Some of our WordPress instances were exploited yesterday at 11 AM UTC. We noticed that the compromise had taken place today and took the blogs offline as soon as we noticed. We have since restored the WordPress files from backup* to a new set of servers. Using our logs we were able to identify the exploit used as a vulnerability in timthumb.php which was included in a theme installed on our wordpress instances and we have removed the theme.

What does this mean to you as a user? If you have an account on one of our blogs then your password has been reset. However, if you have used the same password on other sites then you should also reset that password on those sites.

We apologize for this inconvenience and breach of trust. We will be using more rigorous security procedures around our blog network going forward.

*The database backups were failing but we did have a backup of all the files. We manually combed over the database to find any signs of damage but were unable to find any.

  • 5
    Will also be emailing all users that had blog accounts shortly – Kyle Brandt Jul 3 '12 at 21:45
  • 9
    timthumb eh? I knew Tim Stone had to be involved!!! – animuson Jul 3 '12 at 21:46
  • 2
    Would the email accounts that signed up have been taken with the passwords? (I would certainly assume so) – Ben Brocka Jul 3 '12 at 21:49
  • 4
    @BenBrocka: From what we can see it was all bot activity. We don't know that the password hashes and emails were actually taken. However, they would have had the opportunity to get both emails and password hashes. – Kyle Brandt Jul 3 '12 at 21:50
  • 11
    Possibly related: Using the Stack engine for the blog – Jon Ericson Jul 3 '12 at 21:56
  • 4
    @MadScientist: The default MD5 multipass + salt, we have changed the salt: codex.wordpress.org/Function_Reference/wp_hash_password – Kyle Brandt Jul 3 '12 at 22:02
  • 6
    @KyleBrandt MD5 is not a good choice for a password hashing algorithm. – blahdiblah Jul 3 '12 at 22:08
  • 3
    @blahdiblah I don't think Kyle chose MD5, and I doubt it was implemented recently. I think everyone is aware there are better algorithms available. – Aaron Bertrand Jul 3 '12 at 22:09
  • 7
    The real problem is a programer of a plugin used in a theme thought this was a good way to check string equality: if (strpos (strtolower ($url_info['host']), $site) !== false) – Zypher Jul 3 '12 at 22:11
  • 11
    @animuson I strongly deny that I would ever willingly touch WordPress. – Tim Stone Jul 3 '12 at 22:19
  • 4
    @JayRiggs to rep-cap Kyle, obviously. – Peter Grace Jul 3 '12 at 22:49
  • 6
    @ScottPack For all intents and purposes, this is meta.stackexchange. – Adam Lear Jul 3 '12 at 23:14
  • 7
    @AnnaLear You've stumbled upon the entire point of my bringing it up. – Scott Pack Jul 3 '12 at 23:22
  • 17
    Maybe it's time to ditch wordpress and create a good, integrated blogging platform for Stack Exchange. – nhinkle Jul 3 '12 at 23:43
  • 5
    @ScottPack I'd rather we get a real SE blogging solution before splitting MSO and MSE...MSO is significantly less of a usability nightmare and security risk – Ben Brocka Jul 4 '12 at 0:34

Browse other questions tagged .