Presentation given at Wordcamp London 2017 to raise awareness of Wordpress malware, what it's all about and best practice to prevent sites being sompromised

1. WordPress Malware
Owen Cutajar
(@OwenC)

2. Your lovely WordPress site …

3. looking not-so-lovely …

4. According to the FBI
“There are only two types of
companies: those that have been
hacked, and those that will be.”
Robert Mueller, FBI Director, 2012

5. Why?
Profit or Propaganda
Wordpress is an attractive target
Outdated version of WordPress
Large surface of attack across plugins/themes

6. Classes of attacks
Targeted attacks
Password cracking (brute force / dictionary attacks)
DDOS
Malware

7. Some terminology
Virus
Worm
Trojan Horse
Botnet
Malnet

8. Types of attacks
Defacing
Spam
Drive-by Downloads
Backdoors
Malicious redirects and embeds

9. Defacing

10. Spam

11. Drive-By Downloads

12. Backdoors

13. Malicious Redirects and
Embeds

14. How?
Exploits and vulnerabilities
Outdated software
Insecure credentials
Compromised host

15. Infection Demo
Local Samples
Tools:
Base64Decoder: https://www.base64decode.org/
Execute PHP: https://eval.in/

16. Cleaning an infected site
Manually
Wordfence demo

17. Protecting your site
Automatic updates
Security plugins
External scanning
User education
Two factor authentication
Off-site Backups
SSL on login page

18. References
Wordpress Vulnerability Database: http://wpvulndb.com
Wordfence: https://wordpress.org/plugins/wordfence/
Securi: https://sucuri.net/wordpress-security/
Cloudflare: https://www.cloudflare.com/
Me: @OwenC on Twitter, owencutajar on Skype