How to Keep WordPress Secure

Re:How to Keep WordPress Secure by abjourn on Sunday September 06, 2009 @01:26AM (#807500)

Seems like that advice is applicable to any software.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by tsally on Sunday September 06, 2009 @02:21AM (#807540)

Except that Wordpress is written in PHP and designed without security as a goal. True, security is all about probability, but Wordpress' odds are not that good.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by reedlaw on Sunday September 06, 2009 @03:46AM (#807593)

Windows was originally built without security as a major focus, but has been improved vastly. So has WordPress. Except for a few rare cases where security was a primary goal, such as OpenBSD, most software will be discovered to have vulnerabilities at some point in time.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by rincewind on Sunday September 06, 2009 @08:16AM (#807739)

Windows was originally built without security as a major focus.

This is misleading. Windows NT was built with security in mind. Windows Xp, Vista and 7 are descended from NT.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by reedlaw on Sunday September 06, 2009 @09:45AM (#807784)

I meant Windows 95 and 98. NT is one of the vast improvements I had in mind.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by _b8r0 on Sunday September 06, 2009 @07:54AM (#807729)

OpenBSD has had plenty of vulnerabilities, including a couple of remote ones.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by reedlaw on Sunday September 06, 2009 @09:47AM (#807786)

So it's a good example of software built with security as a primary focus that still has vulnerabilities. I can think of few examples of software that has never had vulnerabilities discovered. OpenSSH maybe?

[ Parent | on HN ]

Re:How to Keep WordPress Secure by shykes on Sunday September 06, 2009 @11:39AM (#807878)

OpenSSH has had more than its share of vulnerabilities.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by scythe on Sunday September 06, 2009 @03:35PM (#808074)

seL4!

...wait, that's cheating, isn't it?

[ Parent | on HN ]

Re:How to Keep WordPress Secure by nir on Sunday September 06, 2009 @10:46AM (#807835)

The fact it's been written in PHP is meaningless. As for "designed without security as a goal", I think you'll find that's true for most web apps.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by antonovka on Sunday September 06, 2009 @02:01AM (#807521)

Yes, however, perusing the history of vulnerability disclosures in popular software demonstrates that the degree of likelihood of a new issue being found varies to a considerable degree based on the software in question.

Given that, software with an exceedingly low historical defect rate could reasonably be considered 'secure'.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by christofd on Sunday September 06, 2009 @01:40AM (#807511)

As I understand - the issue is that WordPress allows in-browser editing of PHP code.

If you only allow people to edit standard HTML, then this issue would go away.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by photomatt on Sunday September 06, 2009 @01:38PM (#807966)

That's not the issue here -- the worm doesn't require any files to be writable.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by christofd on Tuesday September 08, 2009 @10:48AM (#811104)

ah, thanks for the info!

[ Parent | on HN ]

Re:How to Keep WordPress Secure by nir on Sunday September 06, 2009 @01:18AM (#807493)

AFAIK wordpress.com never got broken into...

[ Parent | on HN ]

Re:How to Keep WordPress Secure by tptacek on Sunday September 06, 2009 @01:48AM (#807513)

That feels extremely unlikely.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by simonk on Sunday September 06, 2009 @02:08AM (#807529)

Wordpress.com is up to date on the Wordpress software, only blogs that haven't updated since the last 2 versions are open for attack.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by tsally on Sunday September 06, 2009 @02:22AM (#807542)

http://en.wikipedia.org/wiki/Zero_day_attack

[ Parent | on HN ]

Re:How to Keep WordPress Secure by pwmanagerdied on Sunday September 06, 2009 @02:04AM (#807523)

I felt the same, but after searching for a few minutes I wasn't able to find anything to contradict it. It looks like their hosted option may actually be significantly more secure than installing your own.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by mahmud on Sunday September 06, 2009 @02:04AM (#807524)

If they're lucky, someone competent pwned them and he is now doing a great job defending his turf.

Everybody gets owned, kept or rm'ed; just a matter of time.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by onreact-com on Sunday September 06, 2009 @04:50AM (#807612)

This is the way they advertise for their wordpress.com version obviously. Stick with us or you get compromised. Bad style. They rather should fix their buggy software.

They prefer new features over security. Have you noticed how with each major upgrade there are new holes in it?

