WordPress is breached, again. I guess I run an unsecure version of WordPress, but I’m not sure. All I am told is that i don’t runt he latest version of WordPress and that I should upgrade, because upgrading is easy.
No, it’s not easy. I keep history of my webpage in Subversion, so every time I need to upgrade WordPress I need to add the new version into Subversion in the vendor branch, merge in the changes in a WordPress current branch and then merge the changes into trunk of my web page. Why I do this, you say? No software is perfect, WordPress is far from it, so I need to alter some core code from time to time. That’s why.
Ok, back to the topic. Matt Mullenweg does not tell me in his blog post (link above) anything about what versions of WordPress that are potential targets for this Internet worm that exploits this security breach, nor what part of the code that makes it possible, not even how to patch it up. The entire blog post is just explaining that security holes do happen and some theory about how to protect yourself from it. Nothing concrete. Not very useful.
Digg this Gi kudos!
Knut-Olav
Torbjørn
mmm
paul
Lennart
1 tilbakemelding til nå ↓
1
Knut-Olav
// 8. september 2009 kl 19:52
Ok, so I finally got to the point of upgrading to WordPress 2.8.4. Since I use Subversion to organize my blog source code I can easily get the diff between WordPress version 2.8.3 and 2.8.4. There is nothing in that diff that bings any security to my blog.
Sure, if a spam bot creates millions of user accounts on my using different email addresses they might brute force the activation key in a few tries. Looking from another perspective millions of bots might try to brute force the activation key of my admin account. But after I apply this patch, they still can! If your admin account is named “admin” of course.
The only benefit from a security perspective of upgrading from 2.8.3 to 2.8.4 is when your admin account is not named admin. Then the bots have to guess the username too.
In the short. Rename your admin account!
Legg igjen en kommentar