Wordpress Hackers Find Fresh WordPress Sites Within 30 Minutes

Gavin · Aug 1, 2017

Hackers Find Fresh WordPress Sites Within 30 Minutes

Interesting...the summary taken from the article:

The sequence of events would go something like this:

You order a new website hosting package from a hosting provider. Your order includes a free or paid SSL certificate for your domain.

The SSL certificate is issued once your order completes.

30 minutes later, attackers see your fresh website listed in the certificate transparency report.

At that time – 30 minutes later – you are halfway through completing your website setup and are just beginning to install WordPress.

An attacker is constantly monitoring your new domain, and as soon as they see the setup script, they run it, install a back door and then reset your site to the state it was in so that you don’t notice.

Click to expand...

eva2000 · Aug 1, 2017

yikes scary - that's why wordpress security in centmin.sh menu option 22 is done at nginx vhost and wordpress install time i.e. wpsecure and autoprotect.sh include files Wordpress - Wordpress 403 Permission Denied Errors. Also as centmin.sh menu option 22 auto configures and sets up wp-config.php, it renders access to /wp-admin/setup-config.php useless.

Also centmin.sh menu option 22, in 123.09beta01 by default password protects wp-login.php and thus wp-admin access though you can opt to disable password protection. In 123.08stable there is no choice, wp-login.php is always password protected.
Code (Text):
Disable Auto Generated WP Admin Username / Password ? [y/n]: n
Disable wp-login.php password protection ? (less security) [y/n]: n
The WPSetup Attack: New Campaign Targets Fresh WordPress Installs

Recommendations for Server Administrators and Hosting Providers
If you operate a server or a network of servers that provides WordPress hosting to customers, we recommend the following to mitigate this attack:

Scan your hosting accounts for WordPress installations that do not have a wp-config.php. These may be fresh installations that have not yet completed setup. If navigating to the base URL of the site redirects you to /wp-admin/setup-config.php then you have confirmation that setup is incomplete. We suggest you alert your customer they should either complete setup or remove the files.

If you have an IDS (intrusion detection system), you should consider monitoring traffic from your web servers to the open Internet for any MySQL traffic. This may indicate an attacker has configured a WordPress site on your network using their own database on the Internet.

If you have any other mechanisms in place to monitor or prevent connections from your web servers to arbitrary databases on the open Internet, we recommend you use those to mitigate this attack.
Click to expand...

Log in / Register

Forums

Discover Centmin Mod today

Wordpress Hackers Find Fresh WordPress Sites Within 30 Minutes

Gavin New Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Discover Centmin Mod today

Wordpress Hackers Find Fresh WordPress Sites Within 30 Minutes

Gavin New Member

eva2000 Administrator Staff Member

.