Feeds

Thousands of WordPress sites commandeered by Black Hole

Webmasters, update TimThumb now!

Internet Security Threat Report 2014

Mass attacks that exploit a known vulnerability in the WordPress publishing platform have continued to bear fruit for hackers, with thousands of websites claimed in the past few weeks, a researcher said.

The security bug, in a widely used image resizing utility known as TimThumb, allows attackers to seize control of WordPress websites, one of the victims warned nine weeks ago. A few days later, a security researcher found almost 4,400 WordPress sites had been commandeered in an attack that poisoned Google Image results with sites that attempted to trick users into installing counterfeit antivirus software. He speculated the cause was the same TimThumb exploit.

Although a fix for the TimThumb vulnerability has been available for more than two months, plenty of websites remain vulnerable. According to a research report published by Avast on Monday, thousands of websites have been infected by Black Hole, a hack-by-numbers toolkit available in underground forums for about $1,500 or for free for a scaled-down version. The kit installs an iframe in infected sites that silently redirects visitors to malicious sites.

"The bad guys are using a security vulnerability in non-updated TimThumb," Avast researcher Jan Sirmer wrote. "This allows attackers to upload and execute arbitrary PHP code in the TimThumb cache directory which will download other malicious files."

Avast alone blocked the redirection attempts from 3,500 unique websites in August and 2,515 sites last month, and Sirmer said he expects to see similar results this month. That may be only a small percentage of the total number of infected sites, since Avast is used by a small minority of people browsing the web. Sirmer said attackers may have compromised some of the websites by exploiting weak passwords.

Once a site is infected, it's not always easy to remove all the malicious code. Denis Sinegubko, the Russian researcher who discovered the WordPress attack used to poison Google Image results, has advised webmasters of compromised sites to look for rogue rules in the .htaccess files in the site root and above the site root directory. He has more here. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.