Presented by Daniel Kanchev

1. 8 WAYS TO HACK A WORDPRESS SITE
WordCamp Porto 2013
Daniel Kanchev

2. Before We Begin…
•
7+ Years of WordPress
experience
•
5 years with SiteGround
•
Love FOSS
•
Addicted to extreme and
not so secure sports

3. Why should YOU care?

4. 1. OUTDATED WORDPRESS CORE

5. 1. OUTDATED WORDPRESS CORE
•
WP 3.7.1 - MAINTENANCE RELEASE
•
WP 3.6.1 - SECURITY RELEASE
•
WP 3.5.2 - SECURITY RELEASE
•
WP 3.5.1 - SECURITY RELEASE
•
WP 3.4.2 - SECURITY RELEASE
•
WP 3.4.1 - SECURITY RELEASE
•
WP 3.3.3 - SECURITY RELEASE
•
WP 3.3.2 - SECURITY RELEASE
•
WP 3.3.1 - SECURITY RELEASE
•
WP 3.2.1 - MAINTENANCE RELEASE

6. 1. OUTDATED WORDPRESS CORE
•
WP 3.7.1 - MAINTENANCE RELEASE
•
WP 3.6.1 - SECURITY RELEASE
•
WP 3.5.2 - SECURITY RELEASE
•
WP 3.5.1 - SECURITY RELEASE
•
WP 3.4.2 - SECURITY RELEASE
•
WP 3.4.1 - SECURITY RELEASE
•
WP 3.3.3 - SECURITY RELEASE
•
WP 3.3.2 - SECURITY RELEASE
•
WP 3.3.1 - SECURITY RELEASE
•
WP 3.2.1 - MAINTENANCE RELEASE
80%

7. UPDATE, UPDATE, UPDATE!

8. 2. OUTDATED PLUGINS/THEMES

9. WP PLUGINS SECURITY STATE
“Checkmarx’s research lab identified that
more than 20% of the 50 most popular
WordPress plugins are vulnerable to
common Web attacks, such as SQL
Injection”
http://www.checkmarx.com/wp-content/uploads/2013/06/The-Security-State-of-WordPressTop-50-Plugins.pdf

10. NOTABLE EXAMPLES
•
timthumb.php Security Vulnerability
•
W3 Total Cache Vulnerability

11. LIVE DEMONSTRATION

12. 3. UPDATED BUT STILL VULNERABLE

13. FREE THEMES/PLUGINS ?!
“8 out of 10 sites included base64
encoding in their themes.”
Siobhan McKeown

14. TRUSTED DEVELOPERS

15. USE WAF

16. 4. WEAK LOGIN DETAILS

17. Do you log in with username “admin” ?

19. KEEP
CALM
AND
LET ME
SHOW YOU
WHY

20. CHANGE THE ADMIN USER
UPDATE wp_users SET user_login = ‘Yourname+_admin’ where
user_login = ‘admin’;

21. STRONG PASSWORDS
Use a whole sentence or a favourite quote:
Comedy is acting out optimism!

22. 5. MALWARE

23. SECURE YOUR COMPUTERS
• Keep
your OS and all programs updated
• Install
Anti-Virus software
• Use
personal firewalls
• Open
• Use
sites via HTTPS whenever possible
SSH or SFTP instead of FTP

24. 6. VULNERABLE SERVER SOFTWARE

25. WATCHA TALKIN ABOUT

26. SOME EXAMPLES
•
PHP-CGI Vulnerability - versions before 5.3.12/5.4.2
•
MySQL/MariaDB Vulnerability - versions before 5.5.25
•
Apache range header DoS - versions before 2.2.20

27. •
Update server software
•
Follow security bulletins
•
Hire professional sysadmins

28. 7. INCORRECTLY CONFIGURED SERVER

29. APACHE SYMLINK VULNERABILITY
The Problem:
public_html/fred.txt —> /home/otheracct/public_html/wp-config.php
The Solution:
Add to httpd.conf or .htaccess file: SymLinksIfOwnerMatch

30. •
Find a good host
•
Hire professional sysadmins

31. 8. WRONG PERMISSIONS + ISOLATION

32. THE CORRECT PERMISSIONS
Folders: 755
• Files: 644
• wp-config.php: 444
•

33. SSH COMMAND TO CORRECT
PERMISSIONS
•
find /wordpress -type d -exec chmod 755 {} ;
!
!
•
find /wordpress -type f -exec chmod 644 {} ;

34. GENERAL GUIDELINES
• Use
Secret Keys - http://api.wordpress.org/secret-
key/1.1/salt
• Move
• Use
wp-config.php to parent folder
SSL for wp-login.php
• Allow
admin access only from certain IPs

35. QUESTIONS ?

36. THANK YOU!
Daniel Kanchev
@dvkanchev
daniel.k@siteground.com

37. http://slideshare.net/siteground

38. REFERENCES
•
http://blog.sucuri.net/2013/05/from-a-site-compromise-to-fullroot-access-symlinks-to-root-part-i.html
•
http://httpd.apache.org/security/CVE-2011-3192.txt
•
http://thehackernews.com/2012/06/cve-2012-2122-seriousmysql.html
•
http://blog.spiderlabs.com/2012/05/php-cgi-exploitation-byexample.html
•
http://www.checkmarx.com/wp-content/uploads/2013/06/TheSecurity-State-of-WordPress-Top-50-Plugins.pdf