Sucuri Doesn’t Have A Clue What Brute Forcing Actually Refers To

One of the problems we see when it comes to people making better choices on web security is that it easy for security companies that don’t have a clue what they are talking about to present themselves as having expertise they don’t have. For example, they can throw around technical terms that they clearly don’t understand, but that the public understandably doesn’t understand either, and it makes them sound like they actually know about security, when they don’t.

One example we keep seeing involves the term brute force attack, which refers to trying all possible password combination in attempt to login in to an account. It isn’t some obscure or exotic term, it has a Wikipedia page, but that doesn’t stop people from using it when actually referring to other types of password attacks.

Often times dictionary attacks, which involve trying to log in with a set of common passwords (things like “password”), are incorrectly identified as having been brute force attacks. The distinction isn’t just semantics, how you protect against those types of attacks is very different, so anybody dealing with web security that involves either of those, absolutely should know the difference. And again the term has a Wikipedia page, so it wouldn’t be hard to know what it is.

That brings us to the security company, Sucuri, which we have seen being quite a bad security company in many ways over the years. That clearly hasn’t changed. In a recent post describe how they did an experiment that was supposed to test how long it would take for successful brute force attacks of SSH logins:

A few weeks ago we ran an experiment to see how long it would take for some IPv4-only and IPv6-only servers to be compromised via SSH brute force attacks.

As they explain in the second paragraph of the post, their experiment involved them setting the password to “password”:

We configured five cloud servers on Linode and Digital Ocean with the root password set to “password.”  The idea was to see how long it would take before the servers were hacked.

To anyone who actually know what brute force attacks and dictionary attacks are, its obvious that they don’t actually know what they are talking about since that would be a password to test for dictionary attacks, not brute force attacks, but the public is unlikely to, especially as security companies keep referring to dictionary attacks as having been brute force attacks.

If you are interested in actual security, Sucuri’s lack of basic security knowledge, would be a good reason to look elsewhere.

Posted in Bad Security | Tagged , | Leave a comment

Where Are The Vulnerabilities That SiteLock’s Vulnerability Scanning Should Have Found?

In looking over things for a possible future post about the web security company SiteLock we have noticed that one of the features prominently promoted by its hosting “partners” when selling SiteLock’s services is vulnerability scanning. For example, at HostGator, one of their hosting “partners” that is also run by the owners of SiteLock, vulnerabilities scans of varying frequency are included in each package:

hostgator-sitelock-packages

It also promoted on their page for the services as helping to prevent hacks:

Make WordPress More Secure Great news for WordPress users! SiteLock's firewall and vulnerability scans help prevent hacks and automated attacks on this ever-more popular publishing platform.

What is missing on the “partners'” websites or SiteLock’s as far as we can tell is any evidence on the claimed effectiveness of their vulnerability scanning. Vulnerability scanning of the type that it appears SiteLock does, doesn’t have a reputation for being of much value. In a study (PDF) from 2014 that looked at vulnerability scanners tied to security seals (SiteLock has one of those and its accuracy has been poor from what we have seen), it was found that two of the 8 vulnerability scanners tested detected none of the vulnerabilities that existed on a website set up with a number of vulnerabilities, which was due to those scanners using third party software that “are not meant to discover vulnerabilities in web applications”. Five of the six remaining scanners only discovered a third or less of the vulnerabilities that existed.

If their vulnerability scanner was in fact detecting vulnerabilities we would expect to have seen evidence of it elsewhere. SiteLock claims that as of 2015 they were “serving over 1 million WordPress customers”. If there vulnerability scanning was actual effective we would expect that would have found quite a few vulnerabilities in plugins based on the number of vulnerabilities we see being discovered in WordPress plugins while collecting data for our Plugin Vulnerabilities service. But we are only aware of two vulnerabilities that they have discovered in recent times and both of those don’t appear to have been discovered during the running of their vulnerabilities scanner. By comparison over at the blog for our Plugin Vulnerabilities service we have over 90 posts for vulnerabilities we have discovered this year (some of the post include multiple vulnerabilities, so the total number of vulnerabilities is even higher). If their vulnerabilities scanner was discovering other vulnerabilities in plugins on website, even if SiteLock were not aware of it, we would expect to see some mentions of that in changelogs of the impacted plugins or discussions of the vulnerabilities and yet what we haven’t seen any reference to their scanning having identified any vulnerabilities and the vast majority of vulnerability disclosures and fixes we have reviewed can be traced back to a source that wasn’t their scanner.

