The FBI has warned that ISIL is exploiting vulnerabilities in WordPress sites running out-of-date versions of WordPress or old versions of certain plugins or themes to deface the sites.

The FBI’s statement:  http://www.ic3.gov/media/2015/150407-1.aspx

Sucuri’s writeup with mention of specific plugins to check:  http://blog.sucuri.net/2015/04/fbi-public-service-annoucement-defacements-exploiting-wordpress-vulnerabilities.html

The current version of WordPress (as of 4/8/2015) is 4.1.1.  If you are running any earlier version, you are vulnerable.  If you need to upgrade, you can do so from your WordPress admin login or by downloading the latest version of WordPress from https://wordpress.org/  Don’t forget to  update any out-of-date plugins or themes as well.

If you need help updating your HIS-hosted WordPress site, open a support request ticket at http://info.his.com/support/support.his.com.html

According to Ars Technica, encrypted eBay passwords and other information have been stolen by cyberattackers.  If you have an eBay account, change your password ASAP.  If your eBay password is one you’ve used on other services, including your accounts with HIS, change those passwords too, and don’t use the same password on more than one service.

When password lists are leaked this way, even in encrypted form, the bad guys have very powerful tools for cracking the passwords, and the cracked passwords go into their database of passwords that are used somewhere and thus are probably also used somewhere else, increasing your likelihood of being hacked on another system if you’re using the same password there.

We know that it’s a pain to change passwords, especially email passwords where you might have several devices checking your account (a phone, a tablet, multiple computers), but it’s a bigger pain to get hacked.  When we detect a hacked account, we change the password immediately and there’s a period of time between then and when we can reach you when you’re without access to your account.   If you use strong passwords (mixed upper/lower case, numbers, punctuation) and you don’t use a password on more than one account, your odds of having your account hijacked are greatly reduced.

You may have read about the bug in OpenSSL that allowed attackers to access random 64k byte chunks of memory.  This bug was reported by CERT on Monday, April 7, 2014.  Software vendors supplied patches on April 7 and 8.  A few of our SSL servers were vulnerable, and we had all patches applied and were able to confirm that the patches worked on all servers April 7 and 8.

Many of the most popular internet sites were affected, including Google, Facebook, Youtube, Yahoo!, Bing, Pinterest, Blogspot, Instagram, Tumblr, Reddit, Netflix, Yelp, Blogger, Dropbox, and the Washington Post (to name a few).

This was a nasty bug – it left no traces in server logs, so there’s no way to tell whether it was exploited by bad guys.  There’s an XKCD cartoon that shows how the exploit worked.

We prefer to err on the side of caution, so we have replaced our own SSL certificates and have changed important passwords.  Odds of your password being exposed on a server that we host are low, but not zero, and since many people use the same passwords on multiple sites (a really bad idea – don’t do this), we’re encouraging everybody to change their passwords.  If you use the same password on, say, Facebook, that you use with your email account, and bad guys managed to get the password from Facebook, you’re exposed.

Our Zimbra email servers were not vulnerable, but we still recommend that you consider changing your password anyway in case you’ve used the same password somewhere else.  Instructions for customers on Zimbra servers are here (use the webmail URL for your domain).  If your email account is on a Plesk server, instructions are here.  If you need  help, open a ticket at https://support.his.com/home.

Changing your password isn’t mandatory, but it’s a good idea, especially if you think you may have used the same password anywhere else.

Windows XP has reached end-of-life, and there will be no updates or security patches for XP after April 8, 2014.  The bad news is that CERT estimates that 30% of all internet-connected PCs are still running XP, so a lot of people are going to be exposed to the latest malware with no help from Microsoft.

If you’re running Windows XP,  it’s time to upgrade (or change to Mac or Linux).

National Cyber Awareness System: TA14-069A: Microsoft Ending Support for Windows XP and Office 2003 03/10/2014 10:56 AM EDT Original release date: March 10, 2014 Systems Affected Microsoft Windows XP with Service Pack 3 (SP3) Operating System Microsoft Office 2003 Products Overview Microsoft is ending support for the Windows XP operating system and Office 2003 product line on April 8, 2014. [1] After this date, these products will no longer receive: Security patches which help protect PCs from harmful viruses, spyware, and other malicious software Assisted technical support from Microsoft Software and content updates Description All software products have a lifecycle. End of support refers to the date when Microsoft no longer provides automatic fixes, updates, or online technical assistance. [2] As of February 2014, nearly 30 percent of Internet-connected PCs still run Windows XP. [3] Microsoft will send “End of Support” notifications to users of Windows XP who have elected to receive updates via Windows Update. Users in organizations using Windows Server Update Services (WSUS), System Center Configuration manager, or Windows Intune will not receive the notification. [4] Impact Computer systems running unsupported software are exposed to an elevated risk to cybersecurity dangers, such as malicious attacks or electronic data loss. Users may also encounter problems with software and hardware compatibility since new software applications and hardware devices may not be built for Windows XP or Office 2003. Organizations that are governed by regulatory obligations may find they are no longer able to satisfy compliance requirements. [4] Solution Computers operating Windows XP with SP3 or running Office 2003 products will continue to work after support ends. However, using unsupported software may increase the risk of viruses and other security threats. Users have the option to upgrade to a currently supported operating system or office productivity suite. The Microsoft “End of Support” pages for Windows XP and Office 2003 offer additional details. There are software vendors and service providers in the marketplace who offer assistance in migrating from Windows XP or Office 2003 to a currently supported operating system or office productivity suite. US-CERT does not endorse or support any particular product or vendor. Users who choose to continue using Windows XP after the end of support may mitigate some risks by using a web browser other than Internet Explorer. The Windows XP versions of some alternative browsers will continue to recieve support temporarily. Users should consult the support pages of their chosen alternative browser for more details. References [1] Support is ending for Office 2003 [2] Windows lifecycle fact sheet [3] Operating system market share [4] Support for Windows XP is ending Revision History March 10, 2014 – Initial Release