Malware disguised as crypcurrency wallets and WordPress sites are getting hacked

WordPress sites are getting hacked after TLS certificate issuance

WordPress sites are getting hacked after TLS certificate issuance as attackers pounce before site owners can activate the installation wizard

WordPress sites are getting hacked after TLS certificate issuance is achieved when an attacker abuse the Certificate Transparency (CT) system to compromise new WordPress sites.

Do you see the ‘short’ window of time before the content management system (CMS) has been configured and therefore secured? That is where they exploit.

CT is a web security standard for monitoring and auditing TLS (aka SSL) certificates, which are issued by certificate authorities (CAs) to validate websites’ identities.

DDoS attack

WordPress sites are getting hacked has something to do with DDoS attacks too. With time, it is now a bit clear that hackers are monitoring these logs in order to detect when new WordPress domains are set up and configure the CMS themselves after web admins upload the WordPress files, but before they manage to secure the website with a password.

Domain owners and website admins alike report the appearance of a malicious file (/wp-includes/.query.php) and sites being press-ganged into joining DDoS attacks.

This can be a real sign your website has been hacked or even compromised. Ignoring signs like this can be a reason why WordPress sites are getting hacked frequently through this means.

Should you use ‘automation’?

It is therefore suggested that the responsibility for protecting new WordPress sites mainly lies with domain owners, website admins, and hosting providers.

“Getting a certificate from Let’s Encrypt may make it easier to detect a new installation, but nobody should be putting WordPress installations on the public internet until they are secured. If a hosting provider or any other entity is doing that, please report it as a vulnerability in their deployment process.”

Josh Aas, executive director at the Internet Security Research Group

“This only affects direct installations – if a site is on any recommended host, or the installation process is automated, there is usually a pre-configured config file so the installation process is complete/is not interactive and there’s little chance for that attack”.

Josepha Haden, executive director on the WordPress project at Automattic

WordPress sites are getting hacked all over the world. This is a call for concern. If you are a web developer, admin, or business owner that is into hosting services, please do your best to identify malicius files and secure your website regularly.

Leave a Comment

Your email address will not be published.