{"id":9683,"date":"2015-08-31T10:50:09","date_gmt":"2015-08-31T14:50:09","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=9683"},"modified":"2019-11-15T07:02:21","modified_gmt":"2019-11-15T12:02:21","slug":"security-week-35","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/security-week-35\/9683\/","title":{"rendered":"Security Week 35: Nothing personal, just business"},"content":{"rendered":"

The industry of infosec news (if there is one, after all), while not that similar to cry-wolf Vanity Fair type of media, is constantly agitated and always looking for the scoop. For instance, one of the most popular pieces of news on Threatpost last year was quite a mediocre one, covering the PNG vulnerability<\/a>. It wasn\u2019t even a vulnerability as such, just a method of obscuring a malicious code in the image\u2019s metadata. Why did that happen? Someone (not us, obviously!) decided to announce the flaw as \u2018You can infect your PC by looking at cat pics!!111\u2019.<\/p>\n

\"Infosec<\/a><\/p>\n

Of course, once some supermassive hole allowing culprits to infect millions of machines is discovered, I\u2019d be happy to write about it, but those are nowhere to be seen. Many years have passed since Slammer<\/a>: that sneaky little malware was able to infect a Windows XP PC in just 30 minutes and needed only connection to the Internet.<\/p>\n

As for current software, it is not such an easy target (yet). But what if something dreadful happened? Something that would leave everyone awed, heartbroken and thinking about next-level PC\/phone\/fridge security, or, otherwise, every device or appliance would turn into a useless piece of plastic\/metal\/whatever to some evil maniac\u2019s will. The world is on fire! Mamma mia! Porca Madonna! Ributtati all\u2019et\u00e0 della pietra con solo carta e penna per archiviare e condividere informazioni!<\/p>\n

Er. Epic fails in information security are plausible \u2014 take all those IoT things, for example \u2014 but are unlikely to happen. While we are waiting for some big kaboom, we might overlook some serious but down-to-Earth flaws, with which someone effectively wins and someone effectively loses. They are nothing but outstanding vulnerabilities \u2014 business as usual.<\/p>\n

#Security Week 35: vulns in @Wordpress, @GitHub #DDoS, @Wyndham responsible for #breach, while @Target is not<\/p>Tweet<\/a><\/blockquote>\n

In today\u2019s digest of information security news, we will cover three cases of routine vulnerabilities, which are massively and effectively exploited. Once again, the rules of the road: every week Threatpost\u2019s team handpicks three important news stories, which I would restlessly comment. All previously aired episodes can be found here<\/a>.<\/p>\n

Hacked WordPress websites are used to deliver the Neutrino exploit pack<\/h3>\n

News<\/a>. ZScaler<\/a> research.<\/p>\n

This news should be divided in two parts. The first parts would be about thousands blogs and websites based on the WordPress engine which is highly vulnerable. The second part would cover the methods used by hackers exploiting these vulnerabilities, the malware they use to infect users\u2019 PCs and, ultimately, the way they extract money from their hacking scheme.<\/p>\n

Now, WordPress. It\u2019s like a web-based Windows. It\u2019s a very popular web engine with an extensive plug-in system, which, by design, enjoys high level of attention from cybercriminals. Just look at this year\u2019s news coverage (and that\u2019s not all!):<\/p>\n