Website Security - It Begins With Good Posture

It Starts With Good Posture
Website Security (WordPress)

@PEREZBOX
• Sucuri, Inc.
– @sucuri_security
– @sucurisupport
– @sucurilabs
– @perezbox
• Specialization:
– Website Security
– Incident Handling
• Special Interests:
– Brazilian JiuJitsu
6/9/2014
Tony Perez | @perezbox |
@sucuri_security
2

• Website Security Company
• Global Operations
• Platform Agnostic (i.e., WordPress, Joomla, etc..)
• Scan 2M Unique Domains a Month
• Block 4M web attacks a Month
• Remediate 400 – 500 websites a day
• Signature / Heuristic Based
• 24/7 operations
6/9/2014
@sucuri_security
3

Statistics
6/9/2014
@sucuri_security
4

Anatomy of Malicious Websites
Malicious Websites
Legitimate Websites
6/9/2014
@sucuri_security
5

Legitimate Websites
Not-Exploitable
Exploitable
6/9/2014
@sucuri_security
6
1 in 8 - Critical Vulnerability

Hacks Affecting Users
6/9/2014
@sucuri_security
7

Top 4 Symptoms
6/9/2014
@sucuri_security
8
• Malicious Redirects (i.e., abuse your traffic)
• Backdoors (i.e., Bypass Access Controls)
• Phishing (i.e., Spear Phishing Campaigns)
• Search Engine Poisoning (i.e., Pharma, etc…)
….. Obviously many more, but these are the most prevalent…

Malicious Redirect
@perezbox | @sucuri_security

Malicious Redirects
• Easy / Medium to Detect
– Be mindful of conditionals
• Looking for Integrity Issues
– Has something been modified?
• Common location[s]:
– .htaccess
– Index.php
– Footer.php
– Header.php
• Biggest Issue
– Redirectors are becoming highly complex
– Employing heavy conditional elements

Phishing

Phishing, Cntd..
• Difficult to Detect Remotely
– Is something somewhere it doesn’t belong?
– WP-Includes
– Theme Directories
• Biggest Issue
– It can be anywhere
– Fully contained

Backdoors

Backdoors, cntd…
• Can’t detect remotely, only locally
– Is something somewhere it doesn’t
belong?
– WP-Includes
– Root Directory
• Biggest Issue
– Allows attacker to bypass your
access controls
– Provides full control of the
environment
• Common terms:
– Is_bot
– Eval
– Base64_decode
– Fopen
– Fclose
– readfile
– Edoced_46esad
– Exec
– System
– Shell_exec
– Gzuncompress
– popen
– FilesMan
grep -RPl --include=*.{php} "(system|exec|passthru|shell_exec|base64_decode|eval|) *(" /var/www

Example of Complexity

Search Engine Poisoning

Search Engine Poisoning, cntd..
• Targets Search Engines (i.e., Google, Bing, Yahoo)
– Have your posts / pages been modified?
– Index.php (root, theme, plugins, etc..)
– Header.php
– Footer.php
– Embedded in Database (Posts / Pages)
• Biggest Issue
– Continuous to evolve
– Highly conditional
– Not within visible range – often offscreen

Indicators of a Hack
Search Engines have gotten pretty good at detecting issues –
Google blacklists over 10 thousand websites a day.

Anatomy of Attacks
6/9/2014
@sucuri_security
19

Phase of an Attack
6/9/2014
@sucuri_security
20
 Use for malware?
 Pat of a zombie network?
 Data breach?
What kind of website do you have?

Automated Attacks
6/9/2014
@sucuri_security
21
 Exploiting Access Control

Distribution Mechanism
6/9/2014
@sucuri_security
22

There’s a Tool for that
• Malware as a Service
(MaaS)
– Yes, pay someone to
hack for you
• Different tools to break
in and generate
payloads
– Brute force and
vulnerability exploits
Malware Payloads
6/9/2014
@sucuri_security
23

Why?
6/9/2014
@sucuri_security
24

Happening To Everyone
6/9/2014
@sucuri_security
25

It’s About Posture
6/9/2014
@sucuri_security
26

Begins with Posture
6/9/2014
@sucuri_security
27
Posture
Risk
“Risk will never be zero, but it can be reduced”

It’s About Good Posture
6/9/2014
@sucuri_security
28

Layered Defenses
6/9/2014
@sucuri_security
29
Protection Auditing
Detection Sustainment

Defense in Depth
“…a concept in which multiple layers of security
controls (defenses) are placed throughout an
information technology (IT) system. Its intent is
to provide redundancy in the event a security
control fails or a vulnerability is exploited…”
6/9/2014
@sucuri_security
30

Access – P@ssw0rd
• Passwords
6/9/2014
@sucuri_security
31
Complex – Long - Unique

Enforce Strong Credentials
6/9/2014
@sucuri_security
32

Auditing (Monitor Activity)
6/9/2014
@sucuri_security
33

Auditing Questions
6/9/2014
@sucuri_security | #JoomlaDayAtlanta
34
• Understand what is going on at all time
– Who is logging in?
– Who is trying to log in?
– What files are changing?
– Has a post been created?
– Has a page been created?
– Are there any integrity issues?

