Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: Another round of WordPress Attacks SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Another round of WordPress Attacks

H-Security has published an article (http://www.h-online.com/security/news/item/Large-scale-attack-on-WordPress-996628.html) discussing a new series of attacks against WordPress-based sites.

Multiple ISPs have been hit including GoDaddy, Bluehost, Dreamhost, Network Solutions and Media Temple. There is one report that even sites built with the most current version of WordPress have been compromised.

We will update as we have more information, at this point I recommend reading the H-Security article for the summary of the scripts being added and contacting your hosting provider if you have concerns about your site.

Toby

68 Posts
I would like to know if there are any tools to analyze webserver logs for signs of various sorts of mischief -- a sort of after-the-fact IDS function. Something as simple as a sed file of patterns could help. Granted it would not help with compromised shared hosting or stolen FTP credentials. But it would have its place.
Anonymous

Sign Up for Free or Log In to start participating in the conversation!