Menu
FBI says supposed ISIS sympathizers exploiting WordPress plugins

FBI says supposed ISIS sympathizers exploiting WordPress plugins

The plugins are low-hanging fruit, but the attacks have been widespread and disruptive, the FBI said

The Federal Bureau of Investigation warned on Tuesday that attackers claiming to be sympathetic to the extremist group ISIS are targeting websites that have vulnerable WordPress plugins.

The content management system has a thriving community of third-party developers who have created some 37,000 plugins, but occasionally security vulnerabilities in one can put a large number of websites at risk.

The vulnerabilities can allow the hackers to gain unauthorized access, inject scripts or install malware on the affected sites, according to an advisory published by the FBI's Internet Crime Complaint Center. The attackers have hit news organizations, religious institutions, commercial and government websites.

The defacements have occurred on websites that share some of the common WordPress plugins with vulnerabilities that are easily exploited, the FBI said.

"Although the defacements demonstrate low-level hacking sophistication, they are disruptive and often costly in terms of lost business revenue and expenditures on technical services to repair infected computer systems," the advisory said.

The attackers voice support for ISIS, sometimes referred to as ISIL, "to gain more notoriety than the underlying attack would have otherwise garnered," the FBI said.

On Tuesday, the security company Sucuri issued an advisory for a flaw it found in the WP-Super-Cache plugin, which delivers static HTML files of WordPress pages stripped of PHP scripts for improved loading times.

A cross-site scripting vulnerability in the plugin could allow an attacker to add a new administrator to a site or inject a backdoor using WordPress's theme edition tools. As many as a million WordPress sites use the plugin.

In late February, Sucuri said the same number of WordPress sites were vulnerable to takeover due to a flaw in another analytics plugin called WP-Slimstat.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags U.S. Federal Bureau of InvestigationsecurityWordpressExploits / vulnerabilities

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments