Category: TimThumb

  • Has your WordPress Blog been Hacked? Email me now!

    Big News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    If your WordPress blog has been hacked, please email me. I’m collecting data on intrusion methods and backdoors. If you’ve been hacked, I’ll examine your server free of charge, share what I find with you and will make recommendations on how to repair your site, all at no cost. Please note that I will need “Shell” access to your machine. In other words I’ll need a username and password and will log in via SSH to examine the server that hosts your WordPress blog.

    If you’re in dev or ops and have an attack vector you’d like to share, please zip it up and email it to me with as much technical detail as you can.

    Email me at mmaunder at gmail.

    Thanks!!

  • WordPress Security: Please delete old themes and plugins

    News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    I was contacted by another site owner who was hacked via vulnerable WordPress themes today. He had updated to the latest non-vulnerable version of his theme, but the WordPress theme installation or update process doesn’t remove, or remind you to remove, old themes that may be vulnerable. So while they encourage you to update everything, old versions are still lurking on your site waiting for an attacker to take advantage of them.

    Remember: Delete all old unused themes and plugins.

    In this case an attacker once again used an old version of timthumb to install an attack shell called Sniper_SA. The attack shell was Arabic so I’m assuming the attack came from an Arabic country. [The last 3 I’ve seen were english]. This one was base64 encoded inside a PHP eval.

    The web host is one of the top 3 WordPress.org hosts on the web. Their default installation is to have your entire WordPress installation writeable by the web server and the server can even write to your home directory under the web root. This opens up all sorts of possibilities for a hacker to gain a remote shell. WordPress hosts, please secure your default WordPress installations so that only directories under wp-content/ are writeable. Also make sure the user’s home directory is not writeable by the web server by default.

     

  • Further update on TimThumb from Matt

    I just noticed Matt put a post up this morning giving a further update re TimThumb. You can read it here.

  • TimThumb users and WordPress Theme users using TimThumb, please upgrade

    News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    I’ve done a ton of work on TimThumb this weekend and there are a few great enhancements. E.g. if you have pngcrush or optipng installed, it will now use 66% less disk space and give you comparable quality images.

    Please grab the latest version of TimThumb on this page. Then let me know if you have any feature requests or find any bugs by reporting them here.

    Here’s the TimThumb changelog since I released 2.0 about 48 hours ago.

  • Timthumb improvements

    I did a ton of work on timthumb today. Download the latest version to get a whole lot of security and performance improvements and bugfixes. It’s available now.

  • WordThumb is now TimThumb 2.0

    News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Click here to learn more.

    On the suggestion of Matt Mullenweg (wordpress founder) Ben Gillbanks (timthumb author) and I have been working for the last day to merge my work on WordThumb into TimThumb 2.0.

    That work is now complete and TimThumb 2.0 is now available for download from the TimThumb site.

    I’m going to be working with Ben going forward to continue to have TimThumb be the easiest to use, fastest, most popular and most secure thumbnail script on the Web.

    Here are a few enhancements in TimThumb 2.0:

    • Includes the ability to take website screenshots if you have Xvfb and CutyCapt installed. (Instructions included how to do this)
    • All filters and resizing can be applied to website screenshots.
    • The cache directory is now secure and is still public for flexibility across platforms.
    • TimThumb creates index files in your cache to prevent directory listings.
    • Filenames are more randomized using data that a hacker doesn’t have access to, making it very hard to guess filenames in cache and access them.
    • Cache files have a .txt extension which means the web server won’t execute them.
    • All cached files have a fixed length record at the beginning which, if a web server tries to execute them, will be interpreted as PHP code and will cause an immediate exit.
    • It includes file locking when files are created in cache to avoid conflicts.
    • The entire code base has been rewritten and refactored for better code scaleability.
    • Lots of other improvements.
    So give it a whirl and if you have any suggestions or find any bugs, please file them on the TimThumb issues page. Thanks.

  • WordThumb now uses a secure public cache for compatibility

    UPDATE: WordThumb has now been merged into TimThumb and has become TimThumb 2.0. Please head over to the TimThumb site now for updates and to get the code.

    The latest version of wordthumb (just uploaded) uses a public cache again (same place timthumb does) because many system temporary folders are not writeable.

