{"id":103062,"date":"2022-01-22T15:36:42","date_gmt":"2022-01-22T13:36:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/%d0%b1%d1%8d%d0%ba%d0%b4%d0%be%d1%80-%d0%b2-93-%d0%bf%d0%bb%d0%b0%d0%b3%d0%b8%d0%bd%d0%b0%d1%85-%d0%b8-%d1%82%d0%b5%d0%bc%d0%b0%d1%85-%d0%be%d1%84%d0%be%d1%80%d0%bc%d0%bb%d0%b5%d0%bd%d0%b8%d1%8f-acces"},"modified":"2022-01-22T15:36:42","modified_gmt":"2022-01-22T13:36:43","slug":"%d0%b1%d1%8d%d0%ba%d0%b4%d0%be%d1%80-%d0%b2-93-%d0%bf%d0%bb%d0%b0%d0%b3%d0%b8%d0%bd%d0%b0%d1%85-%d0%b8-%d1%82%d0%b5%d0%bc%d0%b0%d1%85-%d0%be%d1%84%d0%be%d1%80%d0%bc%d0%bb%d0%b5%d0%bd%d0%b8%d1%8f-acces","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/%d0%b1%d1%8d%d0%ba%d0%b4%d0%be%d1%80-%d0%b2-93-%d0%bf%d0%bb%d0%b0%d0%b3%d0%b8%d0%bd%d0%b0%d1%85-%d0%b8-%d1%82%d0%b5%d0%bc%d0%b0%d1%85-%d0%be%d1%84%d0%be%d1%80%d0%bc%d0%bb%d0%b5%d0%bd%d0%b8%d1%8f-acces","title":{"rendered":"A backdoor has been found in 93 AccessPress plugins and themes used on 360,000 websites.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Attackers succeeded in embedding a backdoor in 40 plugins and 53 themes for the WordPress content management system developed by AccessPress, which claims its additions are used on over 360,000 websites. The results of the incident analysis have not yet been disclosed, but it is presumed that the malicious code was injected during the compromise of the AccessPress website, modifying the suggested downloads of archives with already released versions, since the backdoor is present only in the code distributed via the official AccessPress site, but is absent in the same versions of the additions distributed through the WordPress.org directory. <\/p>\n

The presence of malicious modifications was detected by a researcher from JetPack (a division of Automatic, which develops WordPress) while examining the malicious code found on a client's website. An analysis of the situation revealed that the malicious changes existed in a WordPress plugin downloaded from the official AccessPress site. Other plugins from the same manufacturer were also found to be subject to malicious modification, allowing full access to the site with administrative privileges. <\/p>\n

During the modification, attackers added a file named «initial.php» to the archives of plugins and themes, which was included via the «include» directive in the «functions.php» file. To obscure their tracks, the malicious content in the «initial.php» file was camouflaged as a data block encoded in base64. The malicious insertion, masquerading as an image retrieval from the site wp-theme-connect.com, directly loaded the backdoor code into the file wp-includes\/vars.php.

\"A<\/center>
\"A<\/center> <\/p>\n

The first websites incorporating malicious changes in AccessPress plugins were identified in September 2021. It is assumed that this is when the backdoor was embedded in the plugins. The first notification to AccessPress about the detected issue went unanswered, and AccessPress only managed to attract attention after involving the WordPress.org team in the investigation. On October 15, 2021, the infected backdoor archives were removed from the AccessPress site, and on January 17, 2022, new versions of the plugins were released. <\/p>\n

Sucuri separately investigated the sites that had compromised versions of AccessPress and identified the presence of malware modules uploaded via a backdoor, which were spamming and redirecting traffic to fraudulent sites (the modules were dated 2019 and 2020). It is believed that the authors of the backdoor sold access to the compromised sites. <\/p>\n

The themes where the backdoor substitution was detected: <\/p>\n