Website Security - It Begins With Good Posture

It Starts With Good Posture

Website Security (WordPress)

04/11/2023

@PEREZBOX

• Sucuri, Inc.– @sucuri_security– @sucurisupport– @sucurilabs– @perezbox

• Specialization:– Website Security– Incident Handling

• Special Interests:– Brazilian JiuJitsu

Tony Perez | @perezbox | @sucuri_security 2

04/11/2023

• Website Security Company

• Global Operations

• Platform Agnostic (i.e., WordPress, Joomla, etc..)

• Scan 2M Unique Domains a Month

• Block 4M web attacks a Month

• Remediate 400 – 500 websites a day

• Signature / Heuristic Based

• 24/7 operations

04/11/2023

Statistics

04/11/2023

Anatomy of Malicious Websites

Malicious WebsitesLegitimate Websites

04/11/2023

Legitimate Websites

Not-ExploitableExploitable

1 in 8 - Critical Vulnerability

04/11/2023

Hacks Affecting Users

04/11/2023

Top 4 Symptoms

• Malicious Redirects (i.e., abuse your traffic)• Backdoors (i.e., Bypass Access Controls)• Phishing (i.e., Spear Phishing Campaigns)• Search Engine Poisoning (i.e., Pharma, etc…)

….. Obviously many more, but these are the most prevalent…

@perezbox | @sucuri_security

Malicious Redirect

Malicious Redirects• Easy / Medium to Detect

– Be mindful of conditionals• Looking for Integrity Issues

– Has something been modified?

• Common location[s]:– .htaccess– Index.php– Footer.php– Header.php

• Biggest Issue– Redirectors are becoming highly complex– Employing heavy conditional elements

Phishing

Phishing, Cntd..

• Difficult to Detect Remotely• Looking for Integrity Issues

– Is something somewhere it doesn’t belong?

• Common location[s]:– WP-Includes– Theme Directories

• Biggest Issue– It can be anywhere– Fully contained

Backdoors

Backdoors, cntd…• Can’t detect remotely, only locally

• Looking for Integrity Issues – Is something somewhere it doesn’t

belong?

• Common location[s]:– WP-Includes– Root Directory

• Biggest Issue– Allows attacker to bypass your

access controls– Provides full control of the

environment

• Common terms:– Is_bot– Eval– Base64_decode– Fopen– Fclose– readfile– Edoced_46esad– Exec– System– Shell_exec– Gzuncompress– popen– FilesMan

grep -RPl --include=*.{php} "(system|exec|passthru|shell_exec|base64_decode|eval|) *\(" /var/www

Example of Complexity

Search Engine Poisoning

Search Engine Poisoning, cntd.. • Targets Search Engines (i.e., Google, Bing, Yahoo)

• Looking for Integrity Issues – Have your posts / pages been modified?

• Common location[s]:– Index.php (root, theme, plugins, etc..)– Header.php– Footer.php– Embedded in Database (Posts / Pages)

• Biggest Issue– Continuous to evolve– Highly conditional– Not within visible range – often offscreen

Indicators of a HackSearch Engines have gotten pretty good at detecting issues –

Google blacklists over 10 thousand websites a day.

04/11/2023

Anatomy of Attacks

04/11/2023

Phase of an Attack

Recon Identify Attack Decisions Sustain

Use for malware? Pat of a zombie network? Data breach?

What kind of website do you have?

04/11/2023

Automated Attacks

WP-ADMIN

Themes / Plugins Payload

Exploiting Access Control

04/11/2023

Distribution Mechanism

Malicious Links

Social Media

Email Links Website

Text Messages

04/11/2023

There’s a Tool for that

• Malware as a Service (MaaS) – Yes, pay someone to

hack for you

• Different tools to break in and generate payloads– Brute force and

vulnerability exploits Malware Payloads

04/11/2023

Happening To Everyone

04/11/2023

It’s About Posture

04/11/2023

Begins with Posture

Posture

“Risk will never be zero, but it can be reduced”

04/11/2023

It’s About Good Posture

Security Posture

Principles

Access

Vulnerabilities

04/11/2023

Layered Defenses

Protection Auditing

Detection Sustainment

04/11/2023

Defense in Depth

“…a concept in which multiple layers of security controls (defenses) are placed throughout an

information technology (IT) system. Its intent is to provide redundancy in the event a security control fails or a vulnerability is exploited…”

04/11/2023

Access – P@ssw0rd

• Passwords

Complex – Long - Unique

04/11/2023

Enforce Strong Credentials

04/11/2023

Auditing (Monitor Activity)

04/11/2023

Auditing Questions

Tony Perez | @perezbox | @sucuri_security | #JoomlaDayAtlanta 34

• Understand what is going on at all time– Who is logging in?– Who is trying to log in?– What files are changing?– Has a post been created?– Has a page been created?– Are there any integrity issues?

