Think Like a Hacker with Wordfence

Latest Episodes:

Episode 75: The WordPress 5.4.1 Security Release & More Plugin Vulnerabilities May 02, 2020

Show notes

The Wordfence Threat Intelligence team unpacked the security updates in WordPress 5.4.1, and they published quite a few blog posts about vulnerabilities in popular plugins like Ninja Forms, LearnPress, and the Real-Time Find and Replace plugin. These plugin vulnerabilities affected over 1 million WordPress sites. As a few of these were Cross Site Request Forgery vulnerabilities, so we take a look at how these attacks work and how to avoid becoming a victim to a malicious CSRF request.

We also look at more scams targeting COVID-19 fears and stimulus funds, and Google's upcoming crackdown on Chrome extensions set to happen in August 2020. We also look at the privacy concerns expressed by many in the information security field about contact tracing initiatives by various companies including Google and Apple as well as governmental agencies.

Episode 74: Staying Safe When Hackers Use Sophisticated Attacks Apr 24, 2020

Show notes

Stories this week about targeted attacks using 0days in iPhone and iPad devices and a sophisticated phone scam targeting a security professional that ended with a $9,800 wire transfer underscore what we all know: malicious attacks are becoming increasingly sophisticated. We also cover a recent plugin vulnerability in the MapPress Maps plugin affecting over 80,000 WordPress sites, Google's report that they're seeing more than 18 million daily malware and phishing emails. We also cover the recent funding that Frontity received, and look at what this might mean for faster WordPress sites.

Episode 73: Security News and Success through Processes with Adam Silver Apr 17, 2020

Show notes

The FTC is reporting numerous scams targeting fears and uncertainty, with over $12 million lost to Coronavirus-related scams. We also cover BBB warnings against oversharing on social media, over 500,000 Zoom credentials found on the dark web, Google's removal of malicious Chrome extensions, as well as recent plugin and theme vulnerabilities. We chat with Adam Silver, host of the KitchenSinkWP podcast, celebrating 6 years of podcasting. We ask Adam about his consistent success, experiences with WordCamps, as well as the impact of Open, the film about the WordPress community, in which Adam plays a starring role.

Episode 72: WordPress 5.4 Released, Zoom Conferencing Safety & Security Apr 06, 2020

Show notes

This week, we look at what's new in WordPress 5.4, including that distraction free editing is now on by default. We also look at new plugin vulnerabilities, including Rank Math and a Contact From 7 helper plugin. We review the new updates to Fast or Slow, the free global website speed profiler. We also talk about Zoom's recent security and privacy issues, including a recent discovery by a security researcher who found recordings of meetings containing sensitive information on Zoom's cloud service.

Episode 71: Hackers Targeting COVID-19 Fears Mar 25, 2020

Show notes

With many of us under either lockdown or shelter-in-place orders due to the COVID-19/Corona virus, fear and stress are rampant. This additional stress lowers our critical thinking capabilities and increases our vulnerability. Hackers targeting these human vulnerabilities are using the global pandemic to attempt exploitation through numerous scams and phishing campaigns. We also cover two plugin vulnerabilities affecting tens of thousands of sites as well as a new product from Wordfence, Fast or Slow, a global website speed profiler.

Episode 70: Customer Education and Agency Resiliency with Jon Bius Mar 14, 2020

Show notes

We chat with Jon Bius, a web developer at Biz Tools One, an agency in Fayetteville, NC, about how they use customer education to build relationships and differentiate their business. We also cover two plugins with vulnerabilities, more cancelled WordCamps, some hackers taking advantage of the fear surrounding COVID-19, the rise of remote work, and what's coming with full screen editing in WordPress 5.4. Find show notes and links on https://www.wordfence.com/podcast/

Episode 69: The Meteoric Growth of Elementor with Kfir Bitton Mar 06, 2020

Show notes

On February 26, WordPress page building platform Elementor announced that they had received $15 million in venture funding. After topping 4 million installations of their plugin in January, it appears that Elementor is on a path to do some big things with WordPress. This week, we chat with Elementor CRO Kfir Bitton from his office in Tel Aviv, Israel about how Elementor grew so quickly, what's next for this plugin turned platform, and how Elementor strives to give back to the WordPress community. Of course, we also have news stories including how COVID-19 is affecting WordCamps, the Let's Encrypt domain control validation bug, and the coupon creation vulnerability in WooCommerce Smart Coupons.

Episode 68: More Plugin Vulnerabilities and Active Attack Campaigns Feb 29, 2020

Show notes

This week, we review numerous plugin vulnerabilities in popular WordPress plugins and the attacks that are targeting them. We also review the Duplicator vulnerability affecting over 1 million sites, and Chloe Chamberland's discovery of multiple vulnerabilities in the Pricing Table by Supsystic plugin. Some WordPress-focused companies, Elementor and Strattic, receive venture funding.

We also ask lead customer support engineer Tim Cantrell about the different ways to use Wordfence settings for brute force protection, blocking IP addresses, and how to prevent alert fatigue. A transcript is available on wordfence.com/podcast

Episode 67: Avoiding Common Vulnerabilities When Developing WordPress Plugins Feb 28, 2020

Show notes

Almost every week, a new vulnerability is discovered in a popular WordPress plugin or theme, leaving developers scrambling to fix it before it's widely exploited. Surprisingly, almost all critical vulnerabilities boil down to a few common mistakes. In this talk from WordCamp Phoenix, Ramuel Gall reviews these common errors and provides advice on creating secure plugins. Check out the video on YouTube to see slides with example code. There were some audio glitches during the presentation, but the content is good enough we had to share this with you. Transcript available in the show notes.

Episode 66: New Plugin Vulnerabilities & Succeeding as a Digital Nomad with Chloe at WCPHX Feb 21, 2020

Show notes

It has been a busy week in WordPress security with active attacks on a number of plugins including ThemeRex Addons and Theme Grill Demo Importer plugins. In this week's Think Like a Hacker, we look at what's happening, review what a zero-day vulnerability is, and give you some advice on keeping WordPress installations clean and safe. We also look at a vulnerability uncovered in the wpCentral plugin installed on over 60,000 sites, a WHO phishing attack, and Malwarebytes' State of Malware report.

At WordCamp Phoenix, Wordfence Threat Analyst Chloe Chamberland spoke to a packed room of attendees looking to learn more about how she succeeds working remotely as a digital nomad. Her talk starts at 19:13 if you'd like to skip ahead, though we recommend watching the YouTube video of her talk to see Chloe's travel photos and audience interaction. Links to that video and all of the news items are available in the show notes on wordfence.com/podcast.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Think Like a Hacker with Wordfence

Related Podcasts

Links

Stay Connected