Exploit code implanted into blog software

Powered by SC Magazine
 

Attackers break into server and inject malware into software update.

Attackers have injected exploit code into the downloadable software for the WordPress blogging service.

The company has issued an update that repairs the vulnerability.

The open source Wordpress software allows users to set up and push out postings to a blog. Although online bloggin services such as Blogger.com, Typepad or Wordpress.com allow users to publish blog postings directly from a browser windows, client software offers users more flexibility.

Hackers early last week broke into Wordpress' download server and embedded their attack code into the 2.1.1 update of the open source application. The malware opened up a backdoor on infected systems that would allow an attacker to execute code and install software.

WordPress founding developer Matthew Mullenweg on a company blog said that the infected software was offered to users for 3-4 days as an official WordPress download before the company was alerted of the breach.

"This is the kind of thing you pray never happens," said Mullenweg.

"But it did and now we’re dealing with it as best we can."

Security vendor Symantec claimed that it had notified fewer than 50 attacks exploiting the backdoor. The firm rated the threat as "low-level" beacuse of its limited reach and easy removal.

WordPress said that though not all downloads of version 2.1.1 were affected, the company is recommending that all users upgrade to version 2.1.2 of the software. WordPress also recommends that administrators hosting WordPress blogs prevent access to the "theme.php" and "feed.php" files that are infected by the attack.

Copyright ©v3.co.uk


Exploit code implanted into blog software
 
 
 
Top Stories
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
A call for timely reporting
[Blog post] Businesses need incentives to keep customer data secure.
 
Doubts cast on Queensland's ICT Dashboard
Opposition, former Govt CIO say it can't be trusted.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  26%
 
Application integration concerns
  3%
 
Security and compliance concerns
  29%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  22%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 859

Vote