04/11/2023

Principle of Least Privileged

“requires that in a particular abstraction layer of a computing environment, every module

(such as a process, a user or a program depending on the subject) must be able to

access only the information and resources that are necessary for its legitimate purpose.”

04/11/2023

Understand Your Roles

04/11/2023

Hardening – Kill PHP

PHP Execution, disable it:

/wp-includes /wp-content▪ /themes▪ /plugins▪ /uploads

04/11/2023

Disable Plugin / Theme Editor

• WP-CONFIG File Modification

#Disable Plugin / Theme EditorDefine(‘DISALLOW_FILE_EDIT’,true);

04/11/2023

Brute Force Attacks

04/11/2023

Backups – It’s Your Safety Net

04/11/2023

Software Vulnerabilities

• Stay current with the latest vulnerabilities:– Secure - http://wordpress.org/plugins/secure/

04/11/2023

Stay Current (Update)

04/11/2023

Website Firewalls

• Stay ahead of Software Vulnerabilities

04/11/2023

Ensure Integrity of Connection

• https://www.getcloak.com/ | @getcloak

04/11/2023

Google Webmaster

04/11/2023

Simple Steps to Reduce Risk

1. Employ Website Firewall2. Don’t let WordPress write to

itself3. Filter Access by IP 4. Use a dedicated server / VPS5. Monitor all Activity (Logging)6. Enable SSL for transactions7. Keep environment current

(patched)8. No Soup Kitchen Servers

1. Connect Securely – SFTP / SSH

2. Authentication Keys / wp-config

3. Use Trusted Sources4. Use a local Antivirus – MAC

too5. Permissions - D 755 | F 6446. Least Privileged Principles7. Accountability8. Backups – Include Database

Ideal implementations:The Bare Minimum:

04/11/2023

Notable ResourcesName Tool

Sucuri Blog http://blog.sucuri.net

Sucuri TV http://sucuri.tv

Malware Scanner http://sitecheck.sucuri.net

Malware Scanner http://unmaskparasites.com

Badware Busters https://badwarebusters.org

Google Forums http://productforums.google.com/forum/#!categories/webmasters/malware--hacked-sites

Google Webmaster Tools http://support.google.com/webmasters/bin/answer.py?hl=en&answer=163633

Secunia Security Advisories http://secunia.com/community/advisories/search/?search=wordpress

Exploit-DB http://www.exploit-db.com/search/?action=search&filter_description=Wordpress&filter_platform=31

WordPress Hacked FAQ http://codex.wordpress.org/FAQ_My_site_was_hacked

WordPress Hardening http://codex.wordpress.org/Hardening_WordPress

04/11/2023

Dealing with a Hack

Dealing with Malware http://blog.sucuri.net/2012/10/dealing-with-todays-wordpress-malware.html

Leveraging Google Webmaster Tools http://www.unmaskparasites.com/malware-warning-guide/

Google Webmaster Tools (Hacked) http://www.google.com/webmasters/hacked/

Understanding Google’s Blacklists http://blog.sucuri.net/2013/11/understanding-googles-blacklist-cleaning-your-hacked-website-and-removing-from-blacklist.html Clearing Your Website with Free

Scannerhttp://blog.sucuri.net/2013/10/cleaning-up-your-wordpress-site-with-the-free-sucuri-plugin.html

WordPress Tips & Tricks http://blog.sucuri.net/2012/07/website-malware-removal-wordpress-tips-tricks.html

04/11/2023

Sucuri, Inc.

Tony Perez

http://sucuri.nethttp://blog.sucuri.net

@sucurilabs | @sucurisupport

Website Security - It Begins With Good Posture

Technology

Posture Presentation

Change Posture

Posture for Kids POSTURE FOR KIDS Children · POSTURE FOR KIDS The Importance of Posture Good posture is when our body maintains a balance with a minimal muscle effort. Assessing

POSTURE ANALYSISccikinesiology.weebly.com/uploads/6/2/2/...posture... · POSTURE ANALYSIS What is good posture? Posture is the position in which you hold your body upright against

Posture Statement

Capstone Website project - walkthru begins P40

Typing Tutor. Overview Posture Hand placement Exercises Website Quick Commands (Windows)

Good Posture

Posture ppt

Balance & Posture

Posture Pedia

Posture analysis

Posture القوام

Meditation Posture

Steadicam Posture

Women’s Home Workout Bible - Exercise ETC!exerciseetc.com/file/womens-home-workout-bible.pdfWomen’s Home Workout Bible ... The exercise begins with erect posture, core activation,

Ma leçon de yoga - Accueil - Librairie Eyrolles · Posture du poisson Posture de torsion au sol. ... Posture de la demi-chandelle Posture de la barque Posture de la grenouille

Posture & Physiotherapy

Posture & Pregnancy

Website walkthru begins Page 40 - Capstone Project