WordPress Pingback Vulnerability Serves DDoS attack feature
Accunetix a web application security company reported vulnerabilities found in the Wordpress Pingback feature. According to report, Pingback vulnerability exists in the WordPress blogging platform that could leak information and lead to distributed denial of service (DDoS) attacks.
"WordPress has an XMLRPC API that can be accessed through the xmlrpc.php file. When WordPress is processing pingbacks, it's trying to resolve the source URL, and if successful, will make a request to that URL and inspect the response for a link to a certain WordPress blog post. If it finds such a link, it will post a comment on this blog post announcing that somebody mentioned this blog post in their blog." Bogdan Calin explained.
Pingback is one of three types of linkbacks, methods for Web authors to request notification when somebody links to one of their documents. This enables authors to keep track of who is linking to, or referring to their articles. Some weblog software, such as Movable Type, Serendipity, WordPress, and Telligent Community, support automatic pingbacks where all the links in a published article can be pinged when the article is published.
A new tool has been released that automates the pingback vulnerability autonomously, distributed on the software development site Github as "WordpressPingbackPortScanner" . That tool exposes the API and lets attackers scan other hosts, multiple WordPress blogs and with a specialized URL, reconfigure routers.
Tool description - "Wordpress exposes a so called Pingback API to link to other blogposts. Using this feature you can scan other hosts on the intra- or internet via this server. You can also use this feature for some kind of distributed port scanning: You can scan a single host using multiple Wordpress Blogs exposing this API."
The bug is already reported on Wordpress community, but Softpedia notice that the ticket was closed at the time after someone argued that “there are so many ways to orchestrate a DDOS attack.”
All the wordpress blogs are at risk,can be heavily abused by attackers. Since the Wordpress also supports URL credentials , the attacker can use a link like
http://admin:admin@192.168.0.1/changeDNS.asp?newDNS=aaaa to reconfigure internal routers.
He also says that disabling the Pingback feature won't fix the solution ,the ultimate solution is a patch.
Batchwiper malware, new virus targets Iranian computersIranian CERT is sounding the alarm over another bit of data-deleting malware it's discovered on PCs in the country. Dubbed Batchwiper, the malware systematically wipes any drive partitions starting with the letters D through I Drive, along with any files stored on the Windows desktop of the user who is logged in when it's executed
Why naming Batchwiper ? The name was chosen because the malware is packed in a batch file.
The malware initiates its data wiping routine on certain dates, the next one being Jan. 21 2013. However, the dates of Oct. 12, Nov. 12 and Dec. 12, 2012, were also found in the malware's configuration, suggesting that it may have been in distribution for at least two months.
GrooveMonitor.exe is the original dropper, which is a self-extracting RAR file, once executed it extracts the following files:
-- \WINDOWS\system32\SLEEP.EXE, md5: ea7ed6b50a9f7b31caeea372a327bd37
-- \WINDOWS\system32\jucheck.exe, md5: c4cd216112cbc5b8c046934843c579f6
-- \WINDOWS\system32\juboot.exe, md5: fa0b300e671f73b3b0f7f415ccbe9d41
Then juboot.exe is executed, which create and execute following batch file :
\Documents and Settings\%User%\Local Settings\Temp\1.tmp\juboot.bat
According to the Iranian CERT advisory, "However, it is not considered to be widely distributed. This targeted attack is simple in design and it is not any similarity to the other sophisticated targeted attacks."
In past, Iran has accused the US and Israel of being behind the Flame attack as well as the Stuxnet virus. Such attacks are seen as en effort to cripple the Islamic Republic's nuclear program, which Western countries fear is being used to make a bomb.
Holiday deals can really be hiding hacker surprises It is that time of year which everybody loves. It is the holiday season and you will start to see a lot more people express good attitudes and wish everyone else a happy new year. As a matter of fact it may be hard to think that with all of this much goodwill in the air there is someone out there who is trying to take advantage of that. But the fact is no matter what time of year it is there are always going to be bad guys around every corner and they will try to stalk their prey at anytime. It does not matter what time of year it is, the bad guys like to work all year round and you always have to be on the lookout for them.
As a matter of fact this time of year is a very good time when it comes to black hat hackers. This is because there are so many people online around this time and they are looking for a bunch of deals for their Christmas shopping. The retailers really go full throttle around this time of year and they want to be able to make as much money as they can. This time of year may be known as the holidays to most people but to people in the financial industry it is known as the fourth quarter and it is the most important quarter of the year. They want to be able to make as much money as they can throughout this time period so they will offer deep discounts wherever they can.
And since you have so many people online trying to advantage of these deep discounts that are being offered, it is the perfect time for a black hat hacker to try and strike. With so many emails and so much different types of information being sent back and forth it is hard for the average person to be able to discern what is real and what is not. They do not know which emails are really offering a real deal and which ones are fake and trying to get something out of you. Normally you would tell a person that if a deal seems to be too good to be true that it probably is and there are some bad guys behind the offer. But at this time of year all of the deals seem too good to be true and it is hard to tell which one is a bad deal and which on is a good deal.
That is why as a consumer, you have to keep a more vigilant eye out than you normally would. Yes, the bad guys are going to be out there in full force and you have to make sure you are more prepared than ever. When you go to visit websites you have to make sure that the domain is correct and that it matches the website that you thought you were going to. If it does not match the domain that you thought you were going to then you should leave right away without clicking on anything. And if you get an offer in your email account then you should not click the link in the email. What you should do is type the website in directly and go to it that way. You never know where a link in your email account is going to take you. So make sure that you do it the right way so that you know where you are going.
When it comes to the holidays the bad guys do not take a day off. So make sure that your common sense does not take a day off as well.