Hacker News Reader

Hacker News

Comment by nissehulth | Hacker News Reader

Full thread

nissehulth

This "breach" happened a year ago and all sources indicate that it was an inside job.

Seeing Wordfence using this to promote their product does not create much confidence.

View on HN

Wordfence ceo here. All sources? Did you read the forbes article we link to?

Edit: One of the partners confirmed it's a hack. http://www.bbc.com/news/world-latin-america-35975503

Right, let me rephrase that. "All reliable sources indicate that it was an inside job".

Cite yours please.

Is this speculative forensics or an absolute? Does the fact that they have an outdated plugin mean the leak was siphoned by that?

Im genuinely curious

We're just reporting what we know at this point and what we think is likely. What we know is that their web server had access to _client data_ (the client portal). Two websites had vulnerabilities - both the WP site and the Drupal site. And it is _client data_ that was exfiltrated.

So in my opinion it's highly likely that the client data was taken via either a Drupal or WP attack vector. Even if this beach didn't happen, the client data eventually would have been stolen via one of these vectors. There are thousands of bot scripts that are exploiting revslider every day and so it's inevitable the site would have been hacked repeatedly and someone would have noticed a 2.6TB database that the web server had permission to access.

To illustrate: I've seen scripts running in real-time coming into a honeypot that run 'show databases;' and then dump everything to a .sql file in a public web directory and hit that URL to download. An attacker might have gotten a partial dump and then gone OMG and gone back for seconds... and thirds, and fourths...

I think the use of "reporting" is a stretch.. you're speculating and twisting information in your favor.

You're right, data was exfiltrated... Do we know if the portal was on the same server as the website? You seem to be making that connection, but that hasn't been illustrated.

So if you're opinion is that it was either a Drupal or WordPress attack vector, why not highlight that in your article or subsequent email? Based on your email, you imply it was WordPress but fail to make this point...

OK "truthfinder007" whose account was created 2 hours ago and has karma of 2. I think I've had about enough of what's going on here. Tell your boss I say hi and that he owes me a beer at the next wordcamp. ;-)

Edit: And then I looked at your comment history. Seriously? http://i.imgur.com/HBqJ8vV.png

Okay Wordfence CEO.

How the hell does your product prevent SQL injection attacks on a payment processor outside of the Wordpress ecosystem??? ( http://www.theregister.co.uk/2016/04/11/hackers_pwn_mossack_... )

You guys are a joke.

I dunno if this promotes their product all that much. It does highlight some major issues with out of date plugins and WP installs though.

Well, that may be worth saying again and again, though those who need to understand it are probably not reading anything security related anyway.

Yup, sounds like press-release marketing. A terabyte+ of crown jewel dbs doesn't sprout legs, even from an APT.

Reply on news.ycombinator.com