Websites are going offline due PHP2Shell, with WordPress and 70% of the Internet affected. The biggest risk…
Erlend G. — Co-founder / Chief Executive Officer at Secure Practice AS
Websites are going offline due PHP2Shell, with WordPress and 70% of the Internet affected. The biggest risk here may however be not the most obvious one, and may eventuall affect a lot more people than we'd like to think.
A vulnerable webshop based on e.g. WooCommerce may of course leak data about customers and purchases, which may be bad enough. But there are only so many of these out there which actually generate substantial amounts of data, and hopefully their owners see the need to protect their business by patching quickly.
🟣 The more quiet risk is what cybercriminals can do with ordinary, trusted websites, like your local sports club, other volunteer organizations and small businesses.
🟣 Phishing is still a prevalent threat to individuals and organizations, and malicious domains are deployed in the millions.
🟣 But what is even better than a new phishing domain, is an old one – one which is otherwise considered fully legit and trusted, with an excellent web reputation for years.
Exploiting the PHP2Shell vulnerability could be done to deploy phishing website content – for instance fake login pages – inside the web domains/addresses of otherwise trusted websites.
🟣 People have for years been taught to check primarily domain names they visit.
🟣 Spam filters are taught to trust domains names which are good on reputation.
🟣 Website admins rarely (never?) check site integrity beyond patching status.
That makes, in my opinion, the biggest risk of this vulnerability the otherwise unnoticed existence of phishing kits on less (or not at all) maintained websites. A risk which will only grow during the time of attacks going mainstream – and then persist until each site is taken down, one by one. Which may indeed take some time!
11 reactions · 2 comments
Comments
Ben N.: interesting about security breaches about PHP
Schomer: Spot on, Erlend. The industry’s obsession with the 'patch status checklist' is exactly why these silent campaigns succeed. When an administrator applies a patch, they assume the perimeter is restored. In reality, if an attacker dropped a web shell five minutes before the patch went live, the architectural trust boundary remains completely broken. At ETBV, we view this as a classic failure of runti