Cov neeg tawm tsam tau tswj hwm qhov chaw rov qab rau hauv 40 plugins thiab 53 lub ntsiab lus rau WordPress cov ntsiab lus tswj hwm, tsim los ntawm AccessPress, uas lees tias nws cov add-ons tau siv ntau dua 360 txhiab qhov chaw. Cov txiaj ntsig ntawm kev soj ntsuam ntawm qhov xwm txheej tseem tsis tau muab, tab sis nws yog qhov xav tias cov cai tsis zoo tau qhia thaum lub sijhawm muaj kev cuam tshuam ntawm AccessPress lub vev xaib, hloov pauv rau cov ntaub ntawv khaws cia rau rub tawm nrog cov ntawv tso tawm uas twb tau tso tawm lawm, txij li lub backdoor yog tam sim no. tsuas yog nyob rau hauv cov cai muab faib los ntawm lub official AccessPress lub website, tab sis yog tsis muaj nyob rau hauv cov tib tso tawm add-ons faib los ntawm WordPress.org directory.
Cov kev hloov pauv tsis zoo tau tshawb pom los ntawm tus kws tshawb fawb ntawm JetPack (ib ntu ntawm WordPress tus tsim tawm Tsis Siv Neeg) thaum tshawb xyuas cov lej tsis zoo pom ntawm tus neeg siv lub vev xaib. Kev tshuaj xyuas ntawm qhov xwm txheej tau pom tias muaj kev hloov pauv tsis zoo nyob hauv WordPress add-on rub tawm los ntawm official AccessPress lub vev xaib. Lwm cov add-ons los ntawm tib lub chaw tsim khoom kuj raug hloov kho tsis zoo uas tso cai rau nkag mus rau hauv lub xaib nrog cov cai tswj hwm.
Thaum lub sijhawm hloov kho, cov neeg tawm tsam tau ntxiv cov ntaub ntawv "initial.php" rau cov ntaub ntawv nrog plugins thiab cov ntsiab lus, uas tau txuas nrog ntawm "nrog" cov lus qhia hauv "functions.php" cov ntaub ntawv. Txhawm rau kom tsis meej pem txoj kev, cov ntsiab lus tsis zoo hauv cov ntaub ntawv "initial.php" tau camouflaged raws li base64 encoded thaiv cov ntaub ntawv. Lub siab phem ntxig, nyob rau hauv lub guise ntawm tau txais ib daim duab los ntawm lub website wp-theme-connect.com, ncaj qha loaded lub backdoor code rau hauv cov ntaub ntawv wp-includes/vars.php.
Thawj qhov chaw uas suav nrog kev hloov pauv tsis zoo rau AccessPress add-ons tau txheeb xyuas thaum lub Cuaj Hlis 2021. Nws yog assumed tias nws yog ces hais tias lub backdoor tau muab tso rau hauv lub add-ons. Thawj qhov kev ceeb toom rau AccessPress txog qhov teeb meem uas tau txheeb xyuas tsis tau teb, thiab AccessPress tsuas yog tuaj yeem tau txais kev saib xyuas tom qab koom nrog pab pawg WordPress.org hauv kev tshawb xyuas. Thaum Lub Kaum Hli 15, 2021, cov ntaub ntawv cuam tshuam los ntawm lub qhov rooj rov qab raug tshem tawm ntawm AccessPress lub vev xaib, thiab cov ntawv tshiab ntawm cov add-ons tau tso tawm thaum Lub Ib Hlis 17, 2022.
Sucuri cais cov chaw soj ntsuam uas cuam tshuam cov versions ntawm AccessPress tau teeb tsa thiab txheeb xyuas qhov muaj cov qauv tsis zoo uas tau thauj khoom los ntawm lub qhov rooj rov qab uas xa spam thiab xa rov qab mus rau qhov chaw dag (cov modules hnub tim 2019 thiab 2020). Nws yog xav tias cov neeg sau ntawv ntawm lub backdoor tau muag kev nkag mus rau qhov chaw cuam tshuam.
