Get Paid to Participate - up to $1 per post!     Twitter     Facebook     Google+
Hosting Discussion
 

forgot password?



Reply


Old
  Post #1 (permalink)   08-29-2012, 02:11 AM
HD Community Advisor
 
SenseiSteve's Avatar
 
Join Date: Mar 2009
Location: Saint Louis
Posts: 4,975
Send a message via MSN to SenseiSteve

Status: SenseiSteve is offline
Just saw where Reuters was exploited.

Curious what recommendations you make to your clients to shore up security on their WordPress sites?
__________________
ProlimeHost- Dedicated Server Hosting & KVM SSD VPS
Three Datacenter Locations: Los Angeles, Denver & Singapore
SuperMicro Hardware | Multiple Bandwidth Providers | 24/7 On Site Engineers
 
 
 


Old
  Post #2 (permalink)   08-29-2012, 05:22 AM
HD Master
 
Join Date: Dec 2011
Location: Florida
Posts: 274
Send a message via Skype™ to SolidShellSecur

Status: SolidShellSecur is offline
Must have missed that article. Did they say how they got hit?
__________________
SolidShellSecurity.com. Providing Quality Support, Secure Hosting and Amazing Services.
STAY ALERT! Sign up for our security mailing list and always know when threats come out.
 
 
 


Old
  Post #3 (permalink)   08-29-2012, 05:27 AM
HD Community Advisor
 
SenseiSteve's Avatar
 
Join Date: Mar 2009
Location: Saint Louis
Posts: 4,975
Send a message via MSN to SenseiSteve

Status: SenseiSteve is offline
From pcmag.com -

Quote:
Reuters reporters use blogging platform WordPress to write and upload stories to the website, though the trouble could stem from the software version the company uses. Mark Jaquith, a member of the WordPress security team, told the Wall Street Journal earlier this month that Reuters was using version 3.1.1, instead of the more current 3.4.1 version, which has been updated to fix holes in its security system.
__________________
ProlimeHost- Dedicated Server Hosting & KVM SSD VPS
Three Datacenter Locations: Los Angeles, Denver & Singapore
SuperMicro Hardware | Multiple Bandwidth Providers | 24/7 On Site Engineers
 
 
 


Old
  Post #4 (permalink)   08-29-2012, 05:34 AM
HD Master
 
Join Date: Dec 2011
Location: Florida
Posts: 274
Send a message via Skype™ to SolidShellSecur

Status: SolidShellSecur is offline
That would explain that. But back on topic:

Some of the ways we work with securing WP are
- custom written mod_sec rules for WP to filter all attack vectors out
- white list ips for admin areas
- ensure that permissions are right on files
- restrict any type of execution in dirs that don't need it
- proactive monitoring on access_logs
- automatic updates on security releases.

Now that doesnt cover server side of things, but application wise it does a good job.
__________________
SolidShellSecurity.com. Providing Quality Support, Secure Hosting and Amazing Services.
STAY ALERT! Sign up for our security mailing list and always know when threats come out.
 
 


Old
  Post #5 (permalink)   08-29-2012, 10:57 AM
HD Amateur
 
Join Date: Aug 2012
Posts: 78

Status: ReadyMakers is offline
Just make sure you have the latest patches installed and everything will be ok.
 
 
 


Old
  Post #6 (permalink)   08-30-2012, 07:28 AM
HD Guru
 
HostLeet's Avatar
 
Join Date: May 2009
Location: Florida, USA
Posts: 874

Status: HostLeet is offline
Well, assuming the server WP is hosted on is already hardened and secured and WP is up-to-date, of course.. I always recommend the following plugins for security:

Wordfence - http://wordpress.org/extend/plugins/wordfence/

Bulletproof - http://wordpress.org/extend/plugins/...roof-security/

Both are excellent ways to protect your WP site from hackers/attackers.

Also.. Don't forget to keep ALL plugins and themes installed, secured and up-to-date at all times, even if you're not currently using them!


EDIT: Forgot to mention to hardened WordPress first and foremost!
__________________
HOSTLEET.COM, LLC - Elite Website Hosting Since 2008!
Fast Reliable Affordable Secure Friendly & Courteous
RISK-FREE Money Back Guarantee PCI-Compliant Checkout

Last edited by HostLeet : 08-30-2012 at 07:34 AM.
 
 


Old
  Post #7 (permalink)   09-10-2012, 11:21 PM
HD Newbie
 
Join Date: Jul 2012
Posts: 29

Status: samirj09 is offline
Ive always found that plugins do more harm then good.

