12/15/2014
For those who wonder what I do for my clients, those I support with maintenance contracts for their servers, this is a good example. I prevent and/or clean up issues like this one described by Sucuri Security. Sucuri does large scale security scans, while I offer similar services on a more individual basis.
Last Monday night, Dec 8, I caught onto an increased wave of attacks on the Revolution Slider plugin. I don't like it, but two sites sites on servers I monitor got compromised, but my tools on my server caught the issue and alerted me. I cleaned up those two sites and then bulletproofed a couple dozen sites more sites that had older vulnerable versions of the Revolution Slider installed.
I then did this across all of the servers that I maintain. I also wrote a routine to detect all of the customers on those servers that used the same password for their database as had for CPanel. That routine also created a new random cPanel password for each, as needed and allowed me (or the end client) to send an email to affected customers notifying them the password change.
Though Tuesday didn't go as planned, I was able to head off this attack so that none of the sites I maintain were among the 100K WordPress sites that have been compromised so far, as this attack morphed into something more invasive.
http://blog.sucuri.net/2014/12/revslider-vulnerability-leads-to-massive-wordpress-soaksoak-compromise.html
Yesterday we disclosed a large malware campaign targeting and compromising over 100,000 WordPress sites, and growing by the hour. It was named SoakSoak due to t
