Shoemoney.com Hacked?



I wonder how much of their 10k+ visitors a day come from their hacking efforts.
 
It was pretty crafty how it was done. I sent over the exploit to wordpress and they said they are investigating it. I have been able to douplicate it on 2 fresh installs so.... watch your rpc file. Newest version of wordpress is vulnerable.

Good timing on their part as most of my team with access to fix it was in the air traveling to vegas again.

For those asking for screenshots it wasnt defaced or anything... a meta refresh was injected in every post on shoemoney.com.

To fix we immediatly made mysql read only and investigated until we found the source. Then restored sql from a backup.
 
ShoeMoney said:
It was pretty crafty how it was done. I sent over the exploit to wordpress and they said they are investigating it. I have been able to douplicate it on 2 fresh installs so.... watch your rpc file. Newest version of wordpress is vulnerable.

Good timing on their part as most of my team with access to fix it was in the air traveling to vegas again.

For those asking for screenshots it wasnt defaced or anything... a meta refresh was injected in every post on shoemoney.com.

To fix we immediatly made mysql read only and investigated until we found the source. Then restored sql from a backup.
Click to expand...

So somehow someone exploited the the database via the XML-RPC remote publishing?
 
If it were my box, I wouldn't blame the chinese as I have all of China and Korea blocked from my server. (lol, less of course the proxy from somewhere else, but most automated attacks don't).
Click to expand...
Not gonna help you. Most of the Chinese shit we deal with at work comes from either Turkish or Mexican proxies. Can't block those countries since they are our main customers =/
 
Edwin said:
Is there anything you can do using .htaccess to protect the rpc.php file?
Click to expand...

You could use allow and only allow certain ips to hit it... or you can rename it... but if you use any 3rd party stuff they will break


FYI Techcrunch got hacked this morning with the same thing exact thing

TechCrunch Hacked

We sent them our fix.

Still no response from wordpress although techcrunch getting hacked puts it on the board =P

The crazy thing about TC getting hacked is all the sites that syndicate TC posts (washington post, WSJ, Businessweek) all were redirecting to the torrent and port sites too.
 
Wordpress has a habit of updating every 2-3 weeks with stupid features while always leaving huge security exploits especially when you use plugins where the developers can't upgrade to the new system fast enough.
 
You must log in or register to reply here.
Top Bottom