Adobe Reader and Oracle Java aren't alone in
having a bull's eye painted on their code by hackers. WordPress also is
becoming a popular target for Internet outlaws.
It's quite a large target, too. About 18 percent of the sites on the Web -- about 60 million of them -- use WordPress.
One reason WordPress is attracting hacker attention is that it's so easy to write plug-ins for it, noted Maty Siman, founder and CTO of Checkmarx.
There are more than 25,000 plug-ins written for WordPress. "That's good for WordPress, but it has some bad security implications," Siman told TechNewsWorld.
For instance, every week there are at least two advisories on critical security vulnerabilities in a WordPress plug-in.
Hacker's Paradise
Checkmarx is releasing a study Tuesday on vulnerabilities in WordPress plug-ins. The task was daunting, Siman confessed.Six months ago, the company started scanning just the top 50 WordPress plug-ins.
"We were overwhelmed by the sheer amount of results," Siman said.
So the researchers limited themselves to the five most critical vulnerabilities -- SQL injection, cross-site scripting, cross-site request forgery, file inclusion and pass reversal.
"Once we limited ourselves to those vulnerabilities, the results were more meaningful -- yet shocking," Siman said. "We found that 30 percent of the top 50 plug-ins were found to be vulnerable to at least one of the vulnerabilities."
With numbers like that, it's no wonder hackers are paying more attention to WordPress.
"They've found it's relatively easy to hack WordPress," Siman observed, "and the benefit of hacking such a website is huge, because once you find a vulnerability, you can hack into millions of websites."
"I am enough of an artist to draw freely upon my imagination. Imagination is more important than knowledge. Knowledge is limited. Imagination encircles the world." -Albert Einstein
0 comments:
Post a Comment