WordPress Security

Transcript

1. Wordpress Security 101 Predrag Cujanović Security Engineer @ Humanity Inc www.cujanovic.com predrag@cujanovic.com @cujanovic
2. Wordpress Security 101 Percentage of all websites globally that use WordPress: 25% Last updated 11/8/15 Companies use WP :)
3. Wordpress Security 101 OWASP Top 10 2013: https://www.owasp.org/index.php/Top_10_2013-T op_10
4. Wordpress Security 101 Wordpress is a PHP + MySQL So let's start from the Server
5. Wordpress Security 101 Shared or Dedicated server? Shared – focus on this: PHP version, Apache(Nginx) versions, MySQL version, Kernel version, cPanel, ModSecurity?
6. Wordpress Security 101 Dedicated server: OS? Kernel – GRSecurity patch Apache version PHP version MySQL version ModSecurity(WAF) + Comodo rules OS Update(s)? Backups? Permissions(.htaccess, wp-config.php)? Multiple sites(suphp)? SSH auth? Apache hardening PHP hardening HTTPS(SSL)
7. Wordpress Security 101 Is Wordpress core secure? Yes, if you update it. Most common vulnerability is XSS.
8. Wordpress Security 101 What is XSS? https://www.virtualforge.com/vmovie/xss_lesson_1 /xss_selling_platform_v1.0.swf
9. Wordpress Security 101 Wordpress 4.2 Stored XSS https://www.youtube.com/watch?v=OCqQZJZ1Ie4
10. Wordpress Security 101 Are Wordpress plugins/themes secure? Yes – if you update them and No https://wpvulndb.com/ WPScan Vulnerability Database Cataloging 4247 WordPress Core, Plugin and Theme vulnerabilities
11. Wordpress Security 101 Akismet 2.5.0-3.1.4 - Unauthenticated Stored Cross-Site Scripting (XSS) https://blog.sucuri.net/2015/10/security-advisory- stored-xss-in-akismet-wordpress-plugin.html Twenty Fifteen Theme <= 1.1 - DOM Cross-Site Scripting (XSS) https://blog.sucuri.net/2015/05/jetpack-and-twent yfifteen-vulnerable-to-dom-based-xss.html
12. Wordpress Security 101
13. Wordpress Security 101 W3 Total Cache & WP Super Cache fiasco: https://blog.sucuri.net/2013/04/update-wp-super- cache-and-w3tc-immediately-remote-code-execution -vulnerability-disclosed.html
14. Wordpress Security 101 Security Headers: Security what? https://securityheaders.io/?q=https%3A%2F%2F www.cujanovic.com&hide=on
15. Wordpress Security 101 CSP - Content Security Policy https://www.owasp.org/index.php/Content_Securit y_Policy https://scotthelme.co.uk/content-security-policy-an -introduction/
16. Wordpress Security 101 Wordpress xmlrpc.php https://blog.sucuri.net/2015/10/brute-force-amplification-a ttacks-against-wordpress-xmlrpc.html https://blog.sucuri.net/2014/03/more-than-162000-wordpress -sites-used-for-distributed-denial-of-service-attack.html http://www.breaksec.com/?p=6362
17. Wordpress Security 101 HTTPS(SSL): https://www.ssllabs.com/ssltest/analyze.html?d=www.cu janovic.com&s=104.28.9.68&hideResults=on&latest https://testssl.sh/ https://mozilla.github.io/server-side-tls/ssl-config-generato r/ https://cipherli.st/ LibreSSL <3 https://wiki.freebsd.org/LibreSSL define('FORCE_SSL_ADMIN', true);
18. Wordpress Security 101 HTTPS(SSL): Man in The Middle: https://www.youtube.com/watch?v=-hd7XG-b6uk
19. Wordpress Security 101 HTTPS(SSL): CloudFlare? Network DDoS Free SSL Free CDN HTTP2
20. Wordpress Security 101 HTTPS(SSL): https://support.cloudflare.com/hc/en-us/articles/200170 416-What-do-the-SSL-options-Off-Flexible-SSL-Full-SSL-F ull-SSL-Strict-SSL-Only-mean-
21. Wordpress Security 101 HTTPS(SSL): Let's Encrypt: https://letsencrypt.org/about/ https://letsencrypt.org/2016/03/08/our-millionth-cert.html
22. Wordpress Security 101 Weak Admin passwords: https://blog.sucuri.net/2015/09/wordpress-brute-f orce-attacks-2015-threat-landscape.html Use a password manager like LastPass with a unique password for all services/sites: https://www.youtube.com/watch?v=RM0fzHxMAS Q
23. Wordpress Security 101 Wordpress users: Use admin only for administration, don't use it for publishing posts, pages, etc
24. Wordpress Security 101 Demo time :) But first using Facebook servers for DDoS on a WP site(missing rate limiting per IP address) https://www.youtube.com/watch?v=g2gAFHs_3dY
25. Wordpress Security 101 Demo time :) http://wpscan.org/ http://sqlmap.org/
26. Wordpress Security 101 Questions? Thanks :) predrag@cujanovic.com www.cujanovic.com @cujanovic