Comments on: Upgrade and new theme http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/ Security Research, Computer Laboratory, University of Cambridge Sat, 28 Jan 2012 18:43:15 +0000 http://wordpress.org/?v=2.9.2 hourly 1 By: autobuildit http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-141255 autobuildit Tue, 25 Oct 2011 20:56:21 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-141255 I not to mention my friends came taking note of the nice helpful hints located on your web site then all of a sudden came up with an awful feeling I never expressed respect to the web blog owner for those strategies. These men became as a consequence excited to read through all of them and already have definitely been taking pleasure in those things. Appreciation for really being indeed thoughtful and then for going for these kinds of perfect resources millions of individuals are really eager to discover. My very own sincere apologies for not expressing appreciation to sooner. I not to mention my friends came taking note of the nice helpful hints located on your web site then all of a sudden came up with an awful feeling I never expressed respect to the web blog owner for those strategies. These men became as a consequence excited to read through all of them and already have definitely been taking pleasure in those things. Appreciation for really being indeed thoughtful and then for going for these kinds of perfect resources millions of individuals are really eager to discover. My very own sincere apologies for not expressing appreciation to sooner.

]]> By: Thomas http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-27211 Thomas Mon, 26 Nov 2007 00:29:38 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-27211 @Steven Can you tell me more about this second backdoor you mention? Just to be on the safe side, I want to double-double-check that he didn't leave anything that I did not discover (even though I'm pretty sure I'm covered - his /tmp backdoor did indeed fail to upload anything). @Steven

Can you tell me more about this second backdoor you mention? Just to be on the safe side, I want to double-double-check that he didn’t leave anything that I did not discover (even though I’m pretty sure I’m covered – his /tmp backdoor did indeed fail to upload anything).

]]> By: Steven J. Murdoch http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-27205 Steven J. Murdoch Sun, 25 Nov 2007 01:14:24 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-27205 @Thomas Very similar. The admin-ajax.php vulnerability was used, the backdoor was placed in /tmp, and then it was loaded as a plugin. The script looks identical too. However, where your attacker gave up, our one was more successful. He went on to upload a second backdoor, hidden amongst some other uploads, and then attempted to edit some of the Wordpress PHP files (but was prevented). After I removed the backdoors and changed the passwords, he still came back and tried to add links to some other compromised blogs which were hosting adverts for various pharmaceuticals. After a few days of unsuccessful attempts, he gave up. @Thomas

Very similar. The admin-ajax.php vulnerability was used, the backdoor was placed in /tmp, and then it was loaded as a plugin. The script looks identical too.

However, where your attacker gave up, our one was more successful. He went on to upload a second backdoor, hidden amongst some other uploads, and then attempted to edit some of the Wordpress PHP files (but was prevented).

After I removed the backdoors and changed the passwords, he still came back and tried to add links to some other compromised blogs which were hosting adverts for various pharmaceuticals. After a few days of unsuccessful attempts, he gave up.

]]> By: Thomas http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-27204 Thomas Sat, 24 Nov 2007 23:34:55 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-27204 Was it anything like this? http://justaddwater.dk/2007/11/15/justaddwaterdk-hacked/ Was it anything like this?
http://justaddwater.dk/2007/11/15/justaddwaterdk-hacked/

]]> By: paul http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-27201 paul Sat, 24 Nov 2007 02:24:41 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-27201 It looks like there is a patch undergoing testing that addresses this. It really does seem overdue. It looks like there is a patch undergoing testing that addresses this. It really does seem overdue.

]]> By: Clive Robinson http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-25481 Clive Robinson Mon, 05 Nov 2007 13:13:08 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-25481 @Steve, I'll give it a try you knever know they might listen... @Steve,

I’ll give it a try you knever know they might listen…

]]> By: Steven J. Murdoch http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-25300 Steven J. Murdoch Sat, 03 Nov 2007 22:20:47 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-25300 @Clive I'm trying, as much as possible, to track the mainline Wordpress distribution. Otherwise each time I upgrade to fix the frequent security problems, my patches break. There is, however, a facility to browse authors posts, for example my posts are at: http://www.lightbluetouchpaper.org/author/sjmurdoch/ You could also try submitting a <a href="http://trac.wordpress.org/" rel="nofollow">feature request</a> at Wordpress. Hopefully you'll have more luck that me with my 2 year old <a href="http://trac.wordpress.org/ticket/2394" rel="nofollow">security vulnerability</a> :-) @Clive

I’m trying, as much as possible, to track the mainline Wordpress distribution. Otherwise each time I upgrade to fix the frequent security problems, my patches break. There is, however, a facility to browse authors posts, for example my posts are at: http://www.lightbluetouchpaper.org/author/sjmurdoch/

You could also try submitting a feature request at Wordpress. Hopefully you’ll have more luck that me with my 2 year old security vulnerability :-)

]]> By: Clive Robinson http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-25240 Clive Robinson Sat, 03 Nov 2007 10:10:03 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-25240 @Steven, One sugestion for a possible "enhancement". Currently it would appear that your search function does not include the posters name. Often this is handy when trying to find related information. RGR @Steven,

One sugestion for a possible “enhancement”.

Currently it would appear that your search function does not include the posters name. Often this is handy when trying to find related information.

RGR

]]> By: Clive Robinson http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/comment-page-1/#comment-24760 Clive Robinson Sun, 28 Oct 2007 16:07:13 +0000 http://www.lightbluetouchpaper.org/2007/10/27/upgrade-and-new-theme/#comment-24760 Good luck, and I hope things go smothly. Good luck, and I hope things go smothly.

]]>