- Is Trump defiling the U.S. flag in this MAGA dude’s artwork? Sunday 4:41 PM
- White woman claims she invented sleep bonnets, selling them for $100 Sunday 4:03 PM
- Even real cats are transfixed by the enigma that is the ‘Cats’ trailer Sunday 3:04 PM
- Wait, how tall is Peppa Pig? Sunday 1:55 PM
- Twitter suspends Iranian state media outlets for harassing members of a religious minority Sunday 1:06 PM
- Pro-MAGA pageant queen stripped of title over ‘offensive’ tweets Sunday 11:52 AM
- Marvel unveiled its Phase 4 plans at San Diego Comic-Con Sunday 9:16 AM
- How a queer Instagram is helping fight the opioid epidemic in Appalachia Sunday 6:30 AM
- Philadelphia to fire 13 officers for racist, violent Facebook posts Saturday 6:12 PM
- Nick Offerman is so down to play every single role in ‘Cats’ Saturday 4:27 PM
- Woman documents how airport staff broke her wheelchair Saturday 3:04 PM
- Funeral home allegedly posted photos of woman’s dead body on social media Saturday 1:56 PM
- Alinity Divine is being investigated after throwing her cat during stream (updated) Saturday 12:04 PM
- ‘Comedians In Cars Getting Coffee’ returns with Seinfeld making a racist joke about China Saturday 10:26 AM
- YouTubers Eugenia Cooney and Shane Dawson make a joint comeback Saturday 9:06 AM
Hackers are infecting WordPress websites to mine cryptocurrencies
Here’s how you can protect yourself.
Hackers have targeted more than 2,000 WordPress websites to steal login credentials and tax visitors’ computers to mine cryptocurrency, researchers at security firm Sucuri discovered recently. WordPress is the one of the most popular content management systems (CMS), powering more than 25 percent of the websites on the internet, which means more websites might be at risk.
What we know about the attacks
Using this method, the attackers have managed to infect the pages of targeted websites with a keylogger, a malware the records keystrokes and sends them to the attacker’s server. This enables the hackers to steal all data entered in the website’s forms, including the login credentials of the administrator and other users.
The hackers have separately infected the WordPress frontend with CoinHive, an in-browser cryptojacker that targets the website’s visitors. CoinHive secretly uses the CPU of visitors to mine cryptocurrency for the attackers. If your website is infected, visitors will feel a sudden slowing down of their computers and smartphones. Cryptocurrency miners also drain smartphone batteries.
Sucuri did not say how the attackers managed to infect the websites. But such attacks usually occur on websites running older versions of WordPress (the current version is 4.9.2) or containing insecure plugins. WordPress has a very popular market for plugins and extensions. The official WordPress website hosts more than 50,000 plugins, and thousands of others can be acquired from other sources. These plugins are often poorly secured, containing exploitable vulnerabilities.
In December 2017, Sucuri found a similar attack that affected more than 5,500 websites. The domain hosting that attack (cloudflare[.]solutions) has long since been disabled. However, as researchers from Sucuri point out, the reinfection rate shows that there are still many sites that have failed to properly protect themselves after the original infection. “It’s possible that some of these websites didn’t even notice the original infection,” the blog post reads. Future attacks might infect more websites.
How to protect yourself
The first step to prevent your WordPress blog from being infected is to make sure you’re running the latest version of the engine and plugins. WordPress.com-hosted websites are automatically updated. If you’re using another hosting service, WordPress will warn you if a new version is available when you log in to your dashboard.
Updates will protect you from future attacks. To make sure your WordPress installation hasn’t already been infected, you must scan core files and database tables for recent and suspicious modifications and return them to their original version. The process isn’t trivial, but Sucuri has a page that guides you through the steps to find and remove infections.
If you don’t run a WordPress website but are worried about browsing to an infected website that will drain your CPU and battery to fill the pockets of anonymous hackers, you can install NoCoin, a browser extension that prevents cryptocurrency miners from running on your machine.
Ben Dickson is a software engineer and founder of TechTalks. His work has been published by TechCrunch, VentureBeat, the Next Web, PC Magazine, Huffington Post, and Motherboard, among others.