Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Researchers have discovered a spike in malware infecting thousands of WordPress web sites that use a popular image tool.
The attacks came to light after French media outlet the Poitou-Charentes Journal began hosting on malware on its WordPress site.
Avast senior researcher Jan Sirmer found attackers had exploited weak FTP server authentication credentials and a vulnerability in the TimThumb image resizer to upload malicious PHP files to the site.
The attack used the BlackHole exploit kit which redirected the web site's visitors to an external malware-hosting site.
An additional 3500 unique infected Word Press sites were detected by Avast redirecting visitors to malicious sites between August 28 – 31. During September it blocked redirects from 2515 WordPress sites, Sirmer said.
In total, some 151,000 users had been hit with the malicious redirect from other compromised WordPress sites.
"I expect October results will be similar,” Sirmer said.
“The Poitou-Charentes Journal is just one part of a much bigger attack. These compromised sites are part of a network which redirected vulnerable users to sites distributing an array of malware.”
The vulnerability in the TimThumb resizer identified in August exists in the way the tool fetches images from websites like Flickr and Photobucket.
The utility runs only a partial check on hostnames meaning hackers could upload and execute arbitrary php code in the .php cache directory.
Sirmer recommended WordPress sites employ strong login credentials. A fix was available for the TimThumb tool.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.