Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Wordpress Security

1,537 views

Published on

Vortrag auf der WordCamp 2016 in Nürnberg von Daniel Potthast zum Thema WordPress Sicherheit.

Published in: Internet
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download Full EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download Full doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download PDF EBOOK here { https://soo.gd/irt2 } ......................................................................................................................... Download EPUB Ebook here { https://soo.gd/irt2 } ......................................................................................................................... Download doc Ebook here { https://soo.gd/irt2 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book THIS can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer THIS is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story THIS Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money THIS the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths THIS Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://shorturl.at/mzUV6 } ......................................................................................................................... Download Full EPUB Ebook here { http://shorturl.at/mzUV6 } ......................................................................................................................... Download Full doc Ebook here { http://shorturl.at/mzUV6 } ......................................................................................................................... Download PDF EBOOK here { http://shorturl.at/mzUV6 } ......................................................................................................................... Download EPUB Ebook here { http://shorturl.at/mzUV6 } ......................................................................................................................... Download doc Ebook here { http://shorturl.at/mzUV6 } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • DOWNLOAD THAT BOOKS INTO AVAILABLE FORMAT (2019 Update) ......................................................................................................................... ......................................................................................................................... Download Full PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download Full doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download PDF EBOOK here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download EPUB Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... Download doc Ebook here { http://bit.ly/2m6jJ5M } ......................................................................................................................... ......................................................................................................................... ................................................................................................................................... eBook is an electronic version of a traditional print book that can be read by using a personal computer or by using an eBook reader. (An eBook reader can be a software application for use on a computer such as Microsoft's free Reader application, or a book-sized computer that is used solely as a reading device such as Nuvomedia's Rocket eBook.) Users can purchase an eBook on diskette or CD, but the most popular method of getting an eBook is to purchase a downloadable file of the eBook (or other reading material) from a Web site (such as Barnes and Noble) to be read from the user's computer or reading device. Generally, an eBook can be downloaded in five minutes or less ......................................................................................................................... .............. Browse by Genre Available eBooks .............................................................................................................................. Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, ......................................................................................................................... ......................................................................................................................... .....BEST SELLER FOR EBOOK RECOMMEND............................................................. ......................................................................................................................... Blowout: Corrupted Democracy, Rogue State Russia, and the Richest, Most Destructive Industry on Earth,-- The Ride of a Lifetime: Lessons Learned from 15 Years as CEO of the Walt Disney Company,-- Call Sign Chaos: Learning to Lead,-- StrengthsFinder 2.0,-- Stillness Is the Key,-- She Said: Breaking the Sexual Harassment Story That Helped Ignite a Movement,-- Atomic Habits: An Easy & Proven Way to Build Good Habits & Break Bad Ones,-- Everything Is Figureoutable,-- What It Takes: Lessons in the Pursuit of Excellence,-- Rich Dad Poor Dad: What the Rich Teach Their Kids About Money That the Poor and Middle Class Do Not!,-- The Total Money Makeover: Classic Edition: A Proven Plan for Financial Fitness,-- Shut Up and Listen!: Hard Business Truths that Will Help You Succeed, ......................................................................................................................... .........................................................................................................................
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Wordpress Security

  1. 1. WORDPRESS SECURITY WORDCAMP NÜRNBERG 2016 Daniel Potthast
 @d_potthast#wcnbg
  2. 2. WORDPRESS SECURITY AGENDA WORDPRESS SECURITY ▸ Aktuelle Lage ▸ Automatische Updates ▸ Zugriffsbeschränkung
  3. 3. WORDPRESS SECURITY
 AKTUELLE LAGE
  4. 4. WORDPRESS SECURITY: AKTUELLE LAGE WORDPRESS AUF 26% ALLER INTERNETSEITEN1 ▸ Oftmals … ▸ … kein HTTPS für Backend (WP-Admin) ▸ … Standardbenutzer und einfache Passwörter ▸ … (zu viel) Plug-Ins aktiviert 1 http://w3techs.com/technologies/details/cm-wordpress/all/all
  5. 5. WORDPRESS SECURITY: AKTUELLE LAGE RANSOMWARE BEFÄLLT AUCH WEBSERVER
  6. 6. WORDPRESS SECURITY: AKTUELLE LAGE RANSOMWARE BEFÄLLT AUCH WEBSERVER ▸ CTB-Locker
 „Your personal files are encrypted by CTB-Locker. Your scripts, documents, photos, databases and other important files have been encrypted with strongest encryption algorithm AES-256 and unique key, generated for this site.“
 → Wiederherstellung (bisher) unmöglich
 → Externe Backups regelmäßig erstellen
  7. 7. WORDPRESS SECURITY: AKTUELLE LAGE DER FALL MOSSACK FONSECA ▸ WordPress auf der Hauptseite ▸ Revolution Slider (Version 2.1.7)
 Zugriff auf Systemdateien und Zugangsdaten ▸ WP SMTP plugin
 Zugangsdaten des Mail-Servers im Klartext gespeichert → Gefahr durch veraltete Plug-Ins
 → Regelmäßig Updates und Security-Fixes installieren
 → Nicht mehr gepflegte Plug-Ins ersetzen https://www.wordfence.com/blog/2016/04/mossack-fonseca-breach-vulnerable-slider-revolution/
  8. 8. WORDPRESS SECURITY
 AUTOMATISCHE UPDATES
  9. 9. WORDPRESS SECURITY: AUTOMATISIERTE UPDATES PROBLEM ▸ WordPress Core und Plug-Ins sollten regelmäßig aktualisiert werden ▸ Theoretisch kein Problem:
 WordPress kann automatisch aktualisieren ▸ Automatische Updates benötigen Schreibrechte für PHP
 oder FTP-Zugang
 → keinesfalls Lese- und Schreibrechte für „alle“ (777)
 → keine Absicherung bei Angriffen
  10. 10. WORDPRESS SECURITY: AUTOMATISIERTE UPDATES LÖSUNG ▸ Unix-Rechteverwaltung sinnvoll nutzen
 Standardwerte: Ordner = 755, Dateien = 644 ▸ 7 6 4
 rwx rwx rwx
 Besitzer Gruppe Sonstige ▸ Live-Modus ▸ Rechte Ordner (chmod 755), Rechte Dateien (444)
 → PHP kann keine Dateien / Ordner schreiben
  11. 11. WORDPRESS SECURITY: AUTOMATISIERTE UPDATES LÖSUNG ▸ Update-Modus ▸ Rechte Dateien / Ordner (777)
 → PHP kann Dateien / Ordner schreiben und ausführen ▸ Vorgehen ▸ Rechte werden nur für die Zeit der Updates gesetzt ▸ Benutzer können zusätzlich angepasst werden, jedoch ▸ Einschränkungen beim Shared Hosting ▸ PHP-CGI-Prozesse laufen oftmals mit Standardbenutzer
  12. 12. WORDPRESS SECURITY: AUTOMATISIERTE UPDATES UMSETZUNG ▸ Shared-Hosting mit Cronjobs und SSH ▸ all-inkl: ab Premium-Paket ▸ domainfactory: ab Professional-Paket ▸ STRATO: ab PowerWeb Plus ▸ Eigener Server ▸ Cronjobs über crontab ▸ Jobs mit Jenkins (continuous integration)
  13. 13. WORDPRESS SECURITY: AUTOMATISIERTE UPDATES UMSETZUNG ▸ Update-Modus aktivieren
 
