tickets #16476
closed
news.opensuse.org seems hacked
Added by sflees@suse.de over 7 years ago.
Updated about 7 years ago.
Category:
Servers hosted in Provo
Description
--
Simon Lees (Simotek) http://simotek.net
Emergency Update Team keybase.io/simotek
SUSE Linux Adelaide Australia, UTC+10:30
GPG Fingerprint: 5B87 DB9D 88DC F606 E489 CEC5 0922 C246 02F0 014B
Files
ticket raised to MF-IT so that they will restore the content and update wordpress. Contacted my manager as well so we can get it urgent priority
Any news on this?
FYI, the page was hacked again :-(
BTW: In case the original articles are lost - I still have a backup of them in my feedreader (at least the newest ones)
I wonder if the page was really hacked or if they just have Doug's password. The article was published under his account. Anyway, Doug should change his PW ASAP, but unfortunately he is not at work today. I guess he's still asleep after the long ride back from FOSDEM and staying up all night to watch the Superbowl.
Doug changed his password at FOSDEM. So wordpress is hacked really.
Micah deployed WordPress 4.7.2 on news.opensuse.org two hours ago, using a database dump from Feb 2nd.
Forcing everybody to change his/her password is probably a good idea.
BTW: lizards.opensuse.org runs an even older WordPress (4.6.1, and funnily this is a good thing because this security issue was introduced in 4.7). Nevertheless, an update to WordPress 4.7.2 is scheduled for Wednesday.
Someone was saying in IRC there was a exploit that allowed you to edit
an existing post with no permissions, you'll notice it kept much of the
meta from the original post so this is likely what happened.
On 02/07/2017 09:39 AM, admin@opensuse.org wrote:
[openSUSE Tracker]
Issue #16476 has been updated by cboltz.
Micah deployed WordPress 4.7.2 on news.opensuse.org two hours ago, using a database dump from Feb 2nd.
Forcing everybody to change his/her password is probably a good idea.
BTW: lizards.opensuse.org runs an even older WordPress (4.6.1, and funnily this is a good thing because this security issue was introduced in 4.7). Nevertheless, an update to WordPress 4.7.2 is scheduled for Wednesday.
tickets #16476: news.opensuse.org seems hacked
https://progress.opensuse.org/issues/16476#change-38262
- Author: sflees@suse.de
- Status: New
- Priority: Normal
- Assignee: opensuse-admin-provo
- Category:
* Target version: ¶
--
Simon Lees (Simotek) http://simotek.net
Emergency Update Team keybase.io/simotek
SUSE Linux Adelaide Australia, UTC+10:30
GPG Fingerprint: 5B87 DB9D 88DC F606 E489 CEC5 0922 C246 02F0 014B
- Category set to Servers hosted in Provo
- Status changed from New to Closed
I got confirmation from the helpdesk ticket that the update has been finished, and that the db has been restored to a pre-hacked version.
- Private changed from Yes to No
https://blog.sucuri.net/2017/02/content-injection-vulnerability-wordpress-rest-api.html
Read the above blog article for detailed information on this topic.
There was a content injection issue - so some post from Douglas was changed obviously to the hacked content.
That's why his account was on this post.
Unfortunately - it might have been possible to go on further from content injection to privilege escalation - but as the updates are now installed and databases are reset to an older state - that should no longer be a problem.
To avoid such problems in the future - i have the question - is someone or some script using the REST API of our WordPress instances?
If not - we should disable the REST API to minimize vectors.
Regards,
Thorsten
For the records - in the meantime, lizards.o.o was also updated to WordPress 4.7.2.
I agree with Thorsten that minimizing vectors is a good idea - but given the WordPress security history, it's probably a good idea to switch to something that is more secure. (I'm using S9Y for my personal blog, and it's quite boring - worst case is one security update per year :-) IIRC, most of the few security issues were only exploitable by logged in backend users.)
Also available in: Atom
PDF
