part of a large botnet.

Critical Vulnerability In CMS Software Drupal Poem

There is an important security update for the popular content management system (CMS) Drupal appeared that fixes multiple vulnerabilities, including a vulnerability that allows attackers websites can take over completely. The leak is in the OpenID module and makes it possible for an attacker as any user to log in, including the manager, and their account hijacking.

Via the other vulnerabilities, it was possible to determine certain information, and to send user via an "open redirect" to a third party website through. This could, for example, can be used for a social engineering attack. Administrators are advised to upgrade to Drupal 6.36 or 7.38.

Website Chef Jamie Oliver Hacked For Third Time

Attackers are there for the third time succeeded in hacking the website of the British chef Jamie Oliver and use for distributing malware. Previously it had been hit in February and March . As with these incidents the attackers malicious code added to jamieoliver.com.

This code sends visitors unnoticed to another website through which uses known vulnerabilities in Adobe Flash Player and Java to infect visitors with malware. It is malware that attempts to steal passwords. In case the software of visitors up-to-date, they are not at risk. The team that know the website of Oliver would be responsible of the incident and take measures to solve the "once and for all", says anti-virus company Malwarebytes . How the attackers were able to gain access to site is unknown.

Website Chef Jamie Oliver Spreading Malware Again

The website of the British chef Jamie Oliver has been hacked again and again spreading malware. The site places attackers malicious code that visitors unnoticed forward to another site. This site contains the Fiesta exploitkit which makes abuse of vulnerabilities in Flash Player, Silverlight and Java.

These are vulnerabilities where all updates to be available. Users who are up-to-date are therefore not at risk. In case users are not up-to-date, it will install a Trojan horse, which is recognized by few virus scanners on VirusTotal. In addition, the malware is signed, even though the certificate used now no longer valid, as reported anti-virus company Malwarebytes. The virus fighter discovered the first hack the website and then warned webmasters that it fixed the problem. Or so it seemed.

The structure used by the attackers to now placed malicious code is very similar to that of the first attack. "That's why we think this is the same infection that was not completely removed or perhaps that a vulnerability in the server or content management system (CMS) is still present," said the researchers. Oliver's website is on the 536ste place of most visited websites in Britain and would attract 10 million visitors each month.

Security Firm Warns Of Hype About WordPress Leak

An American security company has warned the hyping of leaks in the content management system WordPress. Following are reports on various websites about a leak in a WordPress plug-in which more than one million websites were exposed to risk.

The vulnerability was in the plugin called WP Slim Stat. Via the leak would be a "blind" SQL Injection attack are possible.Allows an attacker could read information from the database. According to security firm WhiteFir design these types of vulnerabilities are not used in automated attacks, which most WordPress sites have to deal with. In addition, the leak at the time of news coverage already patched.

"The chances that the leak is abused are quite small compared to a vulnerability that affects PHP files can be uploaded to a website, which will surely be attacked," said the IT security officer. The company also criticizes said plurality of more than 1 million Web sites. The plug-in in question has been downloaded over 1 million times, but downloads does not mean that there are as many websites with the plug-in.

In the case of WordPress are namely also updates to plugins counted as a download. The number of actual users is therefore much lower than the number of downloads. According WhiteFir Design have also the media the opportunity to harm the security of WordPress sites. Users should keep their plugins namely always up-to-date, especially since developers do not always mention that they have remedied vulnerabilities.

TYPO3 Warns Of Critical Vulnerability In CMS

The developers of the popular content management system (CMS) TYPO3 have warned of a critical flaw in the software that only can be logged in with a user name. To also carry out the attack, the CMS software must be set in a certain way.

The system extension must "rsaauth" are loaded and configured in a particular way for frontend use. Furthermore, there must be a vulnerable CMS version installed. The leak, which has not yet CVE number, is present in versions 4.3.0 t / m 4.3.14, 4.4.0 t / m 4.4.15, 4.5.0 t / m 5.4.39 and 4.6.0 t / m 04/06/18. Users have strongly advised to upgrade to 5.4.40 or use a specially crafted shell script that vulnerable TYPO3 versions patches.