WORDPRESS SECURITY 101what is important – and what is not

WordPress Jyväskylä Meetup 21.3.2017Otto Kekäläinen@ottokekalainen

DEFINITION OF INFORMATION SECURITY

1. Confidentiality2. Integrity3. Availability

You must keep your WordPress site secure.

POTENTIAL CONSEQUENCES

● Corrupted orders database: webshop unable to ship anything or resolve payments

● Leaked customer database: angry customers, lawsuit for neglect of privacy laws

● Visitors get redirected to shady sites: lost reputation, marketing budget goes in vain

● Site spreads malware: Google might detect and ban from showing up in search results

● Site sends spam: could become blacklisted and legit email stops working

“BUT MY SITE IS NOT IMPORTANT!”

Your site can be used to mount further attacks!

If you have clearly neglected the maintenance of your own site, you could be held partly liable for attacks on other sites.

What is REALLY important in keeping your WordPress site secure?

AVENUES OFUNAUTHORISED ACCESS:

1. Leaked passwords2. Software vulnerabilities

LEAKED PASSWORDS

Remember password hygienewp-palvelu.fi/blogi/salasanahygienia/

HTTPS, SFTP, SSHNever submit passwords over an unencrypted connection!

Enforce HTTPS in WordPress1. Your server needs to support HTTPS2. Enforce in wp-config.php with: define('FORCE_SSL_ADMIN', true);

Use captcha to avoid robot usersGoogle reCaptcha recommended

SOFTWARE VULNERABILITIES

MINIMIZE VULNERABILITIES 1. Minimize the attack

surface by minimizing the amount of software you have

2. For the software you really need, make sure you have updated to latest releases

HOW SECURE IS WORDPRESS CORE?

Security bugs per 1000 lines of code written

All time: 0,1(204 CVE entries per 2,1 million lines of code)

In 2015: 0,05 (11 CVE entries per 236 000 lines of code)

WORDPRESS COREIS SECURE.

THE PROBLEM IS THE PLUGINS.

Combined core, plugin and theme vulnerability database:wpvulndb.com

Example case: Mossack Fonseca aka Panama papers

● The site www.mossfon.com was running WordPress● Unauthorized access of WP lead to unauthorized access of MS Exchange

email server on internal network and other sites at *.mossfon.com● The intruders most likely came through an old and insecure version of the

Revolution Slider plugin.○ Well known vulnerability, WordPress.org even has a patch as a separate plugin

(https://wordpress.org/plugins/patch-for-revolution-slider/) as Revolution Slider itself is not available at WordPress.org.

Example case: Mossack Fonseca aka Panama papers

● Case analysis at https://www.wordfence.com/blog/2016/04/mossack-fonseca-breach-vulnerable-slider-revolution/

WP PLUGIN REVIEW GUIDELINES FOR CAPITALISTS*

If the logo is red and name contains revolution, don’t install it on your system!

* a small dose of parody can’t hurt?

PLUGIN SECURITY1. Minimize the attack surface by minimizing the amount of

plugins (and themes) you have2. For the plugins you really need, make sure you have

updated to latest releases

You will not minimize vulnerabilities by installing more plugins!

WordPress is insecure!Quickly, install a security plugin!

NO

DON’T WASTE TIME ON

● removing generator meta or hiding version numbers● hiding login errors● changing wp-admin location● removing readme.html or other files

Only for WP geeks who love to research the pros and cons. For normal users WordPress default settings are secure.

FALSE SENSE OF SECURITY

Feels like a lot has been done when really very little has.

Example: useless readme.html blocking= don’t!

Example: useless readme.html blocking

Versions leak anyway

Example: useless readme.html blocking

Disclaimer:WordFence was used just as an example. It still the best guy in town. Many other security plugins are much worse.

..and other WordPress integrity checks trigger

SECURITY PLUGINS ARE NOT THE SOLUTION

Scan results require interpretation. Recommended only for professionals.

The only recommended ones:WPScan and Google Webmaster ToolsAlmost no false positives and no business model based on spreading fear.

IF YOU RUN YOUR OWN SERVER

Also remember to harden and keep updated

● operating system ● web server● database server● PHP environment● HTTPS hardening● SSH hardening

INSTALL ONLY FROM TRUSTED SOURCES

Avoid random 3rd party repositories that don’t have any maintenance policy.

PROTECTION AGAINST DDOS

What if the problem is not unauthorized access but the lack of authorized access?

DENIAL OF SERVICE ATTACKSDetect, withstand and block

● high performance servers and good caching

● detect repeated offenders and block at network level

○ e.g. failtoban + iptables

● detect and block at http level

○ e.g. Nginx rate limiting

● If you are trying to block at PHP/WordPress level, you’ve already lost

DDOS is a constant race of new techniques of attack and defence. Try to find a good hosting provider that takes care of DDOS at least on the network level.

BACKUP AND RECOVERY

Because some day, sooner or later, everything else fails.

BACKUP GUIDELINES 1/2

Make sure your backup system meets these requirements

● automatic: not dependant on human action

● complete: both files and database

● incremental with a history: at least 30 days

● frequent: daily is good

BACKUP GUIDELINES 2/2

● offsite: in case access to the original site is lost

● pull, not push: original site should not have access to the backups, otherwise an attacker can delete both the original site and all backups

Personal favourite: mysqldump + rdiff-backup over SSH

ONCE MORE WITH A FEELING

WORDPRESS SECURITY 1011. Always follow password hygiene.2. Use captchas to stall robot users.3. Use HTTPS (and SFTP and SSH) – never submit passwords in plain

text on any network connection.4. Remove unnecessary software to reduce attack surface.5. Keep WordPress plugins and all other software too updated to have

all known vulnerability fixes installed.6. Install software and update only from trusted sources.7. Have a good backups system in place.8. Choose a good service provider and trust them to take care of the

rest.

ExtraRecommendation in 2016: don’t disableRecommendation 2017: disable and use REST API instead

Blogi: Haittakoodi kuriin eli kuinka sivustomurto selvitetäänwp-palvelu.fi/blogi/wordpress-sivustomurto-haittakoodi/

Extra

THANK YOU!

WP-palvelu.fi

@SeravoFi@ottokekalainen