security

Tag Archives: security

10 years ago
by soulseekah
no comments

The FancyBox for WordPress Vulnerability

…and how the exploit really worked

Last week a very popular plugin called FancyBox for WordPress was hit with a zero-day vulnerability which I happened to experience first-hand and dig into. If you’ve not heard about this here are a couple of links to get you up to speed:

The plugin was force-updated (where possible) on WordPress sites out there. This is the full disclosure of how the exploit worked.

Published 10 years ago by soulseekah with no comments tagged security, vulnerability in WordPress

10 years ago
by soulseekah
21 comments

Advertisement Proposal Scam

So a couple of nights ago I got a weird e-mail from “Diana” at dianabem501@gmail.com. It said:

I have visit your blog https://codeseekah.com/
I can pay you $200 per month. Contact me for more info.

Intrigued, decided to respond and see where this scam went. I replied “What for?”…

Published 10 years ago by soulseekah with 21 comments tagged scam, security, vulnerability in PHP

scam security vulnerability PHP

13 years ago
by soulseekah
11 comments

Don’t Post Images of Your Credit Card Online

Yes, people actually do that and an account I’ve been following @NeedADebitCard aggregates credit card photos on Twitter. Not all images are relevant but many are. Credit card fraud is a serious issue as is, with all our connectivity to the World Wide Web and technology that allows us to be “social” that makes many people act irresponsibly, aggravates this.

And some people actually think there’s nothing bad in posting parts of the card. Yet, the same people have no understanding of which parts are safe to display and which are not. General rule – don’t show your credit card at all, especially online for the general public to view. I have wiped out the critical information in my version of the image as to stop the propagation of this nonsense. The cardholder pasted the image in the clear. Size is taken from the original.

This was a recent image shared via Instagram and Twitter. The person’s peers left 20+ “aww”-type comments, and nobody pointed out that it might have been a bad idea. A sane person on Twitter did so, and the cardholder responded with confidence that it was not a problem since not all the information is available. Now, see, what you get when you don’t understand the technology you use every day?

The cardholder’s screenname contained her name, so the missing name on the left side is not missing any more. The first four digits are a BIN, a Bank Identification Number (or IIN, Issuer Identification Number). We know the issuer – Capital One, it’s a MasterCard Platinum. Quick search through the many BIN lists available online yielded the first 6 digits of the card – 517805, with the last two digits to confirm a match, plus upon closer inspection you can see digits two and three of the BIN in black under the silver numbers, a 7 and an 8 (look under the finger on the left).

After pointing out the bits of “concealed” information that I’ve managed to find out in under 5 minutes, the cardholder took down the image.

Quite excellent. Even if say the last 4 digits were somehow concealed, Luhn’s Algorithm would decrease the search space quite a bit, leaving a handful of valid numbers (probably, whoever does the math gets some kudos). We’re missing the CVV, but we have the rest – issue and expiry date, photo of the card, photo of the person, and a whole bunch of other photos of the person online (identity fraud anyone?). And the CVV part is not an issue in many CNP (card-not-present) points of sale.

Is posting images of your credit card online bad? Without doubt. And teach your children to be highly responsible when using modern technology, and think twice, no matter how confident they are.

Be safe.

Published 13 years ago by soulseekah with 11 comments tagged fraud, security, social in General

fraud security social General

13 years ago
by soulseekah
one comment

WordPress 3.4

Codename “Green”, WordPress 3.4 was announced yesterday, boasting flashy features and upgraded functionality.

WordPress 3.4

Lots of hard work involved, lots of excitement and most can’t wait to upgrade, including me. However, as much as I want to update to WordPress 3.4 and enjoy the new stuff, I find it difficult to do so in production right now. I’m sure WordPress 3.4 is fantastic, but it’s too early, there’s bound to be a WordPress 3.4.1 with security fixes (or at least hot fixes) sometime this year.

My suggestion is that unless you have a huge need for one of the new features just wait a bit, see how it behaves out in the wild, how it is targeted. At a little over 200,000 downloads and less than 24 hours out in the wild it’s too early to tell. I’ll personally wait a couple of months before upgrading in production.

