Attacker’s main aim is
illegal search engine optimization (SEO) as they are freely
distributing pirated WordPress, Drupal, Joomla themes and plugins,
which are packaged with a backdoor being referred to as CryptoPHP.
Last week, WhitePaper has
been released on CryptoPHP from Fox-It, and the security company also
declared that various command-and-control domains had been sinkholed
or taken down.
Approximately 23,693
unique IP addresses are observed by researchers connecting them to
the sinkholes. According to the post, by Monday that number had
decreased to 16,786.
As per the post, “These
numbers are however not a clear indication, mostly because the
servers connecting to our sinkholes were shared hosting with at least
[one] or multiple backdoored websites. This means the actual affected
websites will be higher.”
When it comes to the
23,693 connections to the sinkhole, CryptoPHP has the biggest crash
in the U.S, where researchers have observed 8,657 infections. In
Germany, 2,877 infections were observed and 1231 infections were
observed in France. Moreover, in Netherlands 1008 infections were
observed and 749 in Turkey. While in all other countries, 9171
infections were observed.
Yonathan Klijnsma, a
security analyst with Fox-IT, told SCMagazine.com in a Wednesday
email correspondence, though the number of connections to the
sinkholes is moribund. Since the attackers are still dealing out the
negotiation plugins as well as themes through their sites, the threat
is still not over. He also said that the attackers, who did not name
the backdoor CryptoPHP are possibly now aware that researchers have
caught on and may change their strategy.
Klijnsma said, “I think
by now they noticed due to domains going offline and servers being
taken down (server takedown is in process, taking down physical
machines is a lengthier process).” He also added, “So if they
know about the [whitepaper] by now I think they'll be changing their
operation. Seeing as it's a source of income for them I expect they
will continue doing this.”
There are various Drupal,
Joomla and WordPress users, who were infected with CryptoPHP while
downloading pirated themes and plugins from websites comprising
“dailynulled[dot]com” and “nulledstylez[dot]com,” the
whitepaper specifies, adding all content on these sites contained
CryptoPHP.
A lot of researchers have
also pragmatic CryptoPHP that used for automated Blackhot SEO –
technologies that influence tactics to boost the rank of websites by
popular search engines like Bing and Google.
“The backdoor gives
them full access to your server, they can do anything they want with
it,” Klijnsma said. “The content altering already happens with
the blackhat SEO and of course they could start serving malware with
those sites as well. As for the data stealing, we have already seen
that they inject JavaScript snatch into the WordPress login pages to
steal the administrators' credentials as well.”
A CTO of Sucuri Daniel
Cid told SCMagazine.com in a Wednesday email correspondence that such
types of threats are very common. Cid said, “Not only for website
themes and plugins, but also for downloads of common desktop
software.” He also added, “The main take way for webmasters is
that they have to be extra careful when downloading plugins and
themes from the internet. They should always go to the main source
and official pages to get them.”
To get more information
on Joomla development or any other open source development service,
you can hire a professional Joomla developer, who has special
expertise in open source development.
More Information Regarding Joomla Development Portfolio Click here.
About the Author
0Awesome Comments!