Cov ntsiab lus uas muaj qhov hloov pauv hauv qab:
- accessbuddy 1.0.0
- accesspress-pab 3.2.1
- accesspress-lite 2.92
- accesspress-mag 2.6.5
- Accesspress-parallax 4.5
- Accesspress-Ray 1.19.5
- Accesspress-hauv paus 2.5
- Accesspress-staple 1.9.1
- accesspress-khw 2.4.9
- Agency-lite 1.1.6
- kev 1.0.6
- sib tw 1.0.4
- blogger 1.2.6
- kev tsim kho-lite 1.2.5
- ua 1.0.27
- enlighten 1.3.5
- khw khw 1.2.1
- yees duab 2.4.0
- gaga-corp hwm 1.0.8
- gaga-lite 1.4.2
- ib qho chaw 2.2.8
- parallax-blog 3.1.1574941215
- Parallaxsome 1.3.6
- lus 1.1.2
- rov 1.3.1
- rov 1.2.0
- scrollme 2.1.0
- Sportsmag 1.2.1
- Storevilla 1.4.1
- swing-lite 1.1.9
- tus-launcher 1.3.2
- hnub Monday 1.4.1
- uncode-lite 1.3.1
- unicon-lite 1.2.6
- vwm 1.2.7
- vmagazine-lite 1.3.5
- vmagazine-news 1.0.5
- zigcy-tus me nyuam 1.0.6
- zigcy-cov tshuaj pleev ib ce 1.0.5
- zigcy-lite 2.0.9
Plugins uas tau kuaj pom qhov hloov pauv hauv qab:
- accesspress-tsis qhia npe-post 2.8.0 2.8.1 1
- accesspress-custom-css 2.0.1 2.0.2
- accesspress-custom-post-type 1.0.8 1.0.9
- accesspress-facebook-auto-post 2.1.3 2.1.4
- accesspress-instagram-pub 4.0.3 4.0.4
- accesspress-pinterest 3.3.3 3.3.4
- accesspress-social-counter 1.9.1 1.9.2
- accesspress-social-icons 1.8.2 1.8.3
- accesspress-social-login-lite 3.4.7 3.4.8
- accesspress-social-share 4.5.5 4.5.6
- accesspress-twitter-auto-post 1.4.5 1.4.6
- accesspress-twitter-feed 1.6.7 1.6.8
- ak-menu-icons-lite 1.0.9
- ap-tus khub 1.0.7 2
- ap-contact-form 1.0.6 1.0.7
- ap-custom-testimonial 1.4.6 1.4.7
- ap-mega-menu 3.0.5 3.0.6
- ap-pricing-tables-lite 1.1.2 1.1.3
- apex-notification-bar-lite 2.0.4 2.0.5
- cf7-store-to-db-lite 1.0.9 1.1.0
- lus-disable-accesspress 1.0.7 1.0.8
- yooj yim-sab-tab-cta 1.0.7 1.0.8
- everest-admin-cov ntsiab lus-lite 1.0.7 1.0.8
- everest-coming-soon-lite 1.1.0 1.1.1
- everest-comment-rating-lite 2.0.4 2.0.5
- Everest-counter-lite 2.0.7 2.0.8
- everest-faq-manager-lite 1.0.8 1.0.9
- Everest-gallery-lite 1.0.8 1.0.9
- everest-google-places-reviews-lite 1.0.9 2.0.0
- Everest-review-lite 1.0.7
- everest-tab-lite 2.0.3 2.0.4
- everest-timeline-lite 1.1.1 1.1.2
- inline-hu-rau-action-builder-lite 1.1.0 1.1.1
- khoom-slider-rau-woocommerce-lite 1.1.5 1.1.6
- ntse-logo-showcase-lite 1.1.7 1.1.8
- ntse-scroll-posts 2.0.8 2.0.9
- ntse-scroll-rau-sab saum toj-lite 1.0.3 1.0.4
- tag nrho-gdpr-ua raws-lite 1.0.4
- tag nrho-team-lite 1.1.1 1.1.2
- Qhov kawg-author-box-lite 1.1.2 1.1.3
- Qhov kawg-form-builder-lite 1.5.0 1.5.1
- woo-badge-designer-lite 1.1.0 1.1.1
- txz --> wp-1-slider 1.2.9 1.3.0
- wp-blog-manager-lite 1.1.0 1.1.2
- wp-comment-designer-lite 2.0.3 2.0.4
- wp-cookie-user-info 1.0.7 1.0.8
- wp-facebook-review-showcase-lite 1.0.9
- wp-fb-messenger-khawm-lite 2.0.7
- wp-floating-menu 1.4.4 1.4.5
- wp-media-manager-lite 1.1.2 1.1.3
- wp-popup-banners 1.2.3 1.2.4
- wp-popup-lite 1.0.8
- wp-product-gallery-lite 1.1.1
Tau qhov twg los: opennet.ru