Forest Global Training Partners

Cyber Risks · Krebs on Security

Hundreds of Word Press Blogs Hit by ‘Networkads.net’ Hack

Summary: A large number of WordPress bloggers reported their sites were hacked and redirecting visitors to networkads.net/grep, with the address injected directly into the site's database rather than through modified files, and site owners temporarily locked out of the WordPress interface. Nearly every affected site owner reported Network Solutions as their hosting provider, and security expert David Dede said he helped close to a dozen blogs recover, all hosted there, only to see the site address reset to networkads.net/grep within hours. A later update cited WordPress storing database credentials in plain-text in the wp-config file, readable by anyone on many installs, and a malicious user at Network Solutions who created a script to find those misconfigured files.

Why it matters: A scan of the file delivered by the redirect found only 7 of 39 anti-virus products detected it as malicious, and wiping the database and reinstalling WordPress did not stop the address from being changed back within hours.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related