PHPMailer Hack puts millions of Wordpress Sites at risk

Fancy Wordpress design marketing firms can create  a pretty site, but 9.9 times out of 10, security is severely lacking. Once burned, is just too late. But try convincing your customers of that.

Well this one will grab you where it counts. A critical remote code execution vulnerability in PHPMailer, one of the most widely used PHP email sending libraries, could put millions of websites at risk of hacking.

The flaw was found by a security researcher named Dawid Golunski and an initial fix was included in PHPMailer 5.2.18, which was released Saturday. However, it turns out that the patch was incomplete and can be bypassed.

The PHPMailer library is used directly or indirectly by many content management systems (CMSs) including WordPress, Joomla and Drupal. Where the library is not included in their core code, it is likely available as a separate module or can be bundled with third-party add-ons.A critical remote code execution vulnerability in PHPMailer, one of the most widely used PHP email sending libraries, could put millions of websites at risk of hacking.

Below is a  hacked crafted email address, which if not validated in the form will allow the code to run.

From https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln-Patch-Bypass.htm

# Bypass / PHPMailer < 5.2.20 Remote Code Execution PoC Exploit (CVE-2016-10045)

"\"attacker\\' -oQ/tmp/ -X%s/phpcode.php  some\"@email.com"

Are Macs safer than Windows? Ans: A resounding NO, TL;DR read the highlighted text

You would be amazed at how many people believe and how Apple Store representatives perpetuate the following myth;  

"Mac's don't need an anti-virus solution" 💣. EPIC FAIL 💀

Anecdote

This very discussion occurred before Christmas, consequently triggering the writing of this post, when my niece purchased a Macbook Air at a local Apple Store. For the record, I was no present. In a dinner discussion with my niece, she insisted that "Mac's don't need anti-virus and it slows down the computer." I drilled her, and asked her what did the Apple Store attendant say? She did ask, and paraphrased the attendant,  "Ah, it doesn't need it." So, I spent next few hours lecturing her on how bad of an idea is surfing the internet without antivirus. That's like a women going shopping without a purse. No money, no funny. Very difficult to covey risk to a 17 year old, given her credit card info is stored on the laptop for the Apple Store, and can be ransomed.

"Mac's don't need an anti-virus solution" is not only is this misleading, in my opinion it verges on libel. The potential for credit card charges, fraud and identity theft are very high.

Myth

Let's kill "Mac's don't need an anti-virus solution" misinformation, for good. 

The great thing about the internet is factual data.

Threats Designed for Mac

Experts detected several malicious programs for Mac OS X here are some notable mentions;

• Backdoor.OSX.Laoshu –  a malicious program which makes screenshots every minute. This backdoor is signed by the trusted certificate of the developer which means the creators of the program were about to place it in the AppStore.
• Backdoor.OSX.Ventir – a multi-module Trojan spy with a hidden remote control function. It includes the keystrokes interception driver logkext, the source code for which is publicly available.
• Trojan-Downloader.OSX.WireLurker – an unusual piece of malware designed to steal victims’ data. It attacks not only Mac-based computers but iOS-based devices connected to them. There is also a Windows-based version of this malicious program. It is distributed via a well-known Chinese store that sells apps for OS X and iOS.

Number of Vulnerabilities

According to our friends at Security Vulnerability Database¹ for 2015 (Mac's worst year),

1. Mac OS X had 444 vulnerabilities versus Windows 8.1 which had 151
   
   (see chart below and drill into the details!).
2. Mac OS X has nearly 3x times the number of vulnerabilities of any version of Windows!
3. Mac OS X has nearly 2x times the number of vulnerabilities of Ubuntu Linux!

1.  CVE Details (www.cvedetails.com) is a security vulnerability database that organizes data provided by the National Vulnerability Database (NVD) in a easy to use online web interface. As its name implies, the Common Vulnerabilities and Exposures (CVE) system keeps track of publicly known information-security vulnerabilities and exposures.
CVE is a list of information security vulnerabilities and exposures that aims to provide common names for publicly known problems. The goal of CVE is to make it easier to share data across separate vulnerability capabilities (tools, repositories, and services) with this "common enumeration."

CVE Identifiers (also called "CVE names," "CVE numbers," "CVE-IDs," and "CVEs") are unique, common identifiers for publicly known information security vulnerabilities.


Infection Rate

According to McAfee Labs Quarterly Threat Report June 2017 Mac OS X malware is on the rise.

In 2014, Kaspersky introduced its first line products designed to protect Mac OS X systems blocked almost 3.7 million infection attempts that year. 19 million Mac computers were sold in 2014. 

Kaspersky also detected  1,499 malicious programs designed to target Mac OS X, 200 more than the previous year.  

The number of Mac exploits is rising year over year.

Additionally, infections go way back and to give the above chart some additional perspective. In 2012 the number of Mac's that suffered from Flashback Trojan virus was estimated to reach 700,000 Macs.

Conclusion 

Macs have less attacks, but you are more vulnerable than Windows.

An average, a Mac user encountered 9 threats during the year, in 2014.

No one is safe however, remember this factoid; 

• On average, 23% of user machines were attacked in the 10 safest countries at least once during the year in 2014.
• On average, 31.9% of user computers were subjected to at least one Malware-class web attack over the year in 2016.

Commentary

So suck it Mac heads, you are not safe. You simply benefit from hacker laziness, not being attacked as much because Mac has about 7% of desktop market vs Windows 91% in 2016 (see graph below).

Same debate is happening now with smartphones and tablets, the debate is iOS against Android. Numbers show that more than 90% of mobile malware exists on Androids. Why? Well, because Android owns over 80% of the mobile market.

