WordPress tops for blogging and malware distribution

Summary:Netcraft has identified large numbers of phishing and malware sites built on compromised WordPress blogs. The popular blogging platform is also popular with Internet criminals.

Internet security research and services company Netcraft has determined that sites running the WordPress blogging software are a major source of both phishing attacks and malware distribution.

Must See Gallery

Samsung handsets through the ages: A photo tour of phone firsts

With nearly 30 years in the mobile handset business, Samsung has no shortage of milestones, from its first device in 1988 to its recent transition to metal and curved smartphones. ZDNet takes a trip down memory lane.

Interestingly, none of the phishing sites were hosted on WordPress.com, a a large blog-hosting service run by Automattic. The founder of Automattic was one of the original authors of WordPress and the company still contributes to the WordPress.org open source project. Netcraft speculates that this familiarity explains their security record. It also shows that WordPress can be administered securely.

But the WordPress application is free and is installed on many web sites across the world. The administrators of these sites are responsible for keeping WordPress and its component parts updated, and many do not. Recent versions of WordPress can self-update, but this requires that the web server process have write access to the WordPress program files. This situation presents problems of its own, as a compromise of the web server process could allow for modification of the WordPress installation.

Insecure plugins are another security plague on WordPress and have led over the years to many blog compromises and attacks on blog viewers.

Errors in the administration of the server are usually a factor in any WordPress compromise. A common one is on shared hosting sites where one user has write access to another's wp-content directory, the directory where WordPress puts user content. This makes it easy for attackers to place phishing content and malware on the other users' blogs.

Netcraft relates the recent story of a botnet of over 162,000 WordPress blogs which was used in a DDOS attack against a web site.

The full report contains many more details, especially valuable ones if you run a WordPress blog.

Topics: Security


Larry Seltzer has long been a recognized expert in technology, with a focus on mobile technology and security in recent years. He was most recently Editorial Director of BYTE, Dark Reading and Network Computing at UBM Tech. Prior to that he spent over a decade consulting and writing on technology subjects, primarily in the area of sec... Full Bio

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.