WordPress is like Swiss cheese, full of holes. I'd prefer Swiss banks or watches instead.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by gjm11 on Sunday September 06, 2009 @05:02AM (#807622)

Let me just rephrase that first paragraph a little. "When a WordPress security problem is found, they release a new version with the problem fixed and say everyone should upgrade to it. That's bad. Instead, they should release a new version with the problem fixed." Doesn't something about that seem a little ... odd ... to you?

[ Parent | on HN ]

Re:How to Keep WordPress Secure by onreact-com on Sunday September 06, 2009 @05:11AM (#807628)

No, either you don't get it or you refuse to.

WP 2.8, WP 2.7, WP 2.5 etc. each were compromised almost immediately and each time several security updates have been issued in the matter of days and weeks.

Nobody can keep up with it so no wonder WordPress blogs get hacked.

Why don't they just release stable and secure versions?

[ Parent | on HN ]

Re:How to Keep WordPress Secure by gjm11 on Sunday September 06, 2009 @03:22PM (#808059)

Why? Because security is hard to do unless you (1) build it in right from the start and (2) are good at it, and neither of those things appears to be true in the case of WordPress.

You appear to be suggesting -- I can't tell how seriously -- that WordPress is deliberately made insecure so that when Automattic (ugh, I hate that name) want people to upgrade they always have a security issue they can use to scare people into doing so. Sorry, but that's absolutely nuts.

(In case it isn't clear: I am not, in the least, defending WP's security record. I am pointing out that the things you're saying here are crazy.)

[ Parent | on HN ]

Re:How to Keep WordPress Secure by onreact-com on Sunday September 06, 2009 @04:35PM (#808135)

"You appear to be suggesting -- I can't tell how seriously -- that WordPress is deliberately made insecure so that when Automattic (ugh, I hate that name) want people to upgrade they always have a security issue they can use to scare people into doing so. Sorry, but that's absolutely nuts"

No, YOU said that. I just said they don't care enough for security. Otherwise they wouldn't spit out new versions with holes so often.

So there is no reason to insult me.

Also the WordPress people pointing out all the time how wordpress.com hasn't been hacked is just obvious advertising for their hosted services.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by gjm11 on Sunday September 06, 2009 @07:10PM (#808271)

OK, so we're at cross purposes. It looks to me like (1) I misunderstood something you said but (2) it still (2a) doesn't make sense and (2b) is distinctly more than "I just said they don't care enough for security".

Specifically: you said "This is the way they advertise for their wordpress.com version obviously. Stick with us or you get compromised." So, my mistake: I interpreted "their wordpress.com version" as "the latest version" rather than "hosting your blog on wordpress.com". That was dumb of me; sorry.

On the other hand, even after fixing my brain in that respect, I still can't see any way to read that as just saying that "they don't care enough for security".

If in fact it's true that wordpress.com consistently gets updated immediately when a new version comes out that fixes a security problem, and that people hosting their own WordPress blogs tend to be sluggish about upgrading, then I don't see why one of the things they say when a compromise happens is "you'd be in much less danger on wordpress.com". Because, y'know, it's true. What would be improper would be if (1) they are deliberately putting out insecure code to make their hosted version more appealing, or (2) the only thing they say when a security problem comes up is "come and use our hosted version". #1 is what it still looks to me like you were saying, but seems immensely improbable, not least because I find it very hard to believe that their net gain in paying customers from an incident like this one is positive. #2 would be bad. indeed; is it true?

[ Parent | on HN ]

Re:How to Keep WordPress Secure by onreact-com on Sunday September 06, 2009 @04:55AM (#807619)

wordpress.com blogs get hacked as well, just check:

http://www.google.com/search?q=wordpres.com+hcked&pws=0&...

You'll find threads like these:

http://en.forums.wordpress.com/topic/my-site-got-hacked

http://en.forums.wordpress.com/topic/my-friends-site-was-hac...

http://en.forums.wordpress.com/topic/i-got-hacked-1

where wordpress.com users seek help after they got hacked.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by photomatt on Sunday September 06, 2009 @01:37PM (#807964)

WP.com, to my knowledge, has never had a code or security breach.

There are communities (like Club Penguin) where they are quite promiscuous with their passwords and share login details with each other regularly, and then "hack" each others blogs.

[ Parent | on HN ]

Re:How to Keep WordPress Secure by pwmanagerdied on Sunday September 06, 2009 @06:48AM (#807677)

Please read links before you post them in future.

I did the same search. In each of those cases it seems like being "hacked" means adding another admin and having them screw you over or having your password guessed. Though I'm no Wordpress fan, blaming them for things like that is rather absurd.

[ Parent | on HN ]