Cybercriminals start cashing in on vulnerable WordPress websites

The abuse of a vulnerability in the WordPress REST API has taken an expected turn — with the monetization of compromised websites for cyberattackers. The security flaw is a patched vulnerability in the content management system (CMS)’s REST API which permits attackers to modify the content of posts or pages, including editing or outright deletion, and can even allow them to execute malicious code.
Despite the bug being fixed earlier this year, thousands of webmasters are ignoring pleas to update, granting criminals a vast array of websites to exploit.
Two weeks after the patch update was issued by the WordPress security team, researchers found exploits being shared online to take advantage of slack security, leading to a minimum of 66,000 WordPress domains compromised to carry SEO spam (Search Engine Poisoning) and make cyberattackers money through spam-related content.
A number of websites were also the targets of remote code execution attempts.
It is estimated that up to 1.5 million websites may remain unpatched. However, the situation appears to have worsened.
According to researchers from SiteLock, the latest trend in vulnerable WordPress website defacement is the launch of rogue
Source: https://managewp.org/articles/14474/cybercriminals-start-cashing-in-on-vulnerable-wordpress-websites

source https://williechiu40.wordpress.com/2017/02/28/cybercriminals-start-cashing-in-on-vulnerable-wordpress-websites/

WordPress Retainers 101: The Complete DevriX Tutorial – WordPress Development Agency

What are the Retainers? Retainers are most useful for business that need constant development work, but do not have enough money to hire a full time developer. Also, individuals who are likely to need a lot of development might want to have an agency on retainer.
Fixed-fee projects are entirely based on assumptions and wild guesses. Even if you spend countless hours discussing hypothetical details and exchanging emails, you won’t be able to cover every single part of your project. No matter how detailed the specification, there are always unforseen bottlenecks that emerge through the development or testing stage of the final product.
At DevriX, our main goal is to optimize the overall business process through different iterations during and after the initial product launch. We are not just building websites, we provide custom tailored solutions to business needs that are constantly growing and evolving as your business expands.
The industry standard for fixed fee projects is a 2-3 times multiplier due to scope creep, communication overhead, delays, QA back and forth that are unpredictable with a first time client. This is the reason why we are focusing on a stable and simple partnerships
Source: https://managewp.org/articles/14473/wordpress-retainers-101-the-complete-devrix-tutorial-wordpress-development-agency

source https://williechiu40.wordpress.com/2017/02/28/wordpress-retainers-101-the-complete-devrix-tutorial-wordpress-development-agency/

Local Politicians Meet InfoSec – a WordPress Disaster

Last year will be characterized by hacking and interference in the American political system. It was a huge wake up call for everybody involved in politics; InfoSec was an important priority. I don’t live in America. I live in the tiny Australian Capital Territory, a territory comprising of a Canberra; a city of 300,000 people. Like many places, we have a local government full of politicians. I analyzed the websites of the 25 MLAs (members of the legislative assembly) and their parties sites.
Spolier: too many local politicians have SQL injection vulnerable sites, and don’t even care.
Methodology
I’m not an InfoSec industry professional; just a developer who is interested in this stuff. This is not a blog post about novel vulnerabilities – is is a story about bad higyine.
First, I compiled a list of all the sites. In total, there are 17 MLA sites (not all MLAs have their own site) and 3 party sites. There is even a helpful list maintained by the government.
Then I used used the http headers to do l33t hax0r discovery of the server software they used. It was as follows:
Software Package
# of Users
Wordpress
7
NationBuilder (SaaS)
4
Wix (SaaS)
2
Unknown/Bespoke
2
Static
1
Wordpress.COM
Source: https://managewp.org/articles/14472/local-politicians-meet-infosec-a-wordpress-disaster

source https://williechiu40.wordpress.com/2017/02/28/local-politicians-meet-infosec-a-wordpress-disaster/

Crowdfunding Options for Your WordPress Website

Crowdfunding can be described as the process of raising funds with the help of friends, family, customers, and investors. This is typically done online via a website or through social media to reach a large audience. If you’re planning to do any crowdfunding of any kind on WordPress, you’re in the right place. You don’t have to use KickStarter or Go Fund Me, you can do it right from your own site! Here’s a list of some of the top crowdfunding options, fundraising solutions and ways to accept donations, a selection including plugins & themes for WordPress. Crowdfunding Options – WordPress Plugins
To help you weed through all the options available, here are 6 WordPress crowdfunding plugins worth looking into (in no particular order). Some of these can also be used for fundraising or to accept donations.
1. IgnitionDeck Crowdfunding & Commerce
IgnitionDeck is probably one of the most well known crowdfunding solutions and plugins in the WordPress space. It currently has over 3,000 active installs with a 3.5 out of 5 star rating.
Ignition Deck has worked alongside AppThemer in the past to build crowdfunding WordPress themes. The plugin works with any
Source: https://managewp.org/articles/14471/crowdfunding-options-for-your-wordpress-website

source https://williechiu40.wordpress.com/2017/02/27/crowdfunding-options-for-your-wordpress-website/

