WordPress sites getting hacked ‘within seconds’ of TLS certificates being issued | Hacker News Reader

WordPress sites getting hacked ‘within seconds’ of TLS certificates being issued

portswigger.net

91 pointsfeross56 comments

Is anyone on HN doing WordPress administration? I recently 'inherited' a webshop built on WP/WooCommerce, and all the conflicting security advice in the WP space is making my head spin.

There are a dozen competing 'security' plugins, with some saying 'you don't need any of them, WP is secure enough by default', and others saying 'you actually need ModSecurity [1] / Jeff Starr's nG firewall [2] on your server'.

The agency that (shoddily...) built the webshop installed Wordfence Free [3], so I've just kept that for now, though I feel it's kind of slow (but that might just be caused by the bottom-of-barrel performance of the shared webhost it's currently running on).

[1] https://github.com/SpiderLabs/ModSecurity

[2] https://perishablepress.com/7g-firewall/

[3] https://www.wordfence.com/

The blog of WordFence has been quite informative over the years. Many plugins, and even WordPress Core, have had security issues. Some really bad ones get used from a very early stage. So I do think there is some merit in being more on top of it. Updates and backups are also part of your strategy, being hacked and having to comb through the live database for 'eval()' and 'base64()' and other scary stuff is not that great.

The thing about mod_security is that it is server based. If you are on a shared host you have no control over this and every shared host has a different setup. And if you maintain the server, well, mod_security is not that easy to get right and to stay on top of things. Wordfence adds its own weaknesses ofcourse, it is more code that needs to be vetted. But for recognizing an intrusion or hack, it can work quite well I think. (haven't been hacked in years). This thing about server or account based is similar when it comes to caching of generated html pages, Varnish is server wide, a plugin is WP wide.

Thanks, I'll check out the Wordfence blog! I'm definitely trying to stay on top of updates and backups (nobody had been maintaining it before I took over, so the update situation was dire).

Yeah, since the performance on the current host is dire, I've been debating whether to go with another shared host or to just go the VPS route. The company wants to get into Microsoft 365 for e-mail/files, so maybe Azure is another option. I'm okay with spending some time setting things up, but I definitely don't want to have to put a lot of effort into ongoing maintenance.

Not anymore, but I ran an in-house shared hosting environment for Wordpress sites for years. We leased hardware from Rackspace, ran VMs on top, and directly managed WP on the LAMP stack.

The first key to WP application security is to stick to popular plugins and install patches as fast as possible. The vast, vast majority of Wordpress problems involved known vulnerabilities. “Fail secure” was our approach: better to install patches ASAP and then deal with side effects, than to defer too long and risk getting hacked.

The 2nd key is to configure caching and use a CDN partner to soak up load and defend against DDOS. We used DosArrest but I think Cloudflare would be the obvious choice these days.

If you want to be even more secure, don’t let WP write to its own application files except for a few minutes when you’re installing updates. But, this is not standard and therefore a pain to manage.

Or, do what we did and get out of the hosting business. All our WP sites run at WP Engine now and they take care of a ton of performance and security work for us. Still have to stay on top of patches though.

Thanks for the advice.

Yeah, the plugin situation is something I'm trying to get on top of. One of the reasons I feel the site was shoddily built is that it came with two dozen (active and inactive) plugins, half of which are seemingly configured incorrectly. I've got rid of the inactive plugins, but I still need to look into the active plugins and get rid of the unnecessary ones.

Caching is something I've been wanting to look into too. Don't know if I'll go the CDN route right away, but I'll keep it in mind.

Looked at WP Engine pricing and they seem pretty expensive (the company wants to replace a few more of their outdated sites with WP, so I think that would put us in the €110/mo tier). It's a small company and their websites aren't heavily patronized, so performance isn't really critical. The main consideration is not getting pwned.

Depending on the site, ask yourself "How dynamic does it actually have to be?". Perhaps using the GUI to update the content, and then creating static files and serving those may be an option:

* https://wp2static.com

* https://www.wordpress.org/plugins/simply-static/

* https://blog.hubspot.com/website/create-a-static-website-usi...

It baffles me that it comes insecure by default, if that’s what’s happening. How hard can it be for a standard install to come protected with a unique password, user-provided or otherwise?

For at least a decade it baffles me why do people still use WordPress, self-hosted especially (a dedicated team of professional webmasters working 24x7 has at least some chance to manage protecting it). To me that seems suicidal behavior.

Many customers just don't want to spend much money. Wordpress is still one of the big players for small dynamic websites, probably because they have a good range of plugins to integrate with other services.

It really comes down to price and ease of use. If you are non-technical and want a website/blog without going to Wix, Squarespace, etc. WP is the best game in town.

Is there a better CMS? WordPress has a huge plugin ecosystem, a huge developer talent pool, and is relatively straightforward to use. It also costs nothing, which is important for overseas developers, and can be extremely cheap to host.

It also (can be) very easy to use. Plugins and theme bundles can make this more complex, but it's easy enough to hand a properly secured and deployed WordPress to a marketing or media team and have them do 90% of the work, which is a win for dev and ops teams.

Are the developers really that talented? The only interesting news I see about WordPress is the latest vulnerability being exploited.

WordPress is huge, it represents a big chunk of the web. I've read from a quarter to a third, or even more. It's a good target. Of course we are going to hear about security vulnerabilities more for WordPress than for any other CMS.

There is nothing specific to WordPress about the issue this post relates IIUC apart from the fact it is a privileged target.

And there's no news when everything is fine, which is most of the time.

Your estimate is low: it's actually 43%.

https://w3techs.com/technologies/overview/content_management

This aligns with the numbers we had when I worked at a large webhosting company.

You can say basically the same about any popular system. Chrome, Windows, iOS all have regular vulnerabilities. Maybe the difference is that they have very strong forced patching, whereas there are enough WordPress installs that don't get critical patches for far too long.

In all measures, Windows is a dumpster fire. Usability, security, stability, etc. So what is your argument here? That Wordpress is at least as bad as a popular OS?

I don't know enough about iOS to comment.

My point is that all popular software is a security nightmare because our industry sucks at security. Anything that is a high value attack target gets pwned.

Very little software appears to be actually secure. Maybe OpenSSH is on that short list, but even that has occasional problems. But for it's attack value the known vulnerabilities seem low.

It was the plugin ecosystem that got my website hacked. A plugin that I'd briefly installed to test, thought I had removed, but was somehow still there on disk.

I no longer use it actively but CraftCMS was good to me for several years: https://craftcms.com/

Well if your budget is nothing, and you have the technical skills of a rock, wordpress doesn't seems like the worst option

the cost of getting your wordpress hacked for seo spam is not much for a business that don't have any sensitive data on wordpress(not that they even take it into account...)

I’ve run it for 10+ years without any problems of note. Nothing massive, but a few thousand monthly users.

It auto installs through cpanel and has always had an admin password.

It’s actually really easy for non-professional webmasters to self host and saving $10-???/month on hosting fees is nice.

Its not that bad. WordPress is great for people who don't know how to code and just want to make a website, yes if you just want a blog you can do that with Hugo(but you need to know git and CI/CD and pages hosting etc..) But anything more advanced would be best on WordPress, its very easy to use and is extremely popular so you can find guides anywhere.

There is yet to be any CMS which has the ease of use and capability of WordPress and its plugins.

Unfortunately with it being that easy users are often not very security savvy and don't update plugins/themes and end up getting hacked.

Well, it's easy to use for users, it maintains itself for the most part and doesn't break compatibility. It is also easy to setup. And to customize. It provides many tools out of the box, including though you would not think. An example that surprised me is the automatic addition of lazy loading for images at some point when browsers started supporting it natively without any intervention from me, which is very good.

With a caching plugin it's as fast as a static website most of the time, which gets me 100% on Page Speed Insight, and the hosting is on a domestic connection. I've made sure to not use too many extensions and javascript-heavy things, to disable some stuff and avoid huge assets but I've not spent that much effort on it.

I've been maintaining a few WordPress websites since 2015 and I would chose WordPress again today for any new site on which non technical people must intervene (to write or manage content). It just works and is user friendly.

I'm not sure any CMS would save you if you don't do your security homework though.

It's feature-rich and has a huge ecosystem of plugins and developers.

This specific vuln is related to the fact that every install uses /wp-admin/install.php for initial setup. You don't need a "dedicated team" to protect yourself from that.

I recall coming across some sites over the years where the site was just setup and someone uploaded a Wordpress install onto their server. I was able to go through the wizard and install a new Wordpress, adding credentials, giving it a name etc. It was a lulzy thing to do but I wouldn't do it again. Back in the day you got very bored.

If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it.

> If I was setting up my own Wordpress

> I would go through the wizard as quickly as possible

You might not be quicker than a bot.

I don't understand ehy you would set up an in development website period as publically accessible until you had it locked down. That just seems like a poor idea.

I agree, Step 1 for me has always been to add a rule to the firewall to block all connections except from my IP while I work on it.

Same here. It is trivial to keep it on a private network or behind an SSH tunnel or a SOCKS proxy or _anything_ that limits access to just yourself until it is actually ready for random visitors.

Many Wordpress sites are not set up by developers or technical people. A significant number of them are set up by marketing teams just spinning them up in a cPANEL or GoDaddy or something.

because their IT group "would just slow us down"

IIUC those tools would usually prompt you for a username and password as part of the installation procedure, so your installation would be secure right off the bat.

That is literally the opposite of an excuse. cPanel, and any other hosting provider, has all of the tools needed to implement this correctly. The user wouldn’t even have to leave the browser.

If you're unfamiliar with the nuances of good development practices or basic security, this is an obvious thing to do. It lets you iterate and work on it until you're ready.

It doesn't even occur to a lot of people that this might be a bad idea. Salespeople, marketing, a sole prop, or someone who wants to set up a blog are all people who would have absolutely no idea how to do this right... and no clue that they're doing it wrong.

Ok sure, but these are also somehow people who are requesting and installing TLS certs?

I’m just flummoxed trying to imagine a person who can install and run certbot, but doesn’t know how to (or think to) configure locally, or even set a basic HTTP password on the site until WP is configured.

Yes, because that's the sort of thing that's easily automated and can be done for you by a setup script. Or by following a stepwise tutorial.

People don't have to understand what they're doing to use a tool. Sometimes, like this time, there can be drawbacks to this.

> If I was setting up my own Wordpress I would go through the wizard as quickly as possible to stop others setting it up before me and doing malicious things with it.

Do it offline, or on a private subnet, or whitelist your IP, or well anything you can to keep the world away from your install until you have it setup. Or, if possible, don't install WordPress.

Ideally add basic authentication to the entire VirtualHost beforehand.

TLDR: When you add a CA certificate, you're announcing to the world "hey look at me, I'm probably a new site, with probably not a lot of security practices covered" and if you use WordPress, you could be victim of automated attacks.

In defence of WP this could happen to any CMS, but wp it's the most popular by far

Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers.

Passive DNS is the product e.g. https://www.circl.lu/services/passive-dns/

https://www.farsightsecurity.com/technical/passive-dns/passi...

https://www.anomali.com/blog/introduction-to-passive-dns-usa...

Unsurprisingly lots of outfits want to publicly advertise this as a white hat feature you can purchase from them, but it's just technology, it works fine for bad guys too.

> Note that you're also announcing to the world "Hey look at me, I'm probably a new site" when you publish DNS records and then anybody looks at them via most public DNS resolvers.

"Publish DNS records" does not exist. There is no sort of "firehose" where anyone can subscribe to a feed of newly registered domains.

companies running most zonefiles let you buy it, as well as various statistics

Access to zone files is relatively restricted (you have to give the registry a good reason you need the data), and is a daily report, not a real-time feed.

I run the prepend.com domain. I don’t think there’s any way for you, or anyone without admin access to my dns server, to know when I add a CNAME record for tialaramex.prepend.com.

I guess someone could continuously request every possible entry over and over to see when I do that, but don’t think it’s likely.

Passive DNS doesn't request every possible entry.

What happens is that when say, somebody uses their AT&T phone to ask A? tialaramex.prepend.com the AT&T DNS servers tell them that's 10.20.30.40 and the AT&T DNS servers tell a passive DNS outfit, "At 18:26 UTC the answer to A? tialaramex.prepend.com was apparently 10.20.30.40"

Now, I'm sure that lots of HN readers have a local manually configured DNS resolver that of course isn't feeding passive DNS. And some of them might even have an upstream DNS resolver which is bootstrapped and that too does not feed passive DNS. It's not even difficult if you were insistent upon doing it.

But, the design guy's iPhone which he used to take a quick screenshot? Probably just uses a public DNS resolver. The woman who trains front line support and asked for a sneak peak ready to start training on the new site? She probably has 8.8.8.8 set as her DNS resolver.

So just like asking for the publicly trusted certificate, this is another way that your DNS names go from "Nobody would guess what that is" to public knowledge in seconds once they leave your hands.

The Wordpress project people have more often than not prioritized "ease" over security. This is no different.

Should there obviously be a unique, temporary password encoded in the wp-config.php that prevents this? Of course. Would it diminish "ease"? Yes, and therefore it won't happen.

They're deathly afraid of making anything more difficult to the lowest common denominator, and, by extension, the scammers of the world.

Free automatic TLS is now the noob standard.

Do any of those automatic cert bots support "not_before" dates in the past, or pre-ordering and delayed rotation of certs?

Q. what do people think of using a (correctly) self-signed cert for Wordpress self-hosting, in 2022.. ? (hosted in the USA if that matters)

Don't do it if you want people other than yourself visiting the blog.

Visitors, including yourself, will get browser warnings and will have to explicitly bypass the scary prompts to go ahead and trust the self-signed certificate. Many visitors may not even figure it out with the state of the warning messages now.

For a site that’s on the Internet, it should be a lot easier to get a free certificate from LetsEncrypt and also have it renew frequently (automated).

Totally fine to use during development. We did that a bunch of times before Let’s Encrypt.

But in production, your visitors will likely be scared off by the browser warning on a self-signed cert.

Fun story. I helped someone with a wordpress site recently where I provided an internal address for development. Once they were done with development I moved the site to the public url and found that most of the pages were broken.

Turns out multiple plugins make changing URLs a feature behind a monthly paywall as a monetization strategy. The sobering thing is that the fix is to update tables in the database. There are various examples in github for these things, however most people just use a plugin that literally does a find and replace for the old URI and replaces with the new. Frightening...

Yes, that’s a thing with Wordpress. Any change to the URL requires some sort of migration to the new URL, as they are statically added to pages. This was done to avoid the performance hit of dynamically generating the late every time. Wordpress has been around a long time, and that decision probably did have a performance improvement at the time. Theoretically it’s not really that bad, as URLs are defined as unique, so doing a migration shouldn’t be a big deal. But conceptually it just seems “incorrect”.

is this still an issue if you use wordpress.com to host?

No. wordpress.com takes care of security updates.

Reply on news.ycombinator.com