Custom Mod Security Rules to block common exploits along with keeping all posts, plugins and themes updated keep sites secure.
__________________
Quality WebHosting | 24x7 Priority Support | Website Transfer | Malware Removal | Weekly Offsite Backups
TheSHosting.com - Try Us Out. Experience Reliable Hosting Today!
Free SEO Tools | Certified CloudFlare Parter | 1 - Click Script Installs
 
 
 


Old
  Post #8 (permalink)   09-12-2012, 01:55 AM
HD Addict
 
Join Date: Dec 2003
Location: Oslo, Norway
Posts: 178

Status: gate2vn is offline
Quote:
Originally Posted by samirj09 View Post
Ive always found that plugins do more harm then good
Can you provide more details of your comment please?
__________________
Managed WordPress | Advanced anti-spam

Connect us at https://twitter.com/oslonap
 
 
 


Old
  Post #9 (permalink)   09-13-2012, 11:27 PM
HD Community Advisor
 
SenseiSteve's Avatar
 
Join Date: Mar 2009
Location: Saint Louis
Posts: 4,975
Send a message via MSN to SenseiSteve

Status: SenseiSteve is offline
Quote:
Originally Posted by samirj09 View Post
Ive always found that plugins do more harm then good.
If you list the pros and cons of plugins, I'd wager the pros vastly outnumber the cons. Of course, you have to keep your plug-ins updated, and make sure they're tested for the latest version of WordPress, but how hard is that?
__________________
ProlimeHost- Dedicated Server Hosting & KVM SSD VPS
Three Datacenter Locations: Los Angeles, Denver & Singapore
SuperMicro Hardware | Multiple Bandwidth Providers | 24/7 On Site Engineers
 
 
 


Old
  Post #10 (permalink)   11-08-2012, 09:03 AM
HD Amateur
 
Join Date: Aug 2010
Posts: 50

Status: BreezeHost is offline
You need to upgrade the wordpress to the latest version for more security.
__________________
http://BreezeHost.net
Reliable cPanel, Shared, Reseller Hosting | Fully Managed & UnManaged VPS Servers | Dedicated Servers | DCs Locations @ US & NL | 24/7 Live Chat Support Awaiting You! | Powered by SolusVM - OpenVZ VPS
 
 
 


Old
  Post #11 (permalink)   12-18-2012, 04:38 PM
HD Newbie
 
Join Date: Nov 2012
Location: Milwaukee, WI
Posts: 1

Status: aleach is offline
We see a lot of compromised accounts because of WordPress themes that have outdated TimThumb code within. Since it's not as easy to update a theme as plugins and WordPress itself, people often don't bother. A lot of free themes don't provide updates either. There is a small plugin called 'TimThumb Vulnerability Scanner', which can be used to scan theme files and find outdated TimThumb code. It also allows a webmaster to patch it on the fly without having to manually edit any files.

Although this is just one of many ways websites built with WordPress can be exploited, it's an easy and well known way for attackers to gain entry into an account.
__________________
Umbra Hosting
cPanel | Softaculous | CloudLinux | R1Soft | Ksplice | CloudFlare
Web Hosting, Reseller Hosting, VPS, Dedicated Servers, Colocation
UmbraHosting.com
 
 


Old
  Post #12 (permalink)   12-20-2012, 10:26 AM
HD Newbie
 
Join Date: Nov 2012
Location: 127.0.0.1
Posts: 40

Status: H4G-Kushal is offline
Only use the necessary plugins.
__________________
Host4Geeks LLC - Shared | Semi Dedicated | Reseller | Fully Managed VPS US / UK / India
Host4Geeks India - SSD Shared Hosting | SSD Reseller Hosting | Managed Wordpress Hosting in India
 
 
 


Old
  Post #13 (permalink)   12-26-2012, 03:22 PM
HD Addict
 
Join Date: Nov 2012
Posts: 114

Status: WeLoveServers is offline
Quote:
Originally Posted by aleach View Post
We see a lot of compromised accounts because of WordPress themes that have outdated TimThumb code within. Since it's not as easy to update a theme as plugins and WordPress itself, people often don't bother. A lot of free themes don't provide updates either. There is a small plugin called 'TimThumb Vulnerability Scanner', which can be used to scan theme files and find outdated TimThumb code. It also allows a webmaster to patch it on the fly without having to manually edit any files.

Although this is just one of many ways websites built with WordPress can be exploited, it's an easy and well known way for attackers to gain entry into an account.
Thanks for the tip! TimThumb is an awesome plugin, just installed it on my blog to make sure there were no instances of TimThumb.
 
 
 


Old
  Post #14 (permalink)   01-08-2013, 03:21 PM
HD Newbie
 
Join Date: Oct 2012
Posts: 15

Status: httpEasy is offline
Keep your version updated!
 
 
 


Old
  Post #15 (permalink)   01-08-2013, 06:58 PM
HD Newbie
 
Join Date: Jan 2013
Location: Sudbury, Ontario, Canada
Posts: 42

Status: TekStorm - James is offline
Quote:
Originally Posted by httpEasy View Post
Keep your version updated!
+1

Of the compromised WordPress installations that I've worked with post-breach, the vast majority of them hadn't been kept updated; leaving them vulnerable to attack via exploits that had been patched in later revisions. While keeping it up-to-date is in no way the only thing that can and/or should be done, it's an important part of keeping it secure.
__________________
TekStorm Inc.

AtomiCorp | Cellular | CheckMEND | Dig. Certs. | Domains | S/W | StripeXS

Last edited by TekStorm - James : 01-08-2013 at 07:10 PM.
 
 
 
Reply
Previous Thread Next Thread


Thread Tools

New Post New Post   Old Post Old Post
Posting Rules:
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Sponsored By: