#wordpress 2020-10-24

2020-10-24 UTC
[tantek], [KevinMarks], [chrisbergr], nickodd, [fluffy], [chrisaldrich], [capjamesg] and jeremycherfas joined the channel
#
beko GWG++ awesome, thank you :)
#
Loqi GWG has 35 karma in this channel over the last year (144 in all channels)
nickodd and [snarfed] joined the channel
#
[snarfed] evidently my web site got broken into. 😐 looks like they didn’t get too far, but still. anyone familiar with wordpress forensics and clean-up post-compromise?
#
GWG [snarfed]: Not specifically, do you back up so you could roll back?
#
GWG How bad is it?
#
[snarfed] oh yeah i have full db backups, not worried about losing content
#
[snarfed] they didn’t get far enough to change content anyway
#
[snarfed] it’s more that i don’t know where the vulnerability was, so i can’t just put the site back up as it was until i find and fix the hole
#
GWG [snarfed]: Likely a plugin
#
GWG First step is always assessing your least updated ones
#
[snarfed] afaik they were all up to date
#
GWG [snarfed]: Would you feel comfortable sharing a list?
#
sknebel guess question is if any got patched for vulns in the meantime?
#
GWG Or if any got abandoned
#
[snarfed] i have the full HTTP request logs from the IP that broke in. the first POST requests were to `wp-admin/admin-ajax.php`, so that’s not too helpful
#
GWG If you want me to look at the log piece and the plugin list, I can try to see if anything comes up.
#
[snarfed] thank you! will do
#
[snarfed] https://snarfed.org/logs.txt , https://snarfed.org/plugins.txt
#
[snarfed] updated logs.txt ^ just now with the event notifs from Sucuri that tipped me off
#
[snarfed] site is safe for now, wordpress is entirely disabled, it’s serving only from static file cache. gotta run for now, but thank you for looking GWG! i’ll be back in a bit
#
GWG The moment they seem to get admin access seems to coincide with the ajax call. So, something has a vulnerability there
#
GWG The two places that could be would be something in a plugin, or something embedded in a theme
#
GWG Themes could include libraries with compromising dependencies, but themes are more likely.
#
GWG Disable Check Comment Flood is 8 years old. But not much has changed there
#
GWG NoIndex NoFollow All Posts is 4 years old.
#
GWG The OpenID plugin is 2 years old, but pfefferle commented in the support for it about 5 months ago that he still uses it
#
GWG Press This is effectively abandoned
#
GWG So nothing obvious
#
GWG Ryu Theme hasn't been updated in over two years.
#
GWG In all cases, no reports of anything
[chrisaldrich] and [chrisbergr] joined the channel; nickodd left the channel
#
[chrisbergr] [snarfed] I'm sure your security plugin would have already triggered the alarm, but just to be on the safe side, search all your files for the occurrence 'api.telegram.org'. I have experienced problems with that on many WP installations in the last weeks.
[pfefferle] joined the channel
#
[pfefferle] [snarfed] what wp Version?
[snarfed] joined the channel
#
[snarfed] [chrisbergr] thanks! will do
#
[snarfed] [pfefferle] 5.5.1 😐
#
[snarfed] and thank you for the investigation GWG! definitely helpful
#
[snarfed] updated https://snarfed.org/logs.txt to include a diff of wordpress files between mine and stock 5.5.1, at the bottom
#
[snarfed] also, one key piece of perspective on compromises like this, from https://www.quantable.com/architecture/wordpress-hack-cleanup-guide/ :
#
[snarfed] > I find it helpful to remind myself that the site I’m working on was probably hacked as a part of an automated process. Unless you’re running a really big site or are particularly unlucky, the hackers who messed up your site came across it as a result of scanning thousands and thousands of sites for a particular attack method.
#
[snarfed] …ie, it’s almost never personal or targeted.
#
[snarfed] > Also, while the malicious code is frequently very clever, it’s also frequently very sloppy, and rarely tailored to any particular site. So when you’re scratching your head asking yourself, “what were they thinking??” — remember that the answer is that they weren’t really thinking about your site at all in particular.
#
[chrisbergr] Yes, I mean look at the access logs, how many times 'someone' tries to login to the wp-admin... On the first sight this seems like a pretty good guide, I'll bookmark this and see if I can get something out of it for myself, later.
#
GWG That's why I always have trouble reading logs
astralbijection joined the channel