Whether you are looking at SiteLock or another provider of security services and products you should look for evidence from the provider that products can perform as claimed, as we often see claims made that seem rather unbelievable and from some of the claims we have taken a look into they often turn out to be at least widely inaccurate.

Posted in Bad Security | Tagged | Leave a comment

Joomla Firewalls Are Not a Replacement For Properly Cleaning Up a Hacked Website

When it comes to the security of websites what we often see is that a lot of focus is add-on security products instead of focusing on doing the basics. The reality is doing the basics is going to do a lot more to protect you than any security products. As an example, over at our Plugin Vulnerabilities service we recently tested 11 WordPress security plugin against a very exploitable vulnerability in a plugin and found that only 2 of the plugins provided any protection and for those two we easily found a way to bypass them. By comparison, simply updating the plugin after the vulnerability was fixed would protect you from the vulnerability.

This type of wisdom recently came up in the context of a hacked Joomla website we brought in to clean up. We were originally contacted by someone involved with the website about the following warning they were receiving on the website from Chrome warning that “The site ahead contains malware”:

This site ahead contains malware

The warning referred to another website, so they were not sure if it was due to their website being hacked or if maybe the other website was hosted on the same server and being on the same server was causing the warning. The reason the warning mentioned another website was that it was a cross-site warning, which is shown when content is loaded from another website that is being flagged by Google for malware. In this case it was caused by the following malicious JavaScript code that was being included on the website’s pages:

malicious-javascript-code

We explained them what was going on (if you have a question related to a possible hacked website we are always available for free consultation to discuss it) and then we were brought in to clean up the website.

The JavaScript code shown before was easy to find because it stored in the index.php of the various templates on the website, without any obfuscation.

One of the next steps in the cleanup was determining how the code got on the website. While determining how a website is hacked is one of three important pieces of a proper hack cleanup, many, maybe most, companies doing hack cleanups don’t do this. Not to surprisingly the website where that doesn’t happen often get hacked again, and we are often brought in at that point to re-clean it.

What looked to be the cause of the malicious JavaScript code being added to the template files was a POST request to the file /libraries/fof/integration/joomla/general24.php. While that directory is one for core Joomla files, that file isn’t. Instead it was file a hacker had placed on the website at some point before, based on the last modified date it would appear it was placed there three months before. The logging doesn’t go back that far so we were unable to see how that file had been added to the website.

That was not the only malicious file on the website. One of the easiest to spot was one in the root directory of the installation, due to the filename, ee79bb.php, not being something you would expect to see there. There were also several malicious files that had been renamed so that could be executed. At that point we found out that website had been hacked before, but it not been cleaned in a professional manner before.

Firewall Extensions Didn’t Stop The Hacking

While the website had not been fully cleaned before, two firewalls had been added, RSFirewall! and the firewall that is part of Admin Tools. Neither of those protected against the request sent to the general24.php file or based on their logging look to have had any impact as a number of other malicious look to have been added on the website over a period of months. That isn’t necessarily their fault, as once a hacker has some access it is much harder to detect that the requests are malicious in nature, but it is a reminder that security add-ons are not a replacement for proper security practices.

It is worth noting that with both RSFirewall! and the firewall that is part of Admin Tools, bold claims are made to their security capability with being backed up by and evidence. For RSFirewall! is describe thusly:

RSFirewall! is the most advanced Joomla! security service that you can use to protect your Joomla! website from intrusions and hacker attacks. RSFirewall! is backed up by a team of experts that are trained to be always up to date with the latest known vulnerabilities and security updates.

Nowhere is there anything that actually backs up those claims. Also troubling is the fact that it boasts protection against brute force attacks, despite those not actually happening.

Admin Tools firewall is describe in somewhat less bold way:

Our Web Application Firewall protects your site against the vast majority of common attacks. You won’t find any security tool more feature-complete than this.

But again, nowhere is there anything that actually backs up those claims.

Posted in Joomla, Website Hacked | Tagged , , | Leave a comment

SiteLock Promoted Services To WordPress.com Users That Are Not Relevant to Them

In a recent post about how WordPress is giving the web security SiteLock unwarranted legitimacy by allowing them to be involved in WordCamps, conferences dedicated to WordPress, we mentioned that one of the reasons it didn’t seem great to have them was that they are falsely labeling WordPress website as having vulnerabilities due to their lack of understanding of how WordPress handles security updates. It turns out their lack of knowledge of WordPress extends further, leading to trying to sell people services that are not relevant to them, as we found while looking for information for another post.

