Think Like a Hacker with Wordfence

Latest Episodes:

Episode 85: 0Day in File Manager Plugin and WordPress 5.5.1 Fixes Broken Sites Sep 04, 2020

Show notes

Over 700,000 WordPress users were affected by a zero-day vulnerability in the File Manager plugin, and the WordPress 5.5.1 release fixed millions of sites affected by deprecation of jQuery Migrate. SendGrid is under siege from spammers using hacked accounts, and Apple approves a notorious malware variant to run on Macs.

Episode 84: Google Chrome Plans to Implement Insecure Form Warnings Aug 28, 2020

Show notes

The Google Chrome web browser has a high-severity vulnerability that could be used to execute arbitrary code, which has been fixed in Chrome version 85. Google also announced that Chrome 86 will alert users if a form submission is using the insecure HTTP protocol, making it a good time to audit older sites that may have migrated to HTTPS, but still have forms submitting via HTTP. A security researcher found a flaw in Apple's Safari browser that could allow an attacker to access files on a Mac or iOS device. The FBI and CISA have issued a joint alert to warn about the growing threat from vishing attacks targeting companies.

Episode 83: 100,000 Sites Impacted by Vulnerabilities in Advanced Access Manager Aug 21, 2020

Show notes

The Wordfence Threat Intelligence team discovered vulnerabilities in the Advanced Access Manager plugin installed on over 100,000 WordPress sites. A high severity authorization bypass could lead to privilege escalation and site takeover. Critical vulnerabilities found in the Quiz and Survey Master plugin could also lead to site takeover on the 30,000 WP sites using the vulnerable version of this plugin.

Thousands of sites broke after updating to WordPress 5.5 due to deprecated support for jQuery Migrate, and the release of the Enable jQuery Migrate Helper plugin reached 10,000 active installations to help fix these sites using older themes or plugins.

As cryptocurrency values rise, we're seeing a wave of new scams and hacking campaigns with cryptocurrency as a driving force, such as the recent Twitter hack and a botnet campaign breaching SSH servers.

Episode 82: Important Changes in the WordPress 5.5 Update Aug 14, 2020

Show notes

WordPress 5.5 was released on August 11 with a number of important updates, including a new feature allowing auto-updates of themes and plugins as well as changes to the block editor. The popular Astra theme was suspended from the repository for having affiliate links in the code. A vulnerability found in Google Chromium browsers could allow attackers to bypass content security policy in order to steal data and execute rogue code, this vulnerability affects billions of users. The Wall Street Journal reported that government tracking software is embedded in over 500 mobile apps.

Episode 81: Critical Vulnerability Exposes over 700,000 Sites Using Divi, Extra, and Divi Builder Aug 07, 2020

Show notes

Our Threat Intelligence team disclosed numerous vulnerabilities this week, including a critical vulnerability in the Divi and Extra themes as well as the Divi Builder plugin. In total, this vulnerability affected over 700,000 sites. A vulnerability found in The Official Facebook Chat Plugin created a vector for social engineering attacks as it allowed an attacker to pose as a site owner via chat. Object injection vulnerabilities discovered in the Newsletter plugin affected over 300,000 sites. We also look at the charges brought against 3 people in connection with the recent Twitter hack. The WordCamp US organizing team made the difficult decision to cancel WCUS this year amid online event fatigue.

Episode 80: Critical File Upload Vulnerability in wpDiscuz Plugin Jul 31, 2020

Show notes

Our threat intelligence team discovered a vulnerability in the wpDiscuz plugin, affecting over 80,000 sites. A blind SQL injection attack affected analytics service WayDev, exposing OAuth tokens for GitHub repositories for software companies, leading to further breaches. A debate about problematic admin notices on the WordPress admin dashboard has many wondering how to best solve the issue, while WordCamps move to all virtual in 2020. Garmin's ransomware attack takes down more than step counting.

Episode 79: High Profile Twitter Accounts Compromised in Coordinated Attack Jul 17, 2020

Show notes

A number of high profile Twitter accounts including those of Elon Musk, Apple, Uber, Bill Gates, Joe Biden and others were compromised as a part of a coordinated bitcoin scam attack. The attack lasted a few hours and netted the attackers about $100,000 worth of bitcoin. We talk about how this attack could have possibly happened and lessons for businesses with remote workers accessing company systems.

We also talk about a vulnerability our Threat Intelligence team discovered in the All in One SEO Pack plugin used by over 2 million WordPress sites. This vulnerability could be used by a malicious contributor account to take over a WordPress site.

We also discuss SigRed: A 17-year-old 'wormable' vulnerability that could be used to hijack Windows servers, a vulnerability that could have severe ramifications for enterprise Windows networks. This vulnerability was patched on July 14.

And we take a look at some privacy concerns with the increasingly popular TikTok app and how Apple discovered TikTok spying on iPhone users.

Episode 78: Targeted Phishing Bypassing Security Checks and a new DDoS Record Jun 22, 2020

Show notes

This week, we look at some targeted phishing attacks that are bypassing Microsoft Outlook's protective filters, and phishing campaigns using calendar invitations to target unsuspecting recipients. We also look at some successful bitcoin scams and a new record for a massive DDoS attack that targeted an AWS customer. Drupal pushes out some security fixes, and zero-day vulnerabilities found in numerous Netgear routers.

Episode 77: WordPress 5.4.2 Released, Fake Ransomware Bitcoin Scams Jun 12, 2020

Show notes

This week, we look at the WP 5.4.2 release and a ransomware bitcoin scam targeting site owners with a "You've Been Hacked" email. We also look at an FBI warning about online banking app malware, the Verizon data breach report and what is says about WordPress, and how some white hat hackers are becoming millionaires by responsibly disclosing vulnerabilities via HackerOne.

Episode 76: Ongoing Attacks on WP Growing in Volume Plus Numerous Plugin Vulnerabilities May 15, 2020

Show notes

On this week's Think Like a Hacker podcast, we cover an active attack campaign targeting WordPress sites and numerous plugin vulnerabilities. This active attack campaign has been ongoing and has outpaced all other attacks on WordPress vulnerabilities. Our threat intelligence team has been tracking this attacker for months now, and we're seeing these attacks intensifying. We also look at vulnerabilities found in Google's Site Kit plugin and the Page Builder by SiteOrigin, and why it's so important for plugin developers to have a Responsible Disclosure Policy published in an easy to find location on their site.

We also look at how a combination of two vulnerabilities were used in a zero-day active attack on sites running Elementor Pro and the Ultimate Addons for Elementor plugin.

We also look at some new updates to Fast or Slow, the new global site speed profiling tool created by the Wordfence engineering team, and the impromptu hard launch the site experienced when it rose to the #1 position on Hacker News on May 8, 2020.

May has been a rather busy month in WordPress security and for the Wordfence team. Enjoy the podcast, and stay safe.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Think Like a Hacker with Wordfence

Related Podcasts

Links

Stay Connected