Quantcast
0

Hacking WordPress

Posted by Viktoria Michaelis on April 15, 2015 in Internet |

One of the big discussion themes at the moment – an ongoing theme, to be honest – is hacking and, in particular, the many attempts to hack into WordPress sites. It has been mentioned often, along with a whole series of resolutions to make a site safer, but still seems to be a theme simply because the hackers are out there, they are trying to get into different websites, and they are having some considerable success. One only needs to take a glance at recent news stories surrounding the hacking of television sites, government domains and similar.

Even here, on this blog, hacking attempts are part and parcel of daily life, from the Brute Force attempts – over twenty thousand so far – through to simply looking what is on a site and what can be broken into. Some sites are secure, some have older versions of software installed – despite constant reminders to update – or plug-ins which are either wanting in security measures, or simply old.

Photo Source: Micah SittigCreative Commons

There isn’t a single day that goes by without me having to empty out my logs and erase the long list of 404 reports listing who has tried to get in, and where they are trying. It makes me nervous although, when I look, I see that none of the software packages, the plug-ins are installed on my site. But it also makes me wonder how many of the packages where attempts have been made here really are secure. A few examples from today:

/wp-content/plugins/revslider/temp/update_extract/revslider/info.php
/wp-content/plugins/wp-symposium/server/php/index.php
/wp-content/uploads/wpallimport/uploads/23aa3e3baa50a6465d3319ced07bb99c/info.php
/wp-content/force-download.php?file=../wp-config.php
/wp-content/plugins/google-mp3-audio-player/direct_download.php?file=../../../wp-config.php
/wp-content/themes/dejavu/lib/scripts/dl-skin.php

 

What I see here is a (short) list of packages and plug-ins which could have programming faults or security problems which could allow a hacker access to the inside of a site, to the working end. As can be seen, it is not just the plug-ins, but also themes and specific actions which have had access attempts made.

What exactly are these attempts useful for? Seeing the list here, and the many others I have not included, gives the impression that someone – or some thing – is taking software packages at random and just trying their luck. I don’t believe this to be the case, though, since there are so many repetitions of theme names, of plug-ins, of files listed. For a site with these applications installed, and a lower level of security, or an outdated version, it is highly likely that a hacker could – and probably will – gain access.

Once they are in and can play around with the working parts of a site – with the code that makes the whole function – almost anything is possible, from inserting malicious code through to hijacking a complete site and using it to send a specific message out to all visitors. It is also possible, in some cases, that a code could be entered which starts sending out spam mails at random to millions of recipients, or forces a virus onto the computer of a visitor.

Inclusion in the list above does not mean that this software package, this application, is insecure, unless it is an older version, an outdated and less secure version where problems have surfaced in the past. What it does mean is that there may well have been problems in the past, exploitable problems. The list is by no means definitive, and it is growing every single day. It’s no wonder that a major software player like Microsoft sends out continual updates – I had an update today, for example which improved the security and general running of over twenty-five thousand different files.

But the updates are only of use when the person behind a domain, the person running it, maintains their site. If the software is out of date, if an older version of a plug-in is in use, a site is vulnerable. There are good reasons why developers update and change their packages so often: no one can see every eventuality; no one can guard against every risk.

Everyone, however, who cares about their work, their website, can update and remain on top of the problem. It’s just a shame that so many people do not.

Love & Kisses, Viki.

Tags: , ,

Leave a Reply

Your email address will not be published. Required fields are marked *

Copyright © 2010-2017 Viktoria Michaelis All rights reserved.
This site is using the Desk Mess Mirrored theme, v2.5, from BuyNowShop.com.