In a March post entitled This Week in Exploits: Increased WordPress.com Security on SiteLock’s WordPress focused The District blog, SiteLock mentioned that WordPress.com had enabled HTTPS for those using custom domain names. For those not familiar, WordPress.com is a blog hosting service powered by the WordPress software. It has some rather notable differences with self hosted WordPress installations, some of which we will note in a bit. It seems that SiteLock is not familiar with the differences the WordPress.com service and the WordPress software, but that didn’t get in the way of them trying to use the blog post to sell people on unneeded services.

After a paragraph mentioning the HTTPS change, they pivot to selling their service:

If you’re a WordPress.com user, one way to take advantage of WordPress.com’s exemplary efforts is to go further and enhance the security of your WP.com site with protection services.

First they promote a web application firewall:

The first and probably most fundamental upgrade to your site’s security is to implement a web application firewall, or WAF. With a simple DNS change and SSL cert approval, SiteLock TrueShield WAF protects sites, WordPress.com or otherwise, from malicious traffic, suspicious bots, scrapers and spam comments. The PCI-compliant TrueShield WAF supports SSL and Extended Validation SSL. Service packages depend upon protection capabilities desired.

Considering how the WordPress.com service works it isn’t clear what value that would provide. Much of that would likely already be being done WordPress.com and if there was some vulnerability discovered it should impact the whole service, so you would expect that it would be quickly fixed across the service. The marketing materials for that also don’t present any evidence as to the efficacy of its protection provided by that in general, much less when used with WordPress.com.

Next SiteLock is promoting malware scanning:

The next upgrade to WordPress.com security is a malware scan. The SiteLock Malware Scan crawls websites looking for malicious code and links and immediately alerts the site owner if any are found. The Malware Scan runs daily to find malware early and keeps sites off of blacklists, and results can be viewed in the SiteLock Dashboard or downloaded as CSV for analysis and remediation.

This doesn’t seem to be to useful for the WordPress.com service since you can not use JavaScript code on it:

Users are not allowed to post JavaScript on WordPress.com blogs. JavaScript can be used for malicious purposes. As an example, JavaScript has taken sites such as MySpace.com and LiveJournal offline in the past. The security of all WordPress.com blogs is a top priority for us, and until we can guarantee scripting languages will not be harmful, they will not be permitted.

JavaScript from trusted partners, such as YouTube and Google Video, is converted into a WordPress shortcode when a post is saved.

Since malware on a website is usually JavaScript based (or in some other format not permitted by WordPress.com) there couldn’t be malware on WordPress.com blog and you also couldn’t have your website flagged for malware since, again, there couldn’t malware on these websites in the normal course of things.

Next up they try create a connection between spam and the “dreaded ‘reported attack site’ screen”:

Speaking of blacklists, the final security upgrade is a spam scan. The SiteLock Spam Scan monitors all industry-leading search engine and spam blacklists for the customer’s domain and, again, immediately alerts the customer to any adverse reports. This allows the quickest way to remediation if the worst happens, reducing, if not eliminating, customer interaction with the dreaded ‘reported attack site’ screen.

The Reported Attack Site screen refers to something that has been shown on the Firefox web browser when Google has detected malware on a website, not spam, which is something SiteLock should know. From this description isn’t clear what spam they are scanning for, since it could refer to spam emails or spam content on a website. In looking around for more information on what the Spam Scan actually does, it looks like it actually checks lists of email address claimed to be sending spam, so it isn’t clear what the search engine reference in this refers to. Unless you use your own domain with WordPress.com and send email through it (which wouldn’t be through WordPress.com) this wouldn’t be relevant.

Finally SiteLock brings up their plugin for WordPress:

Security is vital. Easy security management is a must. SiteLock Security Plugin for WordPressprovides complete website security management and allows users to access their SiteLock Dashboard from within WordPress. Highlights include real-time updates ensuring minimal latency between identifying and correcting issues, identifying specific vulnerabilities in order to remediate them as quickly as possible and managing SiteLock Trust Seal settings.

That will not work on WordPress.com blogs, since you can’t install plugins on them.

Posted in Bad Security | Tagged , | Leave a comment

SiteLock Filed a DMCA Takedown Notice Against Our Website For A Screenshot of Their Homepage

We have seen a lot of ridiculous stuff from SiteLock recently, but this has to take the cake. They have now filed a DMCA takedown notice against our website for including a screenshot of their homepage on in one our posts.