Call to Action

Mac users need to get an anti-virus solution. I recommend Kapersky, rated number #1 anti-virus for many years in a row, available for Windows, Macs, Linux, Iphone and Android phone. 

Chart from Security Vulnerability Database at https://www.cvedetails.com/top-50-products.php?year=2015

Rank Product Name Vendor Name Product Type Number of Vulnerabilities 1 Mac Os X Apple OS 444 2 Iphone Os Apple OS 387 3 Flash Player Adobe Application 329 4 Ubuntu Linux Canonical OS 259 5 Air Sdk Adobe Application 259 6 AIR Adobe Application 259 7 Air Sdk & Compiler Adobe Application 259 8 Opensuse Novell OS 237 9 Internet Explorer Microsoft Application 231 10 Debian Linux Debian OS 230 11 Chrome Google Application 187 12 Firefox Mozilla Application 179 13 Solaris Oracle OS 162 14 Windows Server 2012 Microsoft OS 155 15 Windows 8.1 Microsoft OS 151 16 Windows Server 2008 Microsoft OS 150 17 Windows 7 Microsoft OS 147 18 Windows 8 Microsoft OS 146 19 Windows Rt 8.1 Microsoft OS 139 20 Windows Rt Microsoft OS 138 21 Windows Vista Microsoft OS 136 22 Safari Apple Application 135 23 Acrobat Adobe Application 130 24 Acrobat Reader Adobe Application 130 25 Android Google OS 125 26 Fedora Fedoraproject OS 125 27 Itunes Apple Application 101 28 Acrobat Reader Dc Adobe Application 97 29 Acrobat Dc Adobe Application 97 30 Firefox Esr Mozilla Application 95 31 Watchos Apple OS 88 32 Linux Kernel Linux OS 86 33 JRE Oracle Application 80 34 JDK Oracle Application 80 35 Mysql Oracle Application 77 36 Enterprise Linux Server Redhat OS 71 37 Fusion Middleware Oracle Application 68 38 Enterprise Linux Workstation Redhat OS 68 39 Enterprise Linux Desktop Redhat OS 68 40 Enterprise Linux Hpc Node Redhat OS 67 41 Apple Tv Apple Application 57 42 Windows 10 Microsoft OS 53 43 Apple Tv Apple OS 52 44 Enterprise Linux Workstation Supplementary Redhat OS 52 45 Enterprise Linux Desktop Supplementary Redhat OS 52 46 Enterprise Linux Redhat OS 52 47 Suse Linux Enterprise Desktop Novell OS 51 48 Enterprise Linux Server Supplementary Eus Redhat OS 50 49 Enterprise Linux Server Supplementary Redhat OS 49 50 Enterprise Linux Server Eus Redhat OS 47

Graph from https://netmarketshare.com/

How to fix Google Chrome - Your connection is not private

If you are getting "Your connection is not private" in Google Chrome and reload is not working. This blog will fix the most common issue causing this.

Firstly, notice is the type of NET error (red arrow in pic below) which will help you diagnose the issue.

This post will solve the following NET errors; 

1. "NET::ERR_CERT_DATE_INVALID" or "Your clock is behind" or "Your clock is ahead" - means you cannot use HTTPS because SSL certificate on server has been expired.
   
   Solution: Change time and time to be exactly time, synchronized to atomic clock. See below
   
   
2. NET::ERR_CERT_COMMON_NAME_INVALID or NET::ERR_CERT_AUTHORITY_INVALID - means that the name of the certificate does not match the site you are visiting. Server's certificate does not match the URL. Server could not prove that it is the trusted Website because its security certificate is from different URL.

   
   

   Quick Solution:  Try only use http:// to load the page. Don't use https://, since some top websites that still use http://, but usually not the cause.
   
   Solution: Change time and time to be exactly time, synchronized to atomic clock. See below

   
   

Other common NET errors are; 

1. NET::ERR_CERT_AUTHORITY_INVALID – It means the SSL certificate issuing authority is unverified.
2. NET::ERR_CERT_REVOKED – It means the SSL certificated has been removed by issuing authority.
   
   Solution: https://support.google.com/chrome/answer/6098869

Solution: How to set exact time on Windows 8, 8.1, 10

Right-click the time in system tray (1) and choose Adjust date/time (2)

Make sure "Set time automatically" is On. Make This will update from Microsoft's default time server.

Done !

Now that should update you clock to match your phone time exactly! Being off by a few seconds can cause this error.  


Click Reload button in page. This should fix the issue. If not then time has not updated, see below! 


If times does not update immediately, continue below to force a refresh!

Detailed Time Settings

Choose Region & language on left panel

In diagram below follow these steps as numbered; 

1. Choose Additionally date, time & regional settings
2. Opens a new window and click Set the time and date
3. Opens new window and choose  Change settings... button.

This opens a window titled Internet Time Settings

Which indicates the Internet time server currently being used synchronized with.

Click Update now to refresh and get exact current time!

Done.

Click Reload button in Google Chrome. This should fix the issue.

Set a Time Server for your country

NOTE: For privacy and more accurate time, choose a time server close to you. Most of these time servers are based on the official atomic clock for you country.

Each respectable nation in the world, has their own Time Servers, and here's a brief list; 

1. USA      - time.nist.gov
2. Canada  - time.nrc.ca
3. UK        - ntp2c.mcc.ac.uk  University of Manchester
                   (UK Nation Physics Lab  NTP Server is no longer funded) 
4. More NTP Servers listed here for more country selection
   http://support.ntp.org/bin/view/Servers/StratumOneTimeServers

Solution:  How to set exact time on Windows 7

Same as above as in Win10

Canadian Cybersecurity Survey 2016

Tip! Page-Up, Page-Down keys enable when you click on presentation.