FBI says supposed ISIS sympathizers exploiting WordPress plugins

The plugins are low-hanging fruit, but the attacks have been widespread and disruptive, the FBI said

The Federal Bureau of Investigation warned on Tuesday that attackers claiming to be sympathetic to the extremist group ISIS are targeting websites that have vulnerable WordPress plugins.

The content management system has a thriving community of third-party developers who have created some 37,000 plugins, but occasionally security vulnerabilities in one can put a large number of websites at risk.

The vulnerabilities can allow the hackers to gain unauthorized access, inject scripts or install malware on the affected sites, according to an advisory published by the FBI's Internet Crime Complaint Center. The attackers have hit news organizations, religious institutions, commercial and government websites.

The defacements have occurred on websites that share some of the common WordPress plugins with vulnerabilities that are easily exploited, the FBI said.

"Although the defacements demonstrate low-level hacking sophistication, they are disruptive and often costly in terms of lost business revenue and expenditures on technical services to repair infected computer systems," the advisory said.

The attackers voice support for ISIS, sometimes referred to as ISIL, "to gain more notoriety than the underlying attack would have otherwise garnered," the FBI said.

On Tuesday, the security company Sucuri issued an advisory for a flaw it found in the WP-Super-Cache plugin, which delivers static HTML files of WordPress pages stripped of PHP scripts for improved loading times.

A cross-site scripting vulnerability in the plugin could allow an attacker to add a new administrator to a site or inject a backdoor using WordPress's theme edition tools. As many as a million WordPress sites use the plugin.

In late February, Sucuri said the same number of WordPress sites were vulnerable to takeover due to a flaw in another analytics plugin called WP-Slimstat.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags WordpressExploits / vulnerabilitiesU.S. Federal Bureau of Investigation

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Essentials

Brother MFC-L3745CDW Colour Laser Multifunction

Learn more >

Mobile

Exec

Sony WH-1000XM4 Wireless Noise Cancelling Headphones

Learn more >

Budget

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?