Cryptolocking WordPress Plugin Locks Up Blog Posts

guest · Aug 6, 2019

Cryptolocking WordPress Plugin Locks Up Blog Posts
A new type of malicious plugin has been spotted in the wild with the capability of targeting individual blog posts
August 6, 2019
https://threatpost.com/cryptolocking-wordpress-plugin/147016/

A malicious WordPress plugin ironically called WP Security has been spotted in the wild encrypting blog posts and rendering the content unreadable. It’s capable of targeting individual posts — an unusual behavior, according to researchers.

According to analysis from Sucuri, the plugin obtains a list of all of the posts within the system and encrypts them with keys, using the AES-256-CBC encryption standard and the openssl_encrypt function.

“This is the first time we’ve seen a plugin target specific blog posts on a website, but it’s possible that we’ll see this more often in the coming months,” Sucuri researcher Kasimir Konov said in a blog posting on Monday.
As far as decryption, some of the keys are hard coded into the script, but the main key needed to decrypt the content is not available. Instead, a feature called WpEncryption obtains an encryption key from a remote website.
As with any cryptolocking activity, WordPress sites affected by the plugin would be able to recover the posts from a database backup.
Click to expand...

Log in or Sign up

Cryptolocking WordPress Plugin Locks Up Blog Posts

guest Guest

Log in or Sign up

Cryptolocking WordPress Plugin Locks Up Blog Posts

guest Guest

Useful Searches