    This public cache is part of what caused the timthumb vulnerability, so I’ve made it more secure as follows:

    • Using a .txt extension for all files so servers won’t execute the files when accessed.
    • Using an md5 salt to prevent hackers knowing what filenames are to make things a little harder. On a badly configured server they could still get a directory index and access files that way.
    • Added a <?php die(); ?> to the start of ever file cached. That way if a hacker manages to guess a filename and for some reason the server decides to execute a .txt file, as a last resort it will simply die.

     

  • WordThumb can now take screenshots of websites for you

    UPDATE: WordThumb has now been merged into TimThumb and has become TimThumb 2.0. Please head over to the TimThumb site now for updates and to get the code.

    Just for fun I added the ability to take screenshots of any website to WordThumb. You can even apply all the image manipulation and filters that it supports for regular images to a website screenshot.

    The latest update also lets you block “hotlinking” where other websites display an image loaded from your server. That is mainly to prevent other sites using your WordThumb to generate thumbnails of websites.

    Be warned, to use this you’re going to need root access to your own server. You’re also going to have to install a few basic tools, but I’ve included detailed installation instructions in the source where the configuration options are. I’ve also only tested this on Ubuntu Linux.

    If you don’t have root on your machine or don’t want the feature, WordThumb is still fully backwards compatible with timthumb.php and the webshots feature is off by default. But if you like to experiment give it a whirl and let me know what you think.

    The first screenshot takes a few seconds to load and then it’s cached for 24 hours (the default cache setting).

    I have it running on this server, so here are a few screenshots of my favorite sites created and updated using WordThumb. You can click on one of these images and play with the URL and image width/height in the location bar to load different sites. My server is at about 80% load right now, so it will probably run faster on a less busy machine.

  • A secure rewrite of timthumb.php as WordThumb

    Big News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Read this now.

    Update 3 (Final): WordThumb has now been merged into TimThumb and has become TimThumb 2.0. Please head over to the TimThumb site now for updates and to get the code.

    Update 2: WordThumb can now take screenshots of websites for you and turn them into thumbnails.

    Update 1: Two minor bugs fixed and new minor version released. Thanks guys! You can post bugs directly on this page if you find any more.

    I’ve done a full top to bottom rewrite of timthumb and forked the project as WordThumb. You can find it on Google Code with basic instructions on how to use it. Please report any bugs to me at mmaunder at gmail as soon as you can. The code is tested on Ubuntu Linux under Apache and works great.

    The only code that is still original timthumb code is the image processing routines. Everything else has been rewritten from scratch. Here are the changes:

    • Code is now object oriented PHP and is much more manageable and readable. It will still run just about anywhere.
    • Fully backwards compatible with all timthumb’s options.
    • Uses a non-web accessible directory as cache for security. By default it uses the system temporary directory. There is a config option to override this.
    • All cached files have a .txt extension as an extra precaution.
    • Cache cleaning has been rewritten to be faster and only run once a day (user configurable) with no contention between processes.
    • ALLOW_EXTERNAL now works as expected. If disabled, you can’t load external files.
    • mime type checking is improved. Previously files would be written to a web accessible cache before the mime check step. Now the furthest a non-image will get is a temporary file which fails a mime check and is deleted.
    • Previously, the check_cache function created a directory with 777 permissions. That’s removed and we simply use the system temporary directory for everything cache related now.
    • Writing images uses file locking now to avoid two processes writing to the same image file and corrupting it.
    • We now use temporary files when fetching remote images rather than using the same filename we’re turning into a thumbnail. This avoids another process on a busy server thinking a file is a cached thumbnail and serving an unprocessed image accidentally.
    • Fixed browser headers like accept-ranges.
    • Improved error reporting.
    • Added debug mode with tons of debug messages.
    • Debug messages include benchmarking to see where slowdowns occur if any. (It’s very fast!)
    • Cleaned up conflicting curl options like CURLOPT_FILE
    • Added ability to disable browser caching for debugging
    • Added clarity on curl timeout (many sites use php’s default fetching which doesn’t have a timeout)

  • Technical details and scripts of the WordPress Timthumb.php hack

    Big News [April 24th, 2012]: I’ve launched Wordfence to permanently fix your WordPress site’s security issues. Read this now.