In a post discussing how SiteLock was labeling a website as being “secure” while that contained malicious code that compromised credit card credentials we had included a screenshot of their homepage backing our mention of them claiming to be the “The Global Leader in Website Security”.

You can see how that portion of the page looked before the takedown:

sitelock-dmca-1

Beyond the fact that it is fairly clearly fair use, what is the purpose of hiding people from seeing that on our website?

They also filed a notice against another image. This time it is even more clear to be fair use since in a post discussing how SiteLock is falsely claiming that WordPress installations have vulnerabilities, we included the screenshot from their post to discuss the fact they were showing vulnerabilities existing in a version of WordPress they didn’t exist in that version.

You can see how that portion of the looked before the takedown:

sitelock-dmca-2

Worth noting is that the textual content in SiteLock’s screenshot is actually not generated by them, instead copied from other sources.

What makes this even more ridiculous is they clearly now know that their post is showing that they lack a basic understanding of WordPress security, but instead of fixing their post, they are trying to hide you from seeing an image on our website.

The only reasonable explanation we can think of for them doing this is that they thought they could get the pages those images were on removed by filing this, because removing the images alone doesn’t do anything to cover up what they are up to.

Full DMCA Takedown Notice

Abuse Department,

My name is Logan Kipp, I am contacting you on behalf of my company
SiteLock, LLC. A website that your company hosts at IP *66.39.94.41* (
WHITEFIRDESIGN.COM) is infringing on at least one copyright owned by
SiteLock, LLC.

Content has been taken from our official websites, SiteLock.com and
wpdistrict.sitelock.com, and used without the authorization of
SiteLock, LLC on the website WHITEFIRDESIGN.COM.

Infringement Instance #1:

ORIGINAL image URL: https://wpdistrict.sitelock.com/wp-
content/uploads/2016/
08/list-900×237.png

INFRINGING image used in page:
http://www.whitefirdesign.com/blog/2016/
09/06/sitelock-spreading-false-information-about-
wordpress-security-to-their-customers-through-their-
platform-scan-for-wordpress/

INFRINGING image URL: http://www.whitefirdesign.com/blog/wp- content/uploads/2016/09/sitelock-false-wordpress-
vulnerabilities.png

Infringement Instance #2:

ORIGINAL content URL: https://www.sitelock.com

INFRINGING content used in page:
http://www.whitefirdesign.com/blog/2016/
02/26/sitelock-labels-website-as-secure-despite-being-very- dangerous-for-
visitors/

INFRINGING image URL: http://www.whitefirdesign.com/blog/wp- content/uploads/2016/02/sitelock-global-
leader.png

This letter is official notification under United States Code Title 17
Section 512(c), the Digital Millennium Copyright Act (DMCA), and
I seek the removal of the aforementioned infringing material from your
servers. I request that you immediately notify the infringer of this
notice and inform them of their duty to remove the infringing material
immediately, and notify them to cease any further posting of
infringing material to your server in the future.

*Please also be advised that United States Code Title 17 512
requires you, as a service provider, to remove or disable access to
the infringing materials upon receiving this notice.* Under US law a
service provider, such as yourself, enjoys immunity from a copyright
lawsuit, provided that you act with deliberate speed to investigate
and rectify ongoing copyright infringement. If service providers do
not investigate and remove or disable the infringing material this
immunity is lost. Therefore, in order for you to remain immune from a
copyright infringement action you will need to investigate and
ultimately remove or otherwise disable the infringing material from
your servers with all due speed should the direct infringer, your
client, not comply immediately.

I am providing this notice in good faith and with the reasonable
belief that rights that SiteLock, LLC owns are being infringed. Under
penalty of perjury I certify that the information contained in the
notification is both true and accurate, and I have the authority to
act on behalf of the owner of the copyright(s) involved.

Should you wish to discuss this with me please contact me directly.

Logan Kipp
SiteLock, LLC
8701 E. Hartford Dr.
Scottsdale, AZ 85255

Phone: 1-877-257-9263 x 9012

*Logan Kipp* Product Evangelist *Mobile: *480-232-4171 *Desk Phone:*
877.257.9263 ext 9012 *International: *1.415.390.2500 ext 9012 *Email:
*Logan@SiteLock.com <logan@sitelock.com>

<http://www.facebook.com/SiteLock>   <http://twitter.com/sitelocksecure>
www.sitelock.com

CONFIDENTIALITY NOTICE: The information contained in this email,
including any attachment(s), is confidential information that may be
privileged and exempt from disclosure under applicable law, and is
intended only for the exclusive use by the person(s) mentioned above
as recipient(s). If you are not the intended recipient, you are hereby
notified that any disclosure, copying, distribution, or use of the
information contained herein is strictly prohibited and may be
unlawful. If you received this transmission in error, please
immediately contact the sender and destroy the material in its
entirety, whether in electronic or hard copy format.

