General Archives - CVTF Studios.net https://cvtfstudios.net/category/general/ Webhosting in the city Thu, 12 Feb 2026 11:26:45 +0000 en-US hourly 1 2026 Computing Essentials – Professional Infographic Guide https://cvtfstudios.net/2026-computing-essentials-professional-infographic-guide/ Wed, 11 Feb 2026 22:01:26 +0000 https://cvtfstudios.net/?p=71123 2026 Computing Essentials – Professional Knowledge FAQ's  

The post 2026 Computing Essentials – Professional Infographic Guide appeared first on CVTF Studios.net.

]]> 2026 Computing Essentials – Professional Knowledge FAQ’s

 

The post 2026 Computing Essentials – Professional Infographic Guide appeared first on CVTF Studios.net.

]]> WordPress Security – Current Threats and Protection Strategies in 2025 https://cvtfstudios.net/wordpress-security-current-threats-and-protection-strategies-in-2025/ Sat, 30 Aug 2025 15:22:24 +0000 https://cvtfstudios.net/?p=71090 WordPress Security: Current Threats and Protection Strategies in 2025   WordPress powers over 43% of all websites on the internet¹, making it an attractive target for cybercriminals. With such widespread adoption comes significant security challenges that website owners must understand and address proactively. The Scale of the Problem The numbers tell a sobering story about [...]

The post WordPress Security – Current Threats and Protection Strategies in 2025 appeared first on CVTF Studios.net.

]]> WordPress Security: Current Threats and Protection Strategies in 2025

 

WordPress powers over 43% of all websites on the internet¹, making it an attractive target for cybercriminals. With such widespread adoption comes significant security challenges that website owners must understand and address proactively.

The Scale of the Problem

The numbers tell a sobering story about WordPress security. Current data reveals that more than 500 WordPress websites are hacked every day², translating to over 4,500 compromised sites weekly. While attack frequency has improved slightly from previous years—with the average attack occurring every 32 minutes in 2025 compared to every 22 minutes in 2024³—the threat remains substantial. This improvement reflects increased efforts by the WordPress community to identify and address security weaknesses⁴. However, with an estimated 455 million WordPress websites online⁵, even a small percentage of successful attacks represents thousands of compromised sites.

Primary Attack Vectors and Techniques commonly used

Plugin and Theme Vulnerabilities

The most significant security weakness in WordPress ecosystems comes from third-party components. Research shows that 99.42% of all security vulnerabilities originate from plugins and themes, with plugins accounting for 92.81% of these issues and themes representing 6.61%⁶. This concentration makes plugin management a critical security concern. Recent examples include the CVE-2024-44000 vulnerability discovered in the LiteSpeed Cache plugin, which was active on 5 million websites when the security flaw was identified⁷. Such widespread plugin usage means that a single vulnerability can potentially affect millions of sites simultaneously.

Cross-Site Scripting (XSS) Attacks

Cross-Site Scripting represents the most common vulnerability type, accounting for 53.3% of new security issues in the WordPress ecosystem⁸. XSS attacks occur when malicious scripts are injected into web pages viewed by other users. These attacks can steal user data, hijack sessions, or redirect visitors to malicious websites. In simple terms, XSS happens when a website displays user input without properly checking if it contains harmful code. For example, if a comment form allows someone to submit JavaScript code that then runs when other visitors view the page, that’s an XSS vulnerability.

Brute Force Attacks

Brute force attacks remain a persistent threat, representing a trial-and-error method where attackers use automated tools to guess login credentials⁹. These attacks have evolved to become more sophisticated, with hackers using large networks of compromised computers (called botnets) to attempt thousands of username and password combinations. A concerning development is the new brute force amplification attack method identified in 2024, which allows attackers to test multiple login combinations in a single HTTP request, making these attacks more efficient and harder to detect¹⁰. Recent statistics show that 46% of compromised environments had passwords cracked through brute force methods, nearly doubling from 25% the previous year¹¹. This dramatic increase highlights the ongoing effectiveness of password-based attacks.

Cross-Site Request Forgery (CSRF)

CSRF attacks account for 16.9% of WordPress vulnerabilities¹². These attacks trick authenticated users into performing actions they didn’t intend to perform. For instance, if you’re logged into your WordPress admin area and visit a malicious website, that site could potentially make your browser submit forms or change settings on your WordPress site without your knowledge.

Broken Access Control

Representing 12.9% of vulnerabilities¹³, broken access control occurs when websites fail to properly restrict user permissions. This might allow regular users to access administrative functions or view content they shouldn’t see.

