WordPress Site Hacks Continue

70% of WordPress sites are running outdated software and are vulnerable to hackers launching DDoS attacks. Recent examples hit MIT, NEA and Penn State servers.

WordPress installations sporting known vulnerabilities continue to be compromised by hackers and turned into distributed denial of service (DDoS) launch pads.
That warning was sounded last week after IT professional Steven Veldkamp
shared an intrusion prevention system (IPS) log
with
Hacker News
, which found that a single 26-second DDoS attack against a site run by Veldkamp was launched from 569 different WordPress blogs. Those blogs appear to have been compromised by attackers, since they comprised everything from a
mercury science and policy blog
at the Massachusetts Institute of Technology (which as of press time remained offline) and a National Endowment for the Arts blog to WordPress sites run by Pennsylvania State University and Stevens Institute of Technology.
The key aspect to note here is the number of compromised WordPress servers, said Stephen Gates, chief security evangelist at DDoS defense firm Corero Network Security, via email. Its a simple mathematical equation -- attackers are looking to infect servers sitting in hosting environments with each server easily capable of generating 1 Gbps of attack traffic. It is quite easy to generate extremely high volumes and varieties of attack traffic by compromising just a few WordPress servers.
Once WordPress servers get compromised, attackers can use them for a variety of purposes, such as
attacking U.S. financial institutions
. From volumetric attacks that melt down firewalls to the low and slow attacks that sneak through firewalls undetected -- the list is really endless, Gates said.
[ Could crowdsourcing lead to a better security solution? Read
Project Sonar Crowdsources A Better Bug Killer
. ]
WordPress blogs, of course, are easy to provision and host. But that ease of installation -- and use -- means that such software is often run outside the purview of IT provisioning and oversight. Furthermore, many WordPress administrators fail to keep their software updated or follow security best practices, such as
choosing unique usernames
and strong passwords for WordPress admin accounts. As a result, numerous WordPress sites sporting known vulnerabilities -- or admin as the admin account name -- remain sitting ducks for automated attacks.
Indeed, malware is often used to automatically find and exploit vulnerable WordPress installations. In August, Matthew Bing, an Arbor Security Engineering & Response Team (ASERT) research analyst, noted that the Fort Disco malware -- first discovered in April 2013 -- was being used to target known vulnerabilities in content management systems, backed by six command-and-control servers that were running a botnet comprised of more than 25,000 Windows PCs. To date, over 6,000 Joomla, WordPress and Datalife Engine installations have been the victims of password guessing, he said in a
blog post
.
How widespread is the problem of exploitable WordPress software? According to a study conducted by EnableSecurity CEO Sandro Gauci, the list of the one million most trafficked websites -- per the
Alexa index
-- includes 40,000 WordPress sites. But 70% of those sites are running a version of WordPress with known vulnerabilities.
Those statistics were relayed last week by WordPress security expert Robert Abela, who studied data that EnableSecuritys Gauci compiled over a four-day period in the middle of September, immediately following the September 11 release of WordPress 3.6.1, which remains the latest version.
In a
blog post
, Abela reported that of the 42,106 WordPress sites from the Alexa index identified, 19% had already been updated to the new version, while 31% of sites were still running the previous version (3.6). But the remaining 51% of cataloged WordPress sites ran one of 72 other versions, with 2% of all cataloged sites still running version 2.x, which
dates from 2007
and earlier.
Needless to say, many historical WordPress updates have included patches for exploitable vulnerabilities. For example, the latest version of WordPress -- 3.6.1 -- patched a known vulnerability in version 3.6 that would have allowed an attacker to
remotely execute code
. Previous versions of WordPress have also sported a number of known bugs, including version 3.5.1 (8 vulnerabilities), 3.4.2 (12 vulnerabilities) and 3.3.1 (24 vulnerabilities).
All of this adds up to numerous WordPress sites that can be relatively easily hacked, based on a review of the top 10 most-seen versions of WordPress seen among the more than 40,000 counted by Gauci. At least 30,823 WordPress websites out of 42,106 are vulnerable to exploitable vulnerabilities, said Abela. This means that 73.2% of the most popular WordPress installations are vulnerable to vulnerabilities which can be detected using free automated tools. Considering the number of vulnerable WordPress installations out there, and the popularity of such websites, we are still surprised ... most of them havent been hacked yet.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
WordPress Site Hacks Continue