Posted in Bad Security | Tagged , | Leave a comment

Joomla Hack Cleanup Provider Still Using Joomla Version EOL’d Over Four and Half Years Ago

We often say that most security companies don’t know and or care much about security, as quick example let’s take a look at a company named CMSHelplive.com that advertises to clean up hacked Joomla website on Google. Considering that keeping the software up to date is a basic element of security and when doing a proper hack cleanup you should make sure the website is secure as possible (so the software on the website should be brought up to date) you would expect that their website is running an update to version of their CMS. But it isn’t:

cmshelplive-outdated-joomla-version

Joomla 1.7 reached it end of life back in February of 2012. So this company has not updated their software in over four and half years and have missed over 30 subsequent updates that included security fixes. When they are not even keeping their website secure, what are the chances that they are going make sure the website they cleaned up are actually secured after their work?

And of course they are also peddling the falsehood that brute force attacks against WordPress admin passwords are happening:

cmshelplive-brute-force-attacks

Posted in Bad Security, Joomla | Tagged | Leave a comment

WordPress Giving Legitimacy to SiteLock By Allowing Them to Sponsor and Attend WordCamps

As we have continued to hear more troubling stories from the public about the web security SiteLock’s business practices and seen the damage they can cause, we have been very troubled that other organizations would provide them with legitimacy by getting involved with them.

One set of organizations is the various web hosts that had partnered with them. We recently found that the CEO of the parent company of many of those web hosting partners is also the owner of SiteLock, so it isn’t surprising that those web hosts wouldn’t have a problem with what is going on since their CEO is in on it. It would seem the others are getting paid handsomely to help them out.

Due to SiteLock discovering a couple of vulnerabilities in WordPress plugins some time ago, we had started following their blog for Plugin Vulnerabilities service. While no more vulnerabilities were disclosed on the blog, we did start noticing that they were sponsoring and attending quite a few of the official conferences for WordPress, WordCamps (and oddly giving presentations unrelated to security, including Creating a Digital Download Business – What to Sell, How to Sell It and Shortcuts to Success. and Contact Forms are Boring – 5 Creative Ways to Use Forms in WordPress.). That seems like a really bad idea, considering that imprimatur of WordPress is then connected with this company, provided them legitimacy they shouldn’t have.

There is also the issue that money that SiteLock makes taking advantage of people funding these WordCamps, which seems to be reasonable to consider as a moral and ethical issue.

It also doesn’t seem to be great idea to have a company that has shown that they lack a basic understanding of how WordPress responds to security isues, leading them falsely claim that WordPress website contain critical vulnerabilities, involved with WordPress events.

Just in the next couples of weeks SiteLock is sponsoring WordCamps in Pittsburgh, Raleigh (with a presentation also not security related, Using Curated Content in WordPress—Why and How), and Dallas. They are also a sponsor of the WordCamp for the whole US in December.

We would like be able to give you WordPress and WordCamp’s side of the story as to why they have are involved with SiteLock, but it has been a week since we contacted them with the following email asking for comment and we haven’t received any response:

We are writing a post about the fact that the security company SiteLock is being allowed to sponsor and attend numerous WordCamps despite be well known for taking advantage of its customers.

We first became aware of their practices after we had written a number of posts about other issues we had noticed involving them and then we started getting contacted by people who had been take advantage of by them, http://www.whitefirdesign.com/blog/2016/05/03/it-looks-like-sitelock-is-scamming-people/. There are a litany of complaints that can be see if you do a search on Google for something like “SiteLock scam”, including this page with numerous complaints https://sitelock.pissedconsumer.com/. While some of the complaints seem to be unfair to them, there is a pretty clear pattern of actions that seem quite problematic, to say the least.

We would like to include in our post any comment you might have as to why they are allowed to sponsor and attend WordCamps in light of that, so that the public has a better understanding of why WordCamps would get involved with such a company and take money that has been made by taking advantage of people. We would also like to include in our post any comment you might have as to any restrictions you place on what kinds of companies can sponsor and attend WordCamps.

If they were not aware of SiteLock’s reputation before, it seems that could have at least indicated that and that they reviewing things, but the lack of response points to them being aware of what SiteLock does and being okay with being involved with them.