    UPDATE: WordThumb has now been merged into TimThumb and has become TimThumb 2.0. Please head over to the TimThumb site now for updates and to get the code.

    As I mentioned yesterday my WordPress blog was hacked. The security hole has been picked up by hacker news and from there, The Register, ZDNet, PCWorld, and Geek.com among others. The publicity will hopefully get Theme developers to update timthumb.php or switch to a different thumbnail generator.

    I’ve been contacted with requests for detailed info, so I’m going to post the technical details of how my site was hacked along with the scripts that the hacker used to get in. This is targeted at a technical audience.

    The server that served you this web page is the one that was hacked. It runs Ubuntu 10.10 with all security updates installed. It is a virtual server hosted by Linode.

    I also run the latest version of WordPress.org.

    My WordPress root directory was writable, but making it read only would not have prevented the hack.

    Timthumb.php in it’s default configuration allows site visitors to load images from a predefined set of remote websites for resizing and serving. Timthumb offers a caching mechanism so that it doesn’t have to continually re-process images. The cache directory lives under the wordpress root and is accessible by visitors to the website.

    The ability for a site visitor to load content from a remote website and to make the web server write that remote content to a web accessible directory is the cause of the vulnerability in timthumb.php.

    To be clear, timthumb.php does not actually execute any remote malicious code that causes this vulnerability. This was a point of confusion among some commenters in my blog post yesterday. It simply gets a remote file and places it in a web accessible directory.

    Timthumb only allows remote content from a small range of websites to be loaded remotely. In it’s default configuration these included Blogger, WordPress.com and other sites that are writeable by the general public.

    Timthumb’s verification that remote content was only being loaded by these domains was also broken. You could for example load content from hackersiteblogspot.com or from blogspot.com.hackersite.com.

    I’ve submitted a patch that fixes the pattern matching and removed all default public hosting sites from the allowed sites list. The developer has opted to keep a small list in which I’m not in favor of.

    In my case the hacker uploaded a script to my cache directory which timthumb.php stores as “external_<md5 hash>.php”. He/she then accessed this script directly in my timthumb cache directory as something like https://markmaunder.com/wp-content/themes/Memoir/scripts/cache/external_md5hash.php

    The script uploaded was Alucar shell which is base64 encoded and decodes when it executes. That makes it a little harder to find it using grep or similar tool. You can see the encoded version of Alucar here and the decoded version of Alucar here (without the username and password preamble at the top).

    Here’s a screenshot of the UI:

    Alucar UI

    This script which gives a web based shell access was then used to inject base64 code to one of my core wordpress files wp-blog-header.php which lives in the wordpress root directory. The file with injected code looked like this.

    The decoded version of this base64 code is this. The code executes whenever a blog page is visited. It fetches a file from a URL and writes it to /tmp. Then it executes the php code that is contained in this file. In my case it simply echo’d some javascript code that would show ads. Here is the code contained in the file in /tmp.

    Again, this file is periodically updated with new PHP code, so the attacker could have his way with my server until I found out about it. The code could be altered to instead become a spam system and work it’s way through a long list of spam emails.

    The way I tracked this to conclusion was:

    • Heard audio on my blog telling me I’d won something.
    • Checked Chrome network tools and saw ad content loading and I don’t serve ads.
    • Grepped wordpress source and themes for hostname I saw in ad. Nothing.
    • Dumped mysql databases on server (all of them) and grepped for hostname. Nothing.
    • Confusion reigns.
    • Started working my way through nginx (which is my front end proxy to apache) and apache access and error logs.
    • Spotted lines in apache error log like this: “[Mon Aug 01 11:09:12 2011] [error] [client 127.0.0.1] PHP Warning: file_get_contents(http://blogger.com.zoha.vn/db/load.php): failed to open stream: HTTP request failed! in /usr/local/markmaunder/wp-content/themes/Memoir/timthumb.php on line 675”
    • Checked timthumb’s cache directory and found Alucar.
    • Realized base64 encoding is why I didn’t find anything with grep.
    • Regrepped wordpress source and database and found injection in wp-blog-header.php
    • Decoded base64 stuff and played with Alucar
    • Found tmp file in /tmp
    • Cleaned everything and fixed permissions. Ran chkrootkit and other utils on machine to see if anything else was compromised. Changed passwords, etc.