Re: [bitfolk] Security incident: Wordpress install compromised and turned into redirect to porn site
6 Mar
2013
6 Mar
'13
9:45 a.m.
On Tue, Mar 5, 2013 at 8:25 PM, Andy Smith <andy(a)bitfolk.com> wrote:
On Tue, Mar 05, 2013 at 07:23:46PM +0000, Andy Smith
wrote:
Do we know which version of WordPress was compromised?
And that it was definitely WordPress not another service?
RewriteRule ^(.*) http:// crzyluxtds
in/go.php?sid=1 [L,R=302]
Quite a few people rejected this email, probably because of the
above URL (now obfuscated as I should have done before). If you did,
you can find the original in the archives:
http://lists.bitfolk.com/lurker/message/20130305.192346.4455264a.en.html 
6 Mar
6 Mar
10:05 a.m.
New subject: Security incident: Wordpress install compromised and turned into redirect to porn site
Hello,
On Wed, Mar 06, 2013 at 09:45:27AM +0000, Adam Spiers wrote:
Do we know which version of WordPress was
compromised?
And that it was definitely WordPress not another service?
No; if the customer has no interest in investigating then
unfortunately I can't usually spare the time to do it for them,
beyond the basics needed to resolve the abuse report.
I would find it unusual for an attacker to compromise some other web
app but then decide to put their .htaccess and other files in a
Wordpress that coincidentally happened to be on the same server,
though. These things tend to be straightforward.
I did a quick web search for that .htaccess content and found a few
other people reporting finding it, but with no details as to how it
was put there.
I suspect that it is unrelated to the actual compromise, being more
of a "this is something you can put in someone's web site to turn it
into a stealthy porn redirector" tool, so yes maybe the actual
compromise is not in Wordpress.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
2:16 p.m.
New subject: Security incident: Wordpress install compromised and turned into redirect to porn site
On 06/03/13 10:05, Andy Smith wrote:
I suspect that it is unrelated to the actual
compromise, being more
of a "this is something you can put in someone's web site to turn it
into a stealthy porn redirector" tool, so yes maybe the actual
compromise is not in Wordpress.
This does beg the question, how can you be happy that your machine isn't
still compromised.
Haven't looked into what people use these days for IDS but I probably
should.
n
2:41 p.m.
New subject: Security incident: Wordpress install compromised and turned into redirect to porn site
Hi,
This does beg the question, how can you be happy that
your machine isn't
still compromised.
Who's machine? AIUI, the compromised machine was reinitialised.
Haven't looked into what people use these days for
IDS but I probably
should.
This:
http://www.ranum.com/security/computer_security/papers/ai/index.html
Regards,
@ndy
--
andyjpb(a)ashurst.eu.org
http://www.ashurst.eu.org/
0x7EBA75FF
2:48 p.m.
New subject: Security incident: Wordpress install compromised and turned into redirect to porn site
Hello,
On Wed, Mar 06, 2013 at 02:41:45PM +0000, Andy Bennett wrote:
In this case the customer (just) removed Wordpress.
I think it is highly likely that Wordpress was the source of the
compromise, and that the compromise extended no further than writing
some content into Wordpress's wp-content directories, but if it were
my host then I would be wanting to confirm that, indeed.
Unfortunately I can't justify keeping a paying customer's service
disabled once they have removed the thing that the abuse reports
were about.
Cheers,
Andy
--
http://bitfolk.com/ -- No-nonsense VPS hosting
This does beg
the question, how can you be happy that your machine isn't
still compromised.
Who's machine? AIUI, the compromised machine was reinitialised. 
7:56 p.m.
New subject: Security incident: Wordpress install compromised and turned into redirect to porn site
On Wed, Mar 06, 2013 at 10:05:30AM +0000, Andy Smith wrote:
Hello,
On Wed, Mar 06, 2013 at 09:45:27AM +0000, Adam Spiers wrote:
Oh you'd be surprised. At DreamHost we would get people who had an old
version of $software installed somewhere else on their account and it
would go and infect as much as it could.
Do we know which version of WordPress was
compromised?
And that it was definitely WordPress not another service?
No; if the customer has no interest in investigating then
unfortunately I can't usually spare the time to do it for them,
beyond the basics needed to resolve the abuse report.
I would find it unusual for an attacker to compromise some other web
app but then decide to put their .htaccess and other files in a
Wordpress that coincidentally happened to be on the same server,
though. These things tend to be straightforward. I suspect that it is unrelated to the actual
compromise, being more
of a "this is something you can put in someone's web site to turn it
into a stealthy porn redirector" tool, so yes maybe the actual
compromise is not in Wordpress.
Agreed.
-Jeremy
8 p.m.
New subject: Security incident: Wordpress install compromised and turned into redirect to porn site
On Wed, Mar 06, 2013 at 11:56:27AM -0800, Jeremy Kitchen wrote:
On Wed, Mar 06, 2013 at 10:05:30AM +0000, Andy Smith
wrote:
And I forgot to mention that this is a great case for separating your
sites onto different users, not running them all under the same user.
Compartmentalize and you limit the damage an attacker can do if they
compromise one of your sites.
-Jeremy
I would find it unusual for an attacker to
compromise some other web
app but then decide to put their .htaccess and other files in a
Wordpress that coincidentally happened to be on the same server,
though. These things tend to be straightforward.
Oh you'd be surprised. At DreamHost we would get people who had an old
version of $software installed somewhere else on their account and it
would go and infect as much as it could.
4075
days inactive
4075
days old
6 comments
5 participants
participants (5)
-
Adam Spiers -
Andy Bennett -
Andy Smith -
Jeremy Kitchen -
Nigel Rantor