Cloudbleed: How Cloudflare’s Memory Leak Exposed their Customer Sensitive Data

Cloudflare, the popular Content Delivery Network (CDN) trusted by over 5.5 million websites, has warned customers of a recent bug that releases private information to standard search engines. Due to some unusual circumstances, Cloudflare edge servers would run past the end of a buffer and disclose unauthorized data back to users if that data transversed Cloudflare. While cyber security is always in flux, the most recent bug with Cloudflare, being called Cloudbleed, is one of the worst cases of data breached over the past few years. In fact, many security experts are saying that this bug is as bad as it ever gets because companies using Cloudflare can’t prove to their customer that their private data is secure.
Acting as a proxy, Cloudflare is the middle man between an online user and the actual website that is being visited. This extra level of protection helps optimize and secure websites from malicious attacks because the Cloudflare servers contribute to making the HTTP requests and filter out suspicious activity.
However, the centralized use of Cloudflare servers opens companies to security issues if Cloudflare experiences a bug such as Cloudbleed. Before we continue to understand
Source: https://managewp.org/articles/14467/cloudbleed-how-cloudflare-s-memory-leak-exposed-their-customer-sensitive-data

source https://williechiu40.wordpress.com/2017/02/27/cloudbleed-how-cloudflares-memory-leak-exposed-their-customer-sensitive-data/

SQL Injection Vulnerability in NextGEN Gallery for WordPress

Security Risk: Critical Exploitation Level: Easy/Remote
DREAD Score: 9
Vulnerability: SQL Injection
Patched Version: 2.1.79
As part of a vulnerability research project for our Sucuri Firewall (WAF), we have been auditing multiple open source projects looking for security issues. While working on the WordPress plugin NextGEN Gallery, we discovered a severe SQL Injection vulnerability. This vulnerability allows an unauthenticated user to grab data from the victim’s website database, including sensitive user information.
Are You at Risk?
This vulnerability can be exploited by attackers in at least two different scenarios:
If you use a NextGEN Basic TagCloud gallery on your site, or
If you allow your users to submit posts to be reviewed (contributors). If you fit any of these two cases, you’re definitely at risk.
This issue existed because NextGEN Gallery allowed improperly sanitized user input in a WordPress prepared SQL query, which is basically the same as adding user input inside a raw SQL query. Using this attack vector, an attacker could leak hashed passwords and WordPress secret keys, in certain configurations.
Technical Details
Never trust the input – that is the
Source: https://managewp.org/articles/14469/sql-injection-vulnerability-in-nextgen-gallery-for-wordpress

source https://williechiu40.wordpress.com/2017/02/27/sql-injection-vulnerability-in-nextgen-gallery-for-wordpress/

Expose Localhost Websites Publicly with ngrok – Shawn Hooper – WordPress Developer & Speaker

If you’re doing any web development work, I hope you have a local development environment running on your computer, and that you aren’t FTP’ing your code to the server and then loading the page each time to see if your change works. (I’ve seen people do this, it’s painful, and slow). If you don’t have a local development environment setup, there are lots of options. WordPress developers, check out DesktopServer, VVV, or Local by Flywheel as great options for getting up and running with a local development environment quickly. When working with local development environments, you can typically only access your sites from localhost (your computer). Accessing your sites from another computer on the same network, or from elsewhere not the Internet, is not possible.
There are many reasons you may want to do get temporaryaccess to your local environment from the outside. I say temporary because your computer should not be used as a web server for many reasons including performance and security. In my experience temporary local access is handy mostly for testing scenarios, such as:
Testing your sites from mobile devices
Testing your REST API endpoints from
Source: https://managewp.org/articles/14468/expose-localhost-websites-publicly-with-ngrok-shawn-hooper-wordpress-developer-speaker

source https://williechiu40.wordpress.com/2017/02/27/expose-localhost-websites-publicly-with-ngrok-shawn-hooper-wordpress-developer-speaker/