If would like to let them know how you feel about that you can contact the central organization for WordCamp’s here. You also might want to contact ones happening locally that SiteLock is involved in, to see if they are aware of what one their sponsors is up to.

Hosting Recommendation Too

This isn’t the only Sitelock connection with WordPress. As we discussed in a recent post, one of the owners of Sitelock is also the CEO of a major web hosting provide, Endurance International Group. Endurance has many brand names they provide web hosting under, one of those being Bluehost. Bluehost has come up repeatedly in complaints about Sitelock. Bluehost is also one of the web hosts listed on the Hosting page on wordpress.org:

wordpress-bluehost-hosting-recommendation

That page has a top level menu link of the website, so we would assume that brings in a lot of business to them.

Posted in Bad Security, WordPress | Tagged , , | Leave a comment

GoDaddy and SiteLock Make a Mess of a Hack Cleanup (And Drop The Ball on Security As Well)

In the complaints about the web security company SiteLock we have seen, one of the things that comes up frequently is the widely variable and often times excessive prices for their services. In some cases the pricing would be within reason if you were getting a high quality service, but as we found while helping to fix a website after SiteLock did a malware removal on it few days ago, you get the opposite of that from them.

This incident involved one of SiteLock’s partner web host, though not one the ones run by the owners of SiteLock. Instead it is GoDaddy, for which we found a couple of security issues on their end while looking into this as well.

What happened in this cases is that SiteLock through GoDaddy was hired to clean up malware on the website. Afterwards though the website was screwed up, with the styling gone and shortcodes showing up on the pages (instead of being processed). GoDaddy told the website’s owner that they would need to have someone update WordPress and re-install the theme they used.

None of this made a whole lot of sense. After removing malware or doing some other cleanup the website should appear as it did before. The theme shouldn’t be missing, unless it had been completely replaced with malicious code (which we have never seen happen). Also a part of a proper cleanup is making the website secure as possible, which would, in part ,involve updating the software on the website.

When we got in to the WordPress admin area to look over things we found that theme actually was still there, but wasn’t activated. The only reason we could think for changing to another theme would be to check if the theme being used was causing the malware to be served up, but after that checking was finished it should be reactivated.

We also found that all of the plugins were deactivated, the same explanation as the theme might explain them being deactivated. But again they should have been reactivated if that was the case. This was more problematic to deal with since we didn’t know which, if any, of the plugins were not active before the cleanup and did not need to be re-activated.

Not only did WordPress still need to be updated, but so did the plugins and themes.

Once we got a handle of those things we were able to bring the website back to working order, but further looking showed that items added by the hacker still existed (and would have allowed them continued wide access to the website) and the vulnerability that could have allowed the hacker access to begin with still existed on the website, so the hacker could have easily gotten back in.

Malicious Administrators and a Vulnerable Plugin

When cleaning up a hacked WordPress website one of thing you want to check for is the existence of users that should not exists, with an emphasis on users with Administrator role, since they have wide ranging access. Sometimes those added accounts are rather obvious, in the case of this website a couple had the email adress “backup@wordpress.org”. While seemly intended to look innocuous, there shouldn’t be any account with email addresses from wordpress.org on a website. Either SiteLock did not spot those or didn’t even do any check for that.

Looking at the details of the users in the database would tell you something more about this. In the following screenshot you can see that for the two account with the “backup@wordpress.org” and one other have the user_registered field not filled in (the others listed there have dates from before the website existed and before the original account on the website was created):

malicious-wordpress-administrators-in-database

 

That indicates that the accounts were not created through the normal process in WordPress. One other way to do that is with direct access to the database.

That brings us to another thing that SiteLock missed, one the installed plugins, Revolution Slider, had an arbitrary file viewing vulnerability in the version of the plugin installed (you can check if a website is using a vulnerable version of that and if other plugins have vulnerabilities hackers are targeting using our Plugin Vulnerabilities plugin). Hackers frequently target that type of vulnerability to try to view the contents of WordPress configuration file, wp-config.php. That file contains database credentials for the website, so accessing that could allow a hacker access to the database, which they could then use to add new users.

GoDaddy’s Security Failings

We then went to check to see if the vulnerability was in fact exploitable on the website and we found that connection was dropping when we made the request to exploit it, which looked to be GoDaddy blocking the request. Unfortunately their protection is incredibly easy to evade.

