Ablikim's Blog

Hackers love to scan WordPress.   With millions of outdated installations, picking on WordPress is like bullying the little guy at school.   It’s easy and for some – fun to do.

Even if you keep your site updated, you may be surprised about how much information you can extract from a WordPress site.

Gathering information is a key step in any sophisticated attack.   Earlier this year, the person that hacked a major security contractor for government’s published a DYI guide to hacking. Many of the steps describe using various tools to gain information about the target.

Server Security Service

If you think your server may have been compromised, rackAID provides security auditing services.   While we don’t clean up WordPress code or exploits, we can scan your entire server for malware, rouge processes and more.

We support cPanel, Plesk, Red Hat and CentOS systems.  Our comprehensive security audit is just $350 and includes a full Nessus Security scan of your server.  If you are struggling to secure your system, contact us for more details.

WordPress Scanning

Gathering information is a key step in any advanced WordPress security attack.   Earlier this year, the person that hacked a major security contractor published how they did it.  Surprisingly, the attack was not too complex.  They used good skills and freely available tools to scan their target.

These tools included simple, freely available scanning tools, Google searches and just looking at the page’s HTML code.

After reading this hacking how-to, I wondered.

What if I turn these tools on a simple WordPress blog?

You may be surprised what your site reveals.

Here’s the results of a simple scan of a WordPress site.

WPScan

WPScan is a WordPress specific security scanner.   The scanner can

• Identify Plugins Installed
• Identify Themes Installed
• Enumerate User IDS
• Brute Force Passwords

So what happens if you turn this tool on your typical small business web site.

For this site, WPScan found four plugins.  Also listed is the current version and past exploit information about the plugin.

Why would you care about past exploit?

Previously exploitable plugins may have, in fact, been exploited. If there was some common backdoor used, searching for that file could reveal that the site was previously hacked.  For this reason, you should always carefully review any WordPress site after a security breach.  Even if you patch the plugin, backdoors can remain.  Various scanning tools like maldet can help you find malware but ultimately, the safest solution is to restore from backups.

WPScan also reveals  user names. These  can be used to start a brute force attack to try to gain direct access to the WP admin area.

Recently, attackers have been using XML-RPC based brute force attacks. These attacks are not blocked by many brute force plugins and require fewer resources than the traditional wp-login.php attacks.

The scan took just four minutes. With a botnet, I could scan 100’s of sites in a few hours.  With results in hand, I could either find or write a tool to quickly exploit plugins or brute force the most valuable targets.

[ois skin=”Wordpress Optimization”]

BuiltWith

While attackers often use command line tools to protect their privacy, Builtwith.com is a great information gathering tool.

A key step in any attack is to map out your target.   Common questions may include:

• What CMS?
• What OS?
• What web server software?
• What third party tools?

Builtwith.com and other tools make this easy.

Just punch in any web site address and you can find out the web server, hosting provider, CMS and more. By using DNS records, third party email services can be found.

Built With is a free online tool that can quickly map out various technologies and information about a WordPress site.

Sometimes advanced attacks on web sites may start or end elsewhere.

What if an attacker compromises your WordPress blog via a plugin, but through a tool such at Builtwith they know you use Google Apps for email.

They can then start targeting your Google App accounts with data obtained from compromising your blog.

By mapping out the target, attackers can use data from a breach in one service to access another.  This is why you should use unique passwords for every site or service you use.

Nikto

Like WPScan, Nikto can find interesting and potentially exploitable items.

In this report, we find that the server has the WP readme.html file still installed. This quickly tells you what version of WP is in use. Using this data, you could then check to see if there are any known exploits in that version.

This also reveals information about various HTTP headers. For example, mod_pagespeed is active. Does it have any exploits?

By scanning WordPress, attackers can easily learn a lot about how your site is built, the hosting environment and third-party services.   Armed with this information, they can begin looking for known exploits.

Exploit Databases

Secunia and similar databases keep track of the various WP security exploits.   While you can use them to check the security history of a plugin or find current exploits, attackers can access this information as well.

In some cases, CVE records will reference proof-of-concept exploits.   Attackers can  use this information to attempt to exploit your WordPress site. With WPScan, it automatically attempts to identify the latest CVE information for any given plugin or theme — providing handy access to this information.

Escalating Access

When an attacker finds an exploit in WordPress, one of their first goals is to escalate their access.

Recently, the popular WP Touch plugin was discovered to have an arbitrary file upload vulnerability. This exploit allows an attacker to upload a file of their choice.

In absence of other security tools, such as Sucuri’s web application firewall, an attacker could upload a PHP Shell Script. Functionally, these PHP shells are nearly the same as an SSH shell.  You can change permissions, read files, upload files and more.  The tools are very robust.

C99Shell is a popular PHP tool designed to escalate access on your server. This is basically a full shell account in PHP.

Another important point about escalated access:

Local exploits become remote exploits when your WordPress site is insecure.

This is why you need to keep any control panels and your OS updated.  With a PHP shell kit, an attacker could upload a local OS exploit and execute it.  Depending on the type of exploit, they could gain even gain root access.

WP User Security

With escalated access, attackers can begin to mine your system for more useful data.   What’s useful?

Your WordPress user’s email and passwords.

Attackers can simply export your user’s email and passwords directly from the database.   While the passwords are encrypted, simple ones can easily be cracked with password guessing tools.

Many users don’t use unique passwords for different sites. As a result, the attacker has your email address and password. They can then use this information to try to gain access to your email, social media accounts or other popular sites.

As they expand their access, you can become a victim of identify theft, they can use your accounts to spam, host illegal files or more.

Failing to use security in-depth is how a simple WordPress plugin security issue can become a cyber security nightmare.

Advanced Persistent Threats

In the cyber security world, experts like to distinguish between automated attacks and advanced persistent threats (APT). APT are very hard to defend against. With APT, there’s a person at the other end actively trying to find ways into your site or server.   Even the smallest clue from their mapping efforts may lead them to a security hole.

Fortunately, for WP users, most people do not face such advanced threats. In fact, in nearly every WP hacking incident we investigate, the attack is done by automated bots that constantly probe for specific exploits.

Blocking these attacks is as simple as keeping your software updated and using good WP security practices.