Stacey

Is Your Site Safe from the Shell Shock (Bash) Vulnerability?

/in /by

What is It?

This vulnerability attacks your host, not your website itself. It is important to check to make sure your host has patched the bug to ensure your site is safe. Some say this security threat could be bigger than HeartBleed a few months ago, so it is important to know your site it protected.

 

Has Your Host Responded?

Below are excerpts from each host explaining how they responded to Shell Shock.

 

BlueHost

logo-1

As one of the first organizations to know about the exploit, we immediately began taking action to secure our platform.  Using the RedHat public patch as a primary resource, we patched our own implementation of Bash to secure our platform, and have deployed that to all our servers.

Official Response

GoDaddy

imgres

We’re patching our servers. We began patching our servers yesterday when we learned of the vulnerability. We’ve got a lot of work to do, but our goal is to finish patching by end of day today. We’ve also added additional security filters to protect your accounts while we patch our servers. (9/25/14)

Official Response

HostGator

images

“You should know that all HostGator servers have been patched as of this writing. We identified the issue very early-on and developed the necessary solution for our environment.”

Official Response

WP Engine

imgres-1

Because we specifically block CGI execution on customer sites by default—as it does not need to be “on” in order to get WordPress to run—our users are already protected from this exploit. Our use of AppArmor on all servers also offers additional protections that would keep attackers from gaining access to anything beyond the site they are visiting.

Official Response

SiteGround

imgres-2

All SiteGround servers were patched in less than 24 hours the vulnerability was announced. In addition, our unique server setup including the special chroot isolation has made it highly unlikely for any attacker to have been able to utilize this vulnerability and gain access to sensitive information even before the patch.

Official Response

 

Don’t See Your Host Listed Here?

Download and activate this plugin, which will let you know if your site is secure from Shell Shock.

 

Stacey

Security Alert: Slider Revolution

/in /by

What is Slider Revolution?

slider-revolution

It is one of the most common sliders (rotating slideshows) used in premium WordPress themes. Chances are,  your site uses this plugin if your theme was purchased through ThemeForest.

What is the Problem?

Old versions of Slider Revolution (Pre 4.5) can allow access to your wp-config.php file. This means a hacker has the ability to completely take over your website and do what they wish with it. This is a major security flaw that the developers of the plugin did not disclose to the public until after they released a fix.  Revolution Slider is a premium plugin, which eliminates the ability to alert your site of an update through the “Plugins” page of WordPress.

What Should You Do About It?

First, check to see if your site is using Slider Revolution. You will see this menu at the bottom left side of your WordPress Dashboard:

rev-wordpress

If you do see this, your site currently uses Slider Revolution. You may not see it in your Plugins list if it was bundled with a premium theme.

You have two options:

  1. Update the Plugin
    • Download the new version of Slider Revolution here.
    • Go to your file manager (or FTP) and upload the new version in your “Plugins” folder.
  2. Update Your Theme
    • See what theme you are using by clicking “Appearance” then “Themes”. This page will show you the active theme on your site.
    • Search for that theme at ThemeForest, download the new version, find Slider Revolution files and replace in your theme.

If you need help doing this, let us know!

 

Major Security Vulnerability in WordPress, Drupal Could Take Down Websites

/in /by

Another reason to keep your WordPress installs up-to-date. Today WordPress released 3.9.2 to patch this particular threat.

Stacey

(Another) WordPress Security Alert

/in /by

This security alert is not specific to any plugin or theme, but to WordPress sites in general. According to Sucuri, the past few days has seen a much higher than normal amount of sites infected with malicious code.

What does it look like?

If your site is behaving strangely or is displaying content you are not familiar with, you may be infected. You can use Sucuri’s scanning tool here, to be see if that is the case.

What can you do to protect yourself?

  1. Create a regular backup of your site so you can restore your site if you do get infected.
  2. Update your admin passwords to be as strong as possible. This is the easiest and most effective way you can protect yourself.
  3. Update all plugins on your site to their most recent versions to close any security holes.

WordPress can be a dangerous place, protect yourself!

Stacey

WPTouch Security Vulnerability

/in /by

If you are using the plugin WPTouch, you should be updating it immediately because of a vulnerability caught by the good folks at Sucuri. WPTouch is a great plugin for a mobile specific site, just make sure you are using the most current version that has patched the security vulnerability. Read more