- Iguanas are falling from trees—and people are selling them online for food 2 Years Ago
- 75,000 sign petition to fire Wendy Williams after ‘cleft lip’ comment about Joaquin Phoenix Today 12:30 PM
- Kim Kardashian says Kylie Jenner’s setting spray is ‘cheap sh*t’ Today 11:59 AM
- Trump continues to demand Apple unlock iPhones for the government Today 11:46 AM
- Police officer suspended after video of a handcuffed Delonte West surfaces Today 11:33 AM
- ‘Girls don’t want a boyfriend’ meme leaves boyfriends in 2019 Today 11:21 AM
- Are these tweets about ‘The Bachelor’ or Trump’s impeachment? Today 10:45 AM
- Likely file Saudi prince sent to Jeff Bezos’ to hack his phone revealed Today 10:10 AM
- Will Olivia Jade have to testify against her mother, Lori Loughlin, in bribery trial? Today 10:07 AM
- Gina Rodriguez slammed for promoting ‘American Dirt’ Today 9:26 AM
- Netflix says ‘The Witcher’ is its biggest show. Is it really? Today 8:59 AM
- Tulsi Gabbard sues Hillary Clinton for podcast comments Today 8:53 AM
- Lizzo reps Beyoncé’s Ivy Park collection in adult-themed TikTok Today 7:58 AM
- Netflix’s ‘Eye for an Eye’ is a fun but messy thriller about revenge Today 7:00 AM
- Which 2020 Democratic candidates post the most cringe? Today 6:30 AM
Hackers have targeted more than 2,000 WordPress websites to steal login credentials and tax visitors’ computers to mine cryptocurrency, researchers at security firm Sucuri discovered recently. WordPress is the one of the most popular content management systems (CMS), powering more than 25 percent of the websites on the internet, which means more websites might be at risk.
What we know about the attacks
Using this method, the attackers have managed to infect the pages of targeted websites with a keylogger, a malware the records keystrokes and sends them to the attacker’s server. This enables the hackers to steal all data entered in the website’s forms, including the login credentials of the administrator and other users.
The hackers have separately infected the WordPress frontend with CoinHive, an in-browser cryptojacker that targets the website’s visitors. CoinHive secretly uses the CPU of visitors to mine cryptocurrency for the attackers. If your website is infected, visitors will feel a sudden slowing down of their computers and smartphones. Cryptocurrency miners also drain smartphone batteries.
Sucuri did not say how the attackers managed to infect the websites. But such attacks usually occur on websites running older versions of WordPress (the current version is 4.9.2) or containing insecure plugins. WordPress has a very popular market for plugins and extensions. The official WordPress website hosts more than 50,000 plugins, and thousands of others can be acquired from other sources. These plugins are often poorly secured, containing exploitable vulnerabilities.
In December 2017, Sucuri found a similar attack that affected more than 5,500 websites. The domain hosting that attack (cloudflare[.]solutions) has long since been disabled. However, as researchers from Sucuri point out, the reinfection rate shows that there are still many sites that have failed to properly protect themselves after the original infection. “It’s possible that some of these websites didn’t even notice the original infection,” the blog post reads. Future attacks might infect more websites.
How to protect yourself
The first step to prevent your WordPress blog from being infected is to make sure you’re running the latest version of the engine and plugins. WordPress.com-hosted websites are automatically updated. If you’re using another hosting service, WordPress will warn you if a new version is available when you log in to your dashboard.
Updates will protect you from future attacks. To make sure your WordPress installation hasn’t already been infected, you must scan core files and database tables for recent and suspicious modifications and return them to their original version. The process isn’t trivial, but Sucuri has a page that guides you through the steps to find and remove infections.
If you don’t run a WordPress website but are worried about browsing to an infected website that will drain your CPU and battery to fill the pockets of anonymous hackers, you can install NoCoin, a browser extension that prevents cryptocurrency miners from running on your machine.
Ben Dickson is a software engineer and founder of TechTalks. His work has been published by TechCrunch, VentureBeat, the Next Web, PC Magazine, Huffington Post, and Motherboard, among others.