WordpresZ 2.6.4

kenpeace
(@kenpeace)

15 years, 5 months ago

I think that my WordPress has been hacked. I’m not a technical guy so looking at the PHP etc is not an option.

In my dashboard the second box down on the left – the one that tell me all the recent news changed it tells me to
Update WordPress 2.6.4 immediately!

and points me to a site called wordpresz.org where a suspicious download of WordPress 2.6.4 is waiting for me.

Is my site compromised? What can I do? What other damage should I expect?

Thanks
Ken

Viewing 15 replies - 1 through 15 (of 33 total)

1 2 3 →

camurphy
(@camurphy)

15 years, 5 months ago

I’m in the same boat, looking at it now.

Some screenshots of the problem and a little investigation so far:

http://www.craigmurphy.com/blog/?p=874

Rgs
–Craig

WebDev WaxLotus LLC
(@musnake)

15 years, 5 months ago

Curious. I don’t get this update notification. I see if I can find the files and do a diff…

Yup.

wp-includes/pluggable.php has extra lines in it that appear to call a script on that site to ‘do stuff’ with your cookies if you have more than 5 users…

http://us.php.net/file_get_contents

Are they hoping to luck into an admin account on a large site?

Clayton James
(@claytonjames)

15 years, 5 months ago

@camurphy,

<meta name=”generator” content=”WordPress 2.5.1″ />

wp-includes/pluggable.php….
…’do stuff’ with your cookies…

Well, there is this…

http://www.securityfocus.com/archive/1/490887/30/0/threaded

Might be worth a read. Just one of many possibilities, mind you.

Vulnerable scripts
==================
“wp-include/pluggable.php
function wp_validate_auth_cookie($cookie)”

Clayton James
(@claytonjames)

15 years, 5 months ago

How do you like that? Plain as day. wordpress.org frontpage and download area is being spoofed at wordpresz.org. I just came from there. That takes some kinda’ nuts. (appears to be aimed directly at users who still use 2.5)

whooami
(@whooami)

15 years, 5 months ago

ballsy, sure. but you know what they say about ppl that dont upgrade. 😛

Clayton James
(@claytonjames)

15 years, 5 months ago

ssshhh… you’ll let the cat out! 🙂

whooami
(@whooami)

15 years, 5 months ago

actually, thats pretty slick, i wanna grab that zip and peek inside.

inquiring minds wanna know, and besides maybe ill have s’mthing to blog about besides politics. 🙂

camurphy
(@camurphy)

15 years, 5 months ago

Heh, I can imagine what us “non-upgraders” get called 🙂

Sophos have picked up on this as Troj/WPHack-A:

http://www.craigmurphy.com/blog/?p=881

Roy
(@gangleri)

15 years, 5 months ago

That’s interesting. How would they have managed to make a fake upgrade notification? Is the WP feed for the dashboard hacked, are the 2.5.1 users hacked? There’s nothing fishy in my 2.6.3, but I can understand that some people would fall for the notification if it does appear on their dashboard.

whooami
(@whooami)

15 years, 5 months ago

yeah and sophos blows. its NOT a windows hack, and their software cant remove it unless you **happen** to scan a windows server — and 99.99999% of IIS servers arent runnning any AV — theyre too memory intensive.

you asked the correct question, Gangleri, how is getting into the earlier install’s dashboard… The goal is to prevent that from happening first.

Roy
(@gangleri)

15 years, 5 months ago

Rrright, Whoo, I don’t understand the first paragraphy of what you wrote 🙂 Nonetheless, it’s a dangerous thing when somehow people can edit the dashboard indeed!

Roy

whooami
(@whooami)

15 years, 5 months ago

well, they would need to be able to edit files, or upload malicious one(s), as far as I can tell.

CAMURPHY, did you save your wp-admin/index.php from when that was occurring? If so, whats on lines 112-118?

Moderator Samuel Wood (Otto)
(@otto42)

WordPress.org Admin

15 years, 5 months ago

Did you save a copy of the WordPress installation that was causing this false notification? I’d like to know how exactly they’re doing it.

Because it seems to me that if they were able to insert malicious code into your site in the first place, then they could have totally owned you, no need to make you do a fake upgrade.

I’m trying to see the point, basically. How could they make a false notification on your system? DNS spoofing?

Roy
(@gangleri)

15 years, 5 months ago

I’m not technical enough to add anything worthfull to the discussion, but when I look at the image in the Graig Murphy article, I would say that the attackers somehow intercepted the WP feeds/notifications (you can see both a dashboard widget saying something AND there is an update notification). The big question is of course: why only in 2.5.1?

Roy

Moderator Samuel Wood (Otto)
(@otto42)

WordPress.org Admin

15 years, 5 months ago

The update notification says 2.6.3, so that may have been legit. I suspect they just replaced the feed thing somehow.

That feed comes from http://planet.wordpress.org/ normally. Dunno how they would have changed it. A malicious plugin or theme could do it, admittedly.