The original request we made was the following, which was stopped:

/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

This request was not stopped:

/wp-admin/admin-ajax.php?action=revslider_show_image&img=..%2Fwp-config.php

The only change was that the “/” right before “wp-config.php” has been encoded, changing it to “%2”.

The fragility of such protection seems to pretty common, as earlier this week we found that two WordPress security plugins protection against another vulnerability could bypassed by simply adding and “\” in the right location (the 9 other WordPress security plugins we tested provided no protection).

Remote Database Access

Even if a hacker gets the database credentials by exploiting an arbitrary file viewing vulnerability they still need some method to access the database. In the case of the database for the website remote access is permitted, which allows someone to connect to the database from outside of GoDaddy’s systems. That type of access makes it really easy for a hacker, so it should be disabled by default.

In looking how we could disable remote access to the database, we found that based on their documentation it shouldn’t have even been enabled. The documentation says that you need to enable direct access when creating a database for to connect remotely:

Connecting remotely to a database lets you manage it using tools like MySQL Query Browser,MySQL Workbench, or Microsoft SQL Server Management Studio Express.

If you want to connect remotely to a database, you must enable Direct Database Access when setting it up1 — you cannot enable it later.

But the database in question is listed as not allowing direct access:

godaddy-database-details

So something isn’t right.

If we didn’t know what SiteLock was up to at this point we would be asking why they had not noticed those problems with the partner GoDaddy’s security and gotten them to fix them, but knowing what they are doing it isn’t surprising they wouldn’t have done that. If anything getting their partners to improve their security would mean less money for them and less money for the partners as well.

If you want a hacked WordPress website cleaned up properly, we are always available to help.

Posted in Bad Security, Website Hacked, WordPress | Tagged , | Leave a comment

SiteLock Hosting Partner Gets Majority of Fees For SiteLock Services

When it comes to web security companies, our experience has been that most of them don’t seem know and or care about security, which we think that goes a long way to explaining why web security is in such bad shape. One company that fits that bill for that is SiteLock, as can be seen in just few of our previous posts on them, whether its them failing to properly clean websites, to claiming website was secure when it contained malicious code to compromise credit credentials, to falsely claiming that WordPress websites have vulnerabilities due not understanding how WordPress handles security. More recently SiteLock has sets itself apart from the average bad security company in our eyes, by combining that with activity that looks more like outright scamming.

In looking into SiteLock one of the things that has stood out for us is that they have partnerships with with so many web hosts. Based on their poor track record when it comes to security we assumed that that the partnerships had to do with money being paid to the web hosts and not on those web hosts feeling that SiteLock providing a quality service. This seemed even more true as the complaints have piled up against SiteLock, which have frequently also cited their partnered web hosts. If it wasn’t about money, they easily could have found another security company to partner with that wouldn’t damage their reputation in this way.

As we discussed yesterday, it turns out that part of the actual explanation for why some web hosts had partnered with SiteLock has a more troubling explanation. The CEO of Endurance International Group, which provides web hosting services under a variety different brand names (including A Small Orange, Bluehost, FatCow, HostGator, HostMonster, iPage, and IPOWER) is also one of the majority owners of Sitelock (a board member of Endurance International Group is the other majority owner along side them).

While looking into that situation we found confirmation that at least with that company, they are getting a portion of the fees for SiteLock’s services. As noted here in the prepared remarks for earning conference call in May of last year Endurance International Group disclosed that they get a majority of the SiteLock fees from their partnership (PDF):

The revenue share between Endurance and IBS for Sitelock has been set at 55%/45% in favor of Endurance.

That goes a long way to explaining why web hosts are willing to get involved with SiteLock, despite the potential damage to their reputation. Consider this comment on one of our previous posts:

Listen to this: Bluehost persuaded me to get Sitelock security for my website and I stupidly paid $500 for a year. This was in January. Yesterday, Sitelock alerted me to malware on my site that could result in terrible consequences. They would remove the malware for a one-time fee of $300! I contacted them to say, “WHAT WAS THE $500 for??” and a hostile character calling himself “sean” told me it was for “scanning.” This company needs to be stopped from continuing their predatory practices.

The web host would be getting $275 a year without having to do any work, versus the $131.88 they would receive for what they claim is their most popular shared web hosting plan at its normal price (for which they would also have the expenses associated with provide the web hosting).

This also seems to go a long way to explaining why SiteLock’s services sometimes come with extremely high prices, since they are getting less than half of the fee being paid.

If you wondering how much money we are talking about, the conference call remarks also listed the payout they made to SiteLock in financial year 2014:

 Revenue share payments to IBS related to Sitelock totaled $5.4 million in FY14.