Other than that, hurray! Off to play with the new XML-RPC methods.

Published 13 years ago by soulseekah with one comment tagged core, security in WordPress

core security WordPress

13 years ago
by soulseekah
one comment

Timing Attacks in Web Applications

When code is executed by a machine it takes some time to do so. Execution time ranges from nanoseconds to months and years and even more (think bruteforcing). Web applications construct output producing, in most cases, very short delays (think the time it takes to show Google search results after typing in the query). Depending on what output is request, how it is requested and what the input is web applications can vary their execution time.

In this article we’re going to exploit some of the open-source content management systems available using delays in its execution under differing conditions to evoke distinct differences in execution time, which allow us, as attackers, to make some useful conclusions.

Published 13 years ago by soulseekah with one comment tagged exploit, security, vulnerability in General

exploit security vulnerability General

13 years ago
by soulseekah
5 comments

Why the update, WordPress 3.3.2?

WordPress 3.3.2 maintenance release was announced yesterday. The changelog for WordPress 3.3.2 explains some of the changes and the changesets log pretty much displays all the changes done in 3.3.2.

So what the heck happened there in terms of security?

Plupload

WordPress 3.3.1 uses Plupload Version 1.5.1.1 (2011-09-27), with latest Plupload at Version 1.5.4 you can see that much could and must have gone wrong between these two. By checking out the changelog, we find the following entries:

Fix potential vulnerability in dump.php and upload.php (too old)
Flash: Restrict scripting ability to swf’s own domain only
Revive temporary file removal logic in upload.php
and possibly some others

Contents of changesets can be seen here. Not sure what we’re really looking for at this point; the WordPress changeset appears to rely on the Plupload update solely. Neal Poole promises some information it seems, which makes it even more intriguing, could the problem be not (only) in Plupload?

One of the core files in the changeset seems to be capabilities.php and it has not changed… then there’s handlers.js, with up.removeFile(file); added… no other ideas, eagerly waiting for some details.

SWFUpload

Another mystery, why are SWFUpload bugs reported to WordPress? There have been no updates to SWFUpload since September 2011 it seems. So what’s going on here? Can’t tell without decompilation of the SWF itself.

SWFobject

Changeset appears to be limited to encoding the MMredirect Flashvar, possibly related is a year-old Security Issue SDK-22303 revolving around XSS as well as this one. Latest version of SWFobject does not appear to have this change applied to it, last update was in June of 2009.

Limited privilege escalation

As the changeset shows, a non-network administrator in WordPress 3.3.1 can deactivate network-wide plugins. This is of limited use under most circumstances.

make_clickable

The make_clickable function grew in size to account for some edge case where XSS is possible in comment text.

Update: OK, so I updated to 3.3.2 and I’m still getting XSS’d from inside the comments, did I miss the point of it all or hit something else? Latest trunk with Twenty Ten/Eleven also allows script injection in comments. Whaaa…? I need to get some serious sleep, been up for over 30 hours. Enough monkey business for now.

Update: The farthest I got is injecting <a href=" www.two.com/onclick=undefined">www.five.com</a> which produces an error on the page when clicked.

Update 2: A few hours of sleep works like magic. Turns out I was logged in as administrator. That’s how I got to inject JavaScript into comments.

So that’s pretty much why the sudden update besides the couple of fixes that made it with the release. It still doesn’t feel right…

Be on the lookout for the details behind the intriguing SWF updates. Bigups go to Neal Poole, Nathan Partlan, Szymon Gruszeck, Mauro Gentile, Adam Backstrom for the patience to disclose responsibly. Much love to the core and the security teams that make it of utmost importance to keep WordPress users safe. Thank you.

Published 13 years ago by soulseekah with 5 comments tagged core, security in WordPress

core security WordPress

13 years ago
by soulseekah
49 comments

WordPress DoSnet

…or how to build your own WordPress-powered denial-of-service network

Pingbacks have been part of the WordPress since the very beginning. One of my previous articles, titled WordPress Pingback Attacks explores two types of denial-of-service attacks that leverage Pingback request processing in WordPress. If you do not know how Pingbacks work, I suggest taking a quick crash-course here.

