Menu
FBI says supposed ISIS sympathizers exploiting WordPress plugins

FBI says supposed ISIS sympathizers exploiting WordPress plugins

The plugins are low-hanging fruit, but the attacks have been widespread and disruptive, the FBI said

The Federal Bureau of Investigation warned on Tuesday that attackers claiming to be sympathetic to the extremist group ISIS are targeting websites that have vulnerable WordPress plugins.

The content management system has a thriving community of third-party developers who have created some 37,000 plugins, but occasionally security vulnerabilities in one can put a large number of websites at risk.

The vulnerabilities can allow the hackers to gain unauthorized access, inject scripts or install malware on the affected sites, according to an advisory published by the FBI's Internet Crime Complaint Center. The attackers have hit news organizations, religious institutions, commercial and government websites.

The defacements have occurred on websites that share some of the common WordPress plugins with vulnerabilities that are easily exploited, the FBI said.

"Although the defacements demonstrate low-level hacking sophistication, they are disruptive and often costly in terms of lost business revenue and expenditures on technical services to repair infected computer systems," the advisory said.

The attackers voice support for ISIS, sometimes referred to as ISIL, "to gain more notoriety than the underlying attack would have otherwise garnered," the FBI said.

On Tuesday, the security company Sucuri issued an advisory for a flaw it found in the WP-Super-Cache plugin, which delivers static HTML files of WordPress pages stripped of PHP scripts for improved loading times.

A cross-site scripting vulnerability in the plugin could allow an attacker to add a new administrator to a site or inject a backdoor using WordPress's theme edition tools. As many as a million WordPress sites use the plugin.

In late February, Sucuri said the same number of WordPress sites were vulnerable to takeover due to a flaw in another analytics plugin called WP-Slimstat.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags WordpressExploits / vulnerabilitiesU.S. Federal Bureau of Investigation

Featured

Slideshows

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

The leading female front runners of the New Zealand ICT industry joined together for the annual Reseller News Women in ICT Awards event at the Hilton in Auckland, during which hundreds of guests celebrated 13 outstanding individuals who won awards, chosen from more than 50 finalists representing over 30 organisations.

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards
Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

More than 500 channel leaders gathered in Auckland on 21 October at the ​Reseller News Innovation Awards ​2020 to celebrate the achievements of the New Zealand technology industry's top partners, start-ups, vendors, distributors and individuals.

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners
Show Comments