Hacked Reuters blog appears still unpatched

Powered by SC Magazine
 

Site still running a vulnerable version of Wordpress.

News service Reuters appears to still be running the same outdated version of WordPress that allowed its blogging platform to be compromised by attackers last week.

Attackers published fake blog posts on Friday, including a purported interview with the leader of the Free Syrian Army.

Mark Jaquith, one of the lead developers behind WordPress, told The Wall Street Journal that  Reuters had been running version 3.1.1 instead of the latest version, 3.4.1. There are at least 20 reported vulnerabilities in version 3.1.1.

While blogs.reuters.com was taken offline shortly after the attack, the site is again operational. But it may be still running a vulnerable version.

Following a tweet Tuesday by security blogger Brian Krebs, SC analysed the HTML source code on the Reuters blog site and found a line in the header section indicating the page was generated using WordPress version 3.1.1.

WordPress developers have implemented update notifications and a self-updating feature to help users stay in line with the latest security patches.

Considering how easy it is to update the core WordPress installation, the fact that Reuters came back online with outdated software is surprising.

The company did not respond to a request for comment.

"Updating the software you use is a basic step in improving your security posture, yet too often we see evidence of a lack of execution in this area," Rapid7 security researcher Marcus Carey said.

Attackers originally broke into the blog platform and published fake news stories on Friday.

One of the fake stories that had been published on the blog platform was an alleged interview with Riad Al-Assad claiming the Free Syria Army was withdrawing from Aleppo, the nation's largest city and a key battleground in the fight between rebels and regime forces.

A follow-up attack came on Sunday, when attackers took control of the @ReutersTECH Twitter account and posted 22 different messages, such as reports of a rebel exodus from Aleppo and claims that the United States was providing financial and technical support to Al-Qaeda operatives in Syria.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


Hacked Reuters blog appears still unpatched
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 440

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 211

Vote