Thousands of WordPress sites sucked into BlackHole

Powered by SC Magazine
 

Exploits aging TimThumb vulnerability.

Researchers have discovered a spike in malware infecting thousands of WordPress web sites that use a popular image tool.

The attacks came to light after French media outlet the Poitou-Charentes Journal began hosting on malware on its WordPress site.

Avast senior researcher Jan Sirmer found attackers had exploited weak FTP server authentication credentials and a vulnerability in the TimThumb image resizer to upload malicious PHP files to the site.

The attack used the BlackHole exploit kit which redirected the web site's visitors to an external malware-hosting site.

An additional 3500 unique infected Word Press sites were detected by Avast redirecting visitors to malicious sites between August 28 – 31. During September it blocked redirects from 2515 WordPress sites, Sirmer said.

In total, some 151,000 users had been hit with the malicious redirect from other compromised WordPress sites.

"I expect October results will be similar,” Sirmer said.

“The Poitou-Charentes Journal is just one part of a much bigger attack. These compromised sites are part of a network which redirected vulnerable users to sites distributing an array of malware.”

The vulnerability in the TimThumb resizer identified in August exists in the way the tool fetches images from websites like Flickr and Photobucket.

The utility runs only a partial check on hostnames meaning hackers could upload and execute arbitrary php code in the .php cache directory.

Sirmer recommended WordPress sites employ strong login credentials. A fix was available for the TimThumb tool.

Copyright © SC Magazine, Australia


Thousands of WordPress sites sucked into BlackHole
 
 
 
Top Stories
Toll Group to go Google
Poaches Woolworths project manager.
 
How News Corp's CIO tackled skills in his race to the cloud
What to do when your team’s talents are no longer needed.
 
Photos: How Thodey transformed Telstra
From turbulent Trujillo to Australia's leading telco.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  35%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 3966

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 1353

Vote