Hello Subscribers, As an Introduction i would like to say that this is my first announcement and i am not happy about the way it went. I am a daily reader of the website XDA-Developers which is mainly announcing information about Android Devices and mobile trends. At the 07.03.2016 around 10:10 AM i accessed on of their articles an landed on a strange 404 Page telling me that http://ift.tt/1RdSsqT could not be found. As a security interested guy i tried to access /wp-admin/install.php and voila, the Wordpress first setup Page was available. The vulnerability had to be closed ASAP because of 35.000 users being online at that time, so i created a free mysql database online and let it run trough the setup. After it was complete the site was not accessible anymore and the only post shown was the Wordpress Hello World post. With that said anyone could have used the vulnerability to install wordpress and upload a webshell in less than a minute und deploy another webshell hidden in the web root and dumping the user database afterwards or gain access to hidden files. As i wanted to tell XDA that their site had to be compromised to prevent damage i tried to contact them trough various channels. Emails to the webmaster, private messages to the site admin and editors, several twitter posts but no one was giving any attention to the problem. The site was back up shortly after, but there was no sign of them announcing that someone had access to their webserver, as if nothing ever happened. I hope not all the sites who have my data saved are treating it that way and i am kind of dissappointed, because i thought such a popular site would be able to deal with security issues and raise truth public awareness. The Security Issue is fixed by now and i hope they will change their mind when the next incident happens. Thank you for providing this great mailing list and another thank you goes to GOLEM.de which provided me with help in this topic and how to handle it. *TIMELINE:* 2016-03-07 # 10:10 AM Vulnerability discovered 2016-03-07 # 10:15 AM Completed Setup to prevent Site from further damage 2016-03-07 # 10:24 AM Contacted Webmaster via Email-Address from Google Cache 2016-03-07 # 11:30 AM Contacted Site Admin, Managing Editor and another Editor via private messaging system after the site was up again 2016-03-07 # 01:13 PM Twitter post to website account to inform about security breach,after not response so far 2016-03-08 # 08:13 AM Email to Golem.de on how to deal with the security issue 2016-03-11 # 05:46 AM Received email from Golem.de with the advice to publish it here Still no response (Email or News) from XDA-Developers Regards, Steffen Rogge
Source: Gmail -> IFTTT-> Blogger
No comments:
Post a Comment