 
 ▸ Live-Modus aktivieren cd /var/www chmod -R 0777 ./wordpress cd /var/www find ./wordpress -type d -exec chmod 755 {} ; find ./wordpress -type f -exec chmod 444 {} ; find ./wordpress/wp-content/cache -type f -exec chmod 644 {} ; find ./wordpress/wp-content/uploads -type f -exec chmod 644 {} ;
  14. 14. WORDPRESS SECURITY: AUTOMATISIERTE UPDATES UMSETZUNG ▸ WP-CLI herunterladen ▸ Updates installieren cd ~ curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages⤸ /phar/wp-cli.phar chmod +x wp-cli.phar ./wp-cli.phar core update --path=/var/www/wordpress (--debug) ./wp-cli.phar core update-db --path=/var/www/wordpress ./wp-cli.phar plugin update --all --path=/var/www/wordpress ./wp-cli.phar theme update --all --path=/var/www/wordpress
  15. 15. WORDPRESS SECURITY: AUTOMATISIERTE UPDATES ÜBER DEN TELLERRAND ▸ Zusätzliche Überprüfung ▸ Tools wie WPScan suchen nach Schwachstellen
 http://wpscan.org/
  16. 16. WORDPRESS SECURITY
 ZUGRIFFSBESCHRÄNKUNG
  17. 17. WORDPRESS SECURITY: ZUGRIFFSBESCHRÄNKUNG .HTACCESS-DATEIEN BEI APACHE-WEBSERVER ▸ Ordner-Auflistung deaktivieren ▸ Direktzugriff nur für bestimmte Dateitypen erlauben
 Options All -Indexes Order deny,allow Deny from all <Files ~ ".(css|doc|docx|gif|jpe?g|js|odf|pdf|png|rar|rtf|xls|xlsx|⤸ xml|zip)$"> Allow from all </Files>
  18. 18. WORDPRESS SECURITY: ZUGRIFFSBESCHRÄNKUNG .HTACCESS-DATEIEN BEI APACHE-WEBSERVER ▸ Login nur nach Passworteingabe ▸ Zugriff auf wp-includes Ordner blockieren
 <Files wp-login.php> AuthType Basic AuthName "Restricted Admin-Area" AuthUserFile /pfad/zur/.htpasswd Require valid-user </Files> <IfModule mod_rewrite.c> RewriteEngine On RewriteBase / RewriteRule ^wp-admin/includes/ - [F,L] RewriteRule !^wp-includes/ - [S=3] RewriteRule ^wp-includes/[^/]+.php$ - [F,L] </IfModule>
  19. 19. WORDPRESS SECURITY: ZUGRIFFSBESCHRÄNKUNG .HTACCESS-DATEIEN BEI APACHE-WEBSERVER ▸ Zugriff auf wp-config.php blockieren
 
 
 
 ▸ Zugriff auf .htaccess-Dateien blockieren <files ~ "^.*.([Hh][Tt][Aa])"> Order allow,deny Deny from all Satisfy all </files> <files wp-config.php> Order allow,deny Deny from all </files>
  20. 20. WORDPRESS SECURITY: LEARNINGS ZUSAMMENFASSUNG ▸ Möglichst wenig (Schreib-) Rechte für Web-Server ▸ Updatebarkeit ist Schutz und Risiko gleichzeitig ▸ Regelmäßig externe Backups erstellen ▸ Dateien: ohne Schreibrechte für Web-Server ▸ Datenbank: komplette Dumps ▸ Veraltete Plug-Ins entfernen / ersetzen
  21. 21. WORDPRESS SECURITY DANKE FÜR DIE AUFMERKSAMKEIT ▸ Daniel Potthast
 dp@sblum.de
 @d_potthast ▸ Präsentation
 ! https://sblum.de/wordcamp

×