wordpress malware - what is it and how to protect your website

WordPress Malware Owen Cutajar (@OwenC)

Upload: owen-cutajar

Post on 16-Apr-2017

78 views

Category:

Technology

1 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Wordpress malware - What is it and how to protect your website

WordPress MalwareOwen Cutajar (@OwenC)

Page 2: Wordpress malware - What is it and how to protect your website

Your lovely WordPress site …

Page 3: Wordpress malware - What is it and how to protect your website

looking not-so-lovely …

Page 4: Wordpress malware - What is it and how to protect your website

According to the FBI

“There are only two types of companies: those that have been hacked, and those that will be.”

Robert Mueller, FBI Director, 2012

Page 5: Wordpress malware - What is it and how to protect your website

Why?

Profit or Propaganda

Wordpress is an attractive target

Outdated version of WordPress

Large surface of attack across plugins/themes

Page 6: Wordpress malware - What is it and how to protect your website

Classes of attacks

Targeted attacks

Password cracking (brute force / dictionary attacks)

DDOS

Malware

Some terminology

Virus

Worm

Trojan Horse

Botnet

Malnet

Page 8: Wordpress malware - What is it and how to protect your website

Types of attacks

Defacing

Spam

Drive-by Downloads

Backdoors

Malicious redirects and embeds

Page 9: Wordpress malware - What is it and how to protect your website

Defacing

Page 10: Wordpress malware - What is it and how to protect your website

Spam

Page 11: Wordpress malware - What is it and how to protect your website

Drive-By Downloads

Page 12: Wordpress malware - What is it and how to protect your website

Backdoors

Page 13: Wordpress malware - What is it and how to protect your website

Malicious Redirects and Embeds

Page 14: Wordpress malware - What is it and how to protect your website

How?

Exploits and vulnerabilities

Outdated software

Insecure credentials

Compromised host

Page 15: Wordpress malware - What is it and how to protect your website

Infection Demo

Local Samples

Tools:

Base64Decoder: https://www.base64decode.org/

Execute PHP: https://eval.in/

https://www.base64decode.org/

https://eval.in/

Page 16: Wordpress malware - What is it and how to protect your website

Cleaning an infected site

Manually

Wordfence demo

Page 17: Wordpress malware - What is it and how to protect your website

Protecting your siteAutomatic updates

Security plugins

External scanning

User education

Two factor authentication

Off-site Backups

SSL on login page

Page 18: Wordpress malware - What is it and how to protect your website

References

Wordpress Vulnerability Database: http://wpvulndb.com

Wordfence: https://wordpress.org/plugins/wordfence/

Securi: https://sucuri.net/wordpress-security/

Cloudflare: https://www.cloudflare.com/

Me: @OwenC on Twitter, owencutajar on Skype

http://wpvulndb.com

https://wordpress.org/plugins/wordfence/

https://sucuri.net/wordpress-security/

https://www.cloudflare.com/

PHP Aspis: Using Partial Taint Tracking To Protect Against ...Third-party plugin code Code that handles user data year WordPress WordPress Plugins 2009 2 13 2010 2 10 CVE WordPress-Platform

WordPress Security: How to Protect Your Site from Hacking

What is Malware? · Web viewManaged by your network administrator, Managed Antivirus is a fully automated antivirus solution designed to protect your computer from all types of malware

BabaYaga - The Self Healing WordPress Malware Contents · BabaYaga - The Self Healing WordPress Malware ... our Premium customers. Our free customers will receive it in a maximum

Malware & Anti-Malware

Protect Your WordPress From The Inside Out

How to Protect Your Business from the Coming Malware Storm

How to Protect your PC from Malware

Protect Your WordPress Website - Setting Up IThemes Security

Canon imageCLASS Security White Paperdownloads.canon.com/nw/pdfs/solutions/imageCLASS-imageRUNNE… · which helps protect against viruses and malware. Security Measures to Protect

How to protect your WordPress website against hackers

Protect Your Desktops from Malware and Unauthorized Software

5 Ways To Protect Your Business From Dangerous Malware

Ransomware, Malware and Viruses; How to Protect Yourself

Know, Protect, Empower. Don’t learn malware.€¦ · Know, Protect, Empower Don’t learn Malware 15 KNOW Detection process does not require vendor-specific or malware knowledge

7 steps that will help protect your Wordpress website from unexpected hacking

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

FireEye - equities.wedbush.comFireEye’s technology is designed to protect large computer networks from malicious software, commonly known as “malware.” Specifically, FireEye

Administrator Protect against Malware by: Brittany Slisher and Gary Asciutto

Protect Against Malware with Mobile Threat Management

How to protect your dell computer from malware?

HP EliteBook 735 G5 Notebook PC - objects.icecat.bizobjects.icecat.biz/objects/mmo_56645174_1534897694_8514_3036.… · Protect your PC against the evolving malware threats, with

Malware Nilgün Kablan. Malware …………………………………….…….……………………………………………… Geschichte der Malware ……………….…………………………………………………

[hs] Heimdal PRO Guide for Affiliates and Resellers …...4 Protect your computer from 2nd generation malware Ransomware, exploit kits, financial Trojans and data-stealing malware

Google Chrome: How to protect from phishing and malware

Protect against viruses, malware, misuse and theft Protect against data theft or loss, identity theft and fraud Avoid scams, savvy social networking and

Lesson 2- Protecting Yourself Online. Determine the strength of passwords Evaluate online threats Protect against malware/hacking Protect against identity

ACCIÓN DEVERÁN - xuventude.xunta.esxuventude.xunta.es/uploads/docs/rix/infoxove/abril2010.pdfRouter, wi-ﬁ, wordpress, spotify, cracker, ﬁrefox, facebook,malware, usb, reset,

Infographic - 15 Ways to Protect Your Business From a ... · cyber breach this year. Advanced Endpoint Detection & Response Protect your computers data from malware, viruses, and

Lesson 2 - Protecting Yourself Online · •Protect yourself against malware/hacking •Protect yourself against identity theft Objectives ... malicious intent. Two types of malware:

Enterprise Malware Defense - Information security Malware Defense: ... Chuck will share a strategy that any company can use to ... He will also share strategies to isolate and protect

Tracking Anti-Malware Protection 2015dennistechnologylabs.com/reports/s/a-m/symantec/... · Tracking Anti-Malware Protection 2015, A time-to-protect anti-malware comparison test Page

Protect your own company environment or increase …...flexibility to protect your environment from all types of malware, including threats for Windows, Mac, mobile malware and ransomware

Ways to Protect Your Business - Sharp Business Systems · Protect your computer’s data from malware, viruses, and cyberattacks with advanced endpoint security. Today’s latest

PROTECT YOURSELF FROM ANTIVIRUS - Insight · PROTECT YOURSELF FROM ANTIVIRUS ... malware and exploit prevention ... tent that is designed to leverage software flaws or bugs in legitimate