Wordpress Redirect Hack Allows Web Traffic To The Malicious URLs

Wordpress Redirect Hack Allows Web Traffic To The Malicious URLs

The security experts from Sucuri have exposed today an continuing attack on the sites of WordPress that revised their source code as well as cleverly transmits the users to the malicious websites.

According to an investigation by Sucuri's John Castro that the crooks are using vulnerabilities in older versions of WordPress or plugins of WordPress to gain the right to use to a site and then they are editing the main theme of header.php file by adding up 12 lines of obfuscated code.

Sucuri says that in several cases the hackers handle to acquire the site of admin credentials by other resources as well as just logged in through the site of regular login page that has right to use the WordPress which is built-in theme editor section as well as added the malicious source code by hand.

Whereas various sites of Joomla are also affected.

We discovered a WordPress Redirect Hack via Test0 .com/Default7 .com https://t.co/8ouc4CuG7P by @unmaskparasites pic.twitter.com/HQsrQb5eFk

— Sucuri (@sucurisecurity) May 11, 2016

The security firm also spots out that, further WordPress they have also observed this same malicious code which added to the sites of Joomla in the administrator/includes/help.php file. However, the number of affected the websites of Joomla is much smaller.

Sucuri says that the operation is still continuing and that, in an earlier version, the attackers were adding up the same obfuscated code in the theme of footer.php file.

After taking out the malicious source code, the security firm says that the functionality which they discovered is trouble-free yet efficient. Attackers are significant that every site to select the incoming users with a 15 percent chance as well as redirect them to a prearranged URL. The malicious source code also puts a cookie in the browser of the user that protects from sending the user again in the forthcoming year.

The malicious sites are gateways to more dangerous than threats.

The domains to that the attacker transmits the users are default7[.]com, test246[.]com, test0[.]com, distinctfestive[.]com, and ableoccassion[.]com.

Sucuri says that these are simple gateways to other anxious domains. Once the user arrives at these gateways, they are transmitted to other as well as many other dangerous sites.

In one of the cases noticed by Sucuri that the users utilizing the Internet Explorer which were transmitted to the websites that pressed the affected malware downloads which made it look like reliable Adobe Flash or Java updates.

Jerome Segura of Malwarebytes also stated that his company saw the same gateway domains which transmit the users to tech support tricks.

And at least 6,400 sites are affected.

Due to several setups of PHP as well as several bad coding in the malicious PHP code on several affected websites and then the code generated an error.

Mysterious Spike in Wordpress Hacks Silently Delivers Ransomware to Visitors

WordPress Content Management System – Hacked

A large number of websites which tend to run on the WordPress content management system are getting hacked to deliver crypto ransom-ware together with other malicious software to ignorant end users. Researchers from three different security firms, in the last few days have reported that a huge number of legitimate WordPress sites are hacked, silently redirecting visitors to a sequences of malicious site.

The attack sites tend to host code from Nuclear exploit kit which is available for sale in black market all over the Internet. People who tend to visit the WordPress sites and use out-of-date versions of Adobe Flash Player, Adobe Reader Internet Explorer or Microsoft Silverlight would find that their computers are infected with the Teslacrypt ransomware package which encrypts user files, demanding a heavy ransom for the decryption key required to restore them.

According to Malwarebytes Senior Security Researcher, Jerome Segura who had mentioned in his blog post published recently stated that WordPress sites are considered to be injected with enormous recommendations of rogue code which tends to silently perform redirection to domain appearing to be hosting ads. This could be a distraction and fraud since the ad comes with more code which sends the visitor to the Nuclear Exploit Kit.

Google’s Safe Browsing Mechanism

The compromised WordPress sites observed, had been hacked to include encrypted code towards the end of all legitimate JavaScript files according to the latest blog post published by website security firm Sucuri. It is said that the encrypted content seems to vary from site to site.

To avoid detection from researchers visiting the compromised site, the code makes efforts to infect only first time visitors and to further hide the attack, the code then redirects end users through a series of sites prior to delivering the ultimate malicious payload. Google’s Safe Browsing mechanism, Sucuri which browser maker then to use in helping users to avoid malicious websites had mentioned that Google had blacklisted some of the Internet domains that were utilised in the scam.

However, a post published recently by Heimdal Security listed an altered domain with the probability that the attackers seem to frequently refreshing as the old ones tend to get identified. Moreover, Heimdal Security also cautioned about antivirus programs could do little in protecting end users.

Enhanced Mitigation Experience Toolkit - Microsoft

The exploit code for instance had been detected by only two of 66 leading AV packages, towards the latest part of the campaign, while the payload it delivered has also been limited.The most recent reminder of the attacks are that people could be exposed to powerful malware attacks even while visiting legitimate websites which could be trusted.

 The best defense would be to install security updates as soon as they tend to become available for such drive by attacks. Other systems comprise of running Enhanced Mitigation Experience Toolkit of Microsoft on any of the Window based computers using the 64-bit version, if possible, of Google’s Chrome browser. It is not known how the WordPress sites tend to get infected.

 There could be a possibility that administrators may be failing in locking down the login identifications which may enable the site content to be changed. It could also be likely that the attackers may be exploiting unknown vulnerability in the CMS, which is one of the plugins used, or the operating system they tend to run on. When a system is infected, the website malware tends to install various backdoors on the webserver, a feature which could result in several hacked sites being repeatedly re-infected.

WordPress Patched Zero Day XSS Vulnerability With New 4.2.1 Security Release

WordPress Patched Zero Day XSS Vulnerability With New 4.2.1 Security Release.

WordPress 4.2.1 version is now available. This is a critical security release for all previous versions and we strongly encourage you to update your sites immediately.

A few hours ago, the WordPress team was made aware of a cross-site scripting vulnerability, which could enable commenters to compromise a site. The vulnerability was discovered by Jouko Pynnönen.

WordPress 4.2.1 has begun to roll out as an automatic background update, for sites that support those.

For more information, see the release notes or consult the list of changes.

Download WordPress 4.2.1 or venture over to Dashboard → Updates and simply click “Update Now”.

What is Cross Site Scripting (XSS)?
'XSS' also known as 'CSS' - Cross Site Scripting. It is a very common vulnerability
found in Web Applications, 'XSS' allows the attacker to INSERT malicous code, There are many types of XSS attacks.

Read more here about Cross Site Scripting with Example.

WordPress clients can likewise briefly disable remarks meanwhile until the patch has been issued by the WordPress security group.

Source: Wordpress