Posted in Bad Security | Tagged , | Leave a comment

One of SiteLock’s Owners is Also The CEO of Many Of The Company’s Web Hosting Partners

SiteLock is a web security company that we had originally became aware and wrote a number of posts about due to our seeing the poor quality of their services when working on client’s websites that had previously used their services. Due to those posts we started started getting contacted about more serious issues with them, namely that in a lot of cases they seem to be scamming people. One of the things that has stood out to us in looking into the situation was the fact that so many web hosts have partnered and continued to stay partnered with them. Was the money that we assumed SiteLock was paying them for the partnership worth the damage to their reputation, seeing as in complaints about them the web host who had partnered with them is frequently brought up?

In looking for some information for another post about the company we ran across the fact that the CEO of a major web hosting provider is also the one of the owners of SiteLock (the other owner is a director of the same provider), which does a lot to explain their partnerships and also raises even more question as to the probity of what is going between them.

On the about page of SiteLock’s website there is no mention of the ownership of the company, doing a Google site search of their website didn’t bring up any mention of either of the two entities that appear to be their parent company.

On the website of one of those, UnitedWeb, SiteLock is shown as one of their brands of the company, while the web hosting companies Endurance International Group and IPOWER are listed as public companies:

unitedweb-brands

The connection between of all of those entities isn’t clear based on that, though.

A little searching brought us to this page that seemed to point to a direct connection between SiteLock and Endurance International Group, which with more checking seems to be confirmed. In Endurance International Group latest quarterly report it states that:

The Company also has agreements with Innovative Business Services, LLC (“IBS”), which provides multi-layered third-party security applications that are sold by the Company. IBS is indirectly majority owned by the Company’s chief executive officer and a director of the Company, each of whom are also stockholders of the Company.

What is Innovative Business Services? That is the entity that owns SiteLock (referred to as a member on that page). So the CEO and a director of Endurance International Group are the owners of SiteLock.

It not clear where UnitedWeb falls in that, but it looks like it might be the owner of Innovative Business Services, and then in turn that is owned by the CEO and directory of Endurance International Group.

Unless you are very involved in website hosting you probably don’t recognize the name Endurance International Group, but they own many well known web hosts. The brands page of their website they highlight some of the more high profile ones including A Small Orange, Bluehost, FatCow, HostGator, iPage, and IPOWER:

endurance-international-group-brands

But that just scratches the surface, here is the all of their current brands (most of them appear to be web hosting companies) as listed on the Wikipedia page for the company:

  • 2slick.com
  • AccountSupport
  • Arvixe LLC
  • A Small Orange
  • ApolloHosting
  • AppMachine
  • Berry Information Systems L.L.C.
  • BigRock
  • BizLand
  • BlueBoxInternet
  • BlueDomino
  • Bluehost
  • BuyDomains
  • CirtexHosting
  • Constant Contact
  • Directi
  • Dollar2Host
  • Domain.com
  • DomainHost
  • Dot5Hosting
  • Dotster
  • easyCGI
  • eHost
  • EmailBrain
  • EntryHost
  • Escalate Internet
  • FastDomain
  • FatCow
  • FreeYellow
  • Glob@t
  • Homestead
  • HostCentric
  • HostClear
  • HostGator
  • HostNine
  • HostMonster
  • HostV VPS
  • hostwithmenow.com
  • HostYourSite.com
  • HyperMart
  • IMOutdoors
  • Intuit Websites
  • iPage
  • IPOWER/iPowerWeb
  • JustHost
  • LogicBoxes
  • MojoMarketplace.
  • MyDomain
  • MyResellerHome
  • MySocialSuite
  • NetFirms
  • Networks Web Hosting
  • Nexx
  • PUBLICDOMAINREGISTRY.COM
  • PowWeb
  • PureHost
  • ReadyHosting.com
  • ResellerClub
  • Saba-Pro
  • SEO Gears
  • SEO Hosting
  • SEO Web Hosting
  • Site5
  • Southeast Web
  • SpeedHost
  • Spertly
  • StartLogic
  • SuperGreen Hosting
  • Typepad
  • Unified Layer
  • USANetHosting
  • vDeck
  • Verio
  • VirtualAvenue
  • VPSLink
  • Webzai Ltd.
  • WebHost4Life
  • webhosting.info
  • Webstrike Solutions
  • Xeran
  • YourWebHosting
Posted in Bad Security | Tagged , , , , , , , , | Leave a comment