One of the attacks is a Layer 7, direct denial-of-service attack, performed by a handful of machines targeted at a single WordPress XML-RPC server with pingbacks enabled. Its purpose is to deplete the server of memory resources by forcing it to download and parse a target URL, which is specifically crafted to heighten resource usage while parsing. Up to 6:1 peak-memory-usage-to-download-size ratios have been reliably reproduced. There’s a bug that allows 5 times as much usage (i.e. 30:1 inflation ratios) when setup properly (WordPress 3.4 will suffer from it as well).

The second attack is a Layer 4 (typically bandwidth-exhaustion), reflected distributed denial-of-service attack which utilizes publicly available WordPress sites on servers of any size and is the subject of this article. Buckle up, off we go.

Published 13 years ago by soulseekah with 49 comments tagged botnet, dos, exploit, security, vulnerability in WordPress

botnet dos exploit security vulnerability WordPress

13 years ago
by soulseekah
21 comments

Why WordPress Authentication Unique Keys and Salts Are Important

…or how to forge authentication cookies in WordPress

If you’ve ever installed or setup WordPress you should have surely seen your wp-config.php file, which contains the necessary configuration directives in order for WordPress to work. One section of the configuration file is dedicated to authentication keys and salts and this article will show you why you should keeps these safe and unique, regenerate these once in a while.

Salt, salt, salt… care to pass me the salt? Don’t! If I know your salt there’s a good chance I’ll be inside your WordPress administration panel within a week. Why? Because WordPress depends on the safety of these salts, once they are compromised the security behind authentication is relatively weak. But how?

Published 13 years ago by soulseekah with 21 comments tagged core, cryptography, security in WordPress

core cryptography security WordPress

13 years ago
by soulseekah
no comments

WordPress Plugin Repository Phishing Scam Spam

A new phishing scam is doing the rounds and it’s targeting WordPress plugin developers. This is a very interesting attack vector, explosively damaging when successful.

Dear WordPress Plugin Developer,

Unfortunately, a plugin you are hosting has been temporarily removed from the WordPress repository. We are going to manually review your plugin because it has been reported for violating our Terms of Service. If your plugin does not get approved then it will be permanently removed from the WordPress repository.

You can check if your plugin has been approved or rejected at

https://wordpress.org/extend/plugins/my-plugin-status/

Very unconventional, not your usual e-mail or PayPal account phishing, it’s WordPress. A little short of 20000 plugins, shared among less authors, so not a lot of victims to play with. The subsequent aim of a phishing attack appears to be the modification of plugins to inject malicious code and get WordPress installations with the plugin infected. People using the plugin would then update and bring the bad code in.

Looks quite difficult to accomplish though; it’s hard enough to get a plugin developer to not notice a fake WordPress.org site, then not smell anything funny going on even if they enter their credentials. Hmmm…

The phishing site is currently disabled (404), looks like the attack has been dismantled quite quickly and efficiently. The link https://wordpress.org/extend/plugins/my-plugin-status/ now leads to a nice plugin by the WordPress team. Well done, WordPress.org for acting quickly and efficiently.

To users of plugins, be aware of sudden updates, review code, contact the authors.

Source: Warning Phishing Attempt @ WordPress.org

Published 13 years ago by soulseekah with no comments tagged phishing, scam, security in WordPress

phishing scam security WordPress

13 years ago
by soulseekah
7 comments

WordPress Pingback Attack

Yesterday I wrote a post titled On WordPress Pingbacks. While writing this I came to several conclusions that resulted in some interesting experiments and results.

I was going to publish my results along with that post, however, I wanted to make sure that the WordPress Security mailinglist had nothing against my publishing such information. With no word from them (I guess I expected too much to be contacted back within 24 hours), I’ve decided to dedicate a whole article to the Pingback attack, its potential, its limitations and further considerations and concerns.

Published 13 years ago by soulseekah with 7 comments tagged pingback, security, vulnerability in WordPress

pingback security vulnerability WordPress

← older posts newer posts → back to top

01100011 01101111 01100100 01100101