Principle of Least Privileged
“requires that in a particular abstraction layer
of a computing environment, every module
(such as a process, a user or a program
depending on the subject) must be able to
access only the information and resources that
are necessary for its legitimate purpose.”
6/9/2014
@sucuri_security
35

Understand Your Roles
6/9/2014
@sucuri_security
36

Hardening – Kill PHP
6/9/2014
@sucuri_security
37
 PHP Execution, disable it:
 /wp-includes
 /wp-content
▪ /themes
▪ /plugins
▪ /uploads
<Files *.php>
Deny from all
</Files>

Disable Plugin / Theme Editor
• WP-CONFIG File Modification
#Disable Plugin / Theme Editor
Define(‘DISALLOW_FILE_EDIT’,true);
6/9/2014
@sucuri_security
38

Brute Force Attacks
6/9/2014
@sucuri_security
39

Backups – It’s Your Safety Net
6/9/2014
@sucuri_security
40

Software Vulnerabilities
• Stay current with the latest vulnerabilities:
– Secure - http://wordpress.org/plugins/secure/
6/9/2014
@sucuri_security
41

Stay Current (Update)
6/9/2014
@sucuri_security
42

Website Firewalls
6/9/2014
@sucuri_security
43
• Stay ahead of Software Vulnerabilities

Ensure Integrity of Connection
6/9/2014
@sucuri_security
44
• https://www.getcloak.com/ | @getcloak

Google Webmaster
6/9/2014
@sucuri_security
45

Simple Steps to Reduce Risk
1. Employ Website Firewall
2. Don’t let WordPress write to
itself
3. Filter Access by IP
4. Use a dedicated server / VPS
5. Monitor all Activity (Logging)
6. Enable SSL for transactions
7. Keep environment current
(patched)
8. No Soup Kitchen Servers
6/9/2014
@sucuri_security
46
1. Connect Securely – SFTP /
SSH
2. Authentication Keys / wp-
config
3. Use Trusted Sources
4. Use a local Antivirus – MAC
too
5. Permissions - D 755 | F 644
6. Least Privileged Principles
7. Accountability
8. Backups – Include Database
Ideal implementations:The Bare Minimum:

Notable Resources
Name Tool
Sucuri Blog http://blog.sucuri.net
Sucuri TV http://sucuri.tv
Malware Scanner http://sitecheck.sucuri.net
Malware Scanner http://unmaskparasites.com
Badware Busters https://badwarebusters.org
Google Forums http://productforums.google.com/forum/#!categories/webmasters/malware--hacked-
sites
Google Webmaster Tools http://support.google.com/webmasters/bin/answer.py?hl=en&answer=163633
Secunia Security Advisories http://secunia.com/community/advisories/search/?search=wordpress
Exploit-DB http://www.exploit-
db.com/search/?action=search&filter_description=Wordpress&filter_platform=31
WordPress Hacked FAQ http://codex.wordpress.org/FAQ_My_site_was_hacked
WordPress Hardening http://codex.wordpress.org/Hardening_WordPress
6/9/2014
@sucuri_security
47

Dealing with a Hack
6/9/2014
@sucuri_security
48
Dealing with Malware http://blog.sucuri.net/2012/10/dealing-with-todays-
wordpress-malware.html
Leveraging Google Webmaster Tools http://www.unmaskparasites.com/malware-
warning-guide/
Google Webmaster Tools (Hacked) http://www.google.com/webmasters/hacked/
Understanding Google’s Blacklists http://blog.sucuri.net/2013/11/understanding-
googles-blacklist-cleaning-your-hacked-website-and-
removing-from-blacklist.html
Clearing Your Website with Free
Scanner
http://blog.sucuri.net/2013/10/cleaning-up-your-
wordpress-site-with-the-free-sucuri-plugin.html
WordPress Tips & Tricks http://blog.sucuri.net/2012/07/website-malware-
removal-wordpress-tips-tricks.html

Sucuri, Inc.
Tony Perez
http://sucuri.net
http://blog.sucuri.net
@sucurilabs | @sucurisupport
6/9/2014
@sucuri_security
49

Website Security - It Begins With Good Posture

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (20)

Semelhante a Website Security - It Begins With Good Posture

Semelhante a Website Security - It Begins With Good Posture (20)

Mais de Tony Perez

Mais de Tony Perez (7)

Último

Último (20)

Website Security - It Begins With Good Posture