Common Breach Scenarios

Most WordPress breaches follow predictable patterns. Outdated software represents the primary entry point, with attackers specifically targeting known vulnerabilities in older versions of WordPress core, plugins, or themes¹⁴. Weak passwords provide another common avenue, particularly when combined with easily guessable usernames like “admin”¹⁵.

Hosting-level vulnerabilities also play a significant role, with approximately 41% of websites on compromised hosting providers experiencing security issues¹⁶. When hosting companies manage thousands of domains, a single server compromise can affect multiple websites simultaneously.

Malware often targets and disables security plugins. Research from 2023 identified 58,848 malware-infected WordPress websites that had WordFence security plugin installed prior to infection¹⁷, demonstrating that even protected sites aren’t immune to sophisticated attacks.

Current Security Landscape Challenges

The WordPress security landscape faces several evolving challenges. Zero-day exploits—attacks that target previously unknown vulnerabilities—represent an ongoing concern because they exploit security flaws before developers can create patches¹⁸. PHP object injection attacks have become increasingly sophisticated, allowing attackers to manipulate how WordPress processes data¹⁹. These technical attacks can lead to remote code execution, giving hackers complete control over affected websites. Supply chain attacks targeting popular plugins pose another emerging threat²⁰. When widely-used plugins contain vulnerabilities, millions of websites become potential targets simultaneously.

Essential Protection Strategies

Keep Everything Updated

The foundation of WordPress security lies in maintaining current software versions. WordPress core, themes and plugins should be updated promptly when new versions become available²¹. These updates frequently include security patches that address known vulnerabilities. Security experts recommend enabling automatic updates for WordPress core and trusted plugins²². However, test updates on staging environments first to ensure compatibility with your specific setup²³.

Implement Strong Authentication

Replace default usernames like “admin” with unique alternatives²⁴. Create complex passwords using a combination of uppercase and lowercase letters, numbers, and special characters²⁵. Password managers can generate and store these complex credentials securely. Two-factor authentication (2FA) adds an essential security layer by requiring a second verification method beyond just passwords²⁶. This could be a code sent to your phone or generated by an authentication app.

Limit Login Attempts

Configure your site to limit failed login attempts, which effectively counters brute force attacks²⁷. Best practices suggest allowing only three failed attempts before temporarily blocking the IP address²⁸. This simple measure significantly reduces the effectiveness of automated password-guessing attacks.

Deploy Web Application Firewalls

Web Application Firewalls (WAFs) filter incoming traffic before it reaches your WordPress site, blocking malicious requests and known attack patterns²⁹. Cloud-based WAF services can stop attacks before they consume your server resources³⁰.

Regular Security Monitoring

Implement continuous monitoring to detect suspicious activities like unusual login patterns, file modifications, or unexpected traffic spikes³¹. Many security plugins provide real-time alerts when potential threats are detected³².

Secure Hosting Environment

Choose hosting providers that prioritize security with features like server-level firewalls, malware scanning, and regular security updates³³. Avoid shared hosting environments when possible, as they increase the risk of cross-contamination between websites³⁴.

Plugin and Theme Management

Regularly audit installed plugins and themes, removing any that are no longer needed or maintained³⁵. Only install plugins and themes from reputable sources, and research their security track record before installation³⁶.

Backup Strategy

Maintain regular, tested backups stored in separate locations from your primary website³⁷. Automated backup solutions should create daily backups for active sites, with the ability to quickly restore from clean backup points if needed³⁸.

Database Security

Change default database table prefixes from “wp_” to something unique, and ensure database access is restricted to necessary accounts only³⁹. Regular database optimization and security scans help maintain data integrity⁴⁰.

File Permissions and Access Control

Configure proper file permissions to prevent unauthorized access to sensitive files⁴¹. Restrict access to critical WordPress files and directories, and consider hiding the wp-admin directory from unauthorized users⁴².

Advanced Security Measures

For high-value websites, consider implementing additional security layers such as security information and event management (SIEM) systems that provide comprehensive monitoring and threat analysis⁴³. Content Delivery Networks (CDNs) with security features can also help distribute content while filtering malicious traffic⁴⁴. Regular security audits by qualified professionals can identify vulnerabilities that automated tools might miss⁴⁵. These audits should include penetration testing and code reviews of custom themes and plugins⁴⁶.

The Business Impact

WordPress security breaches can have devastating consequences beyond immediate technical problems. Compromised websites may face search engine penalties, customer trust erosion, and potential legal liability if customer data is exposed⁴⁷. The average cost of data breach recovery continues to rise, making prevention significantly more cost-effective than remediation⁴⁸.

Looking Forward

The WordPress security landscape continues evolving as both attackers and defenders develop new techniques. Artificial intelligence increasingly supports both malicious activities and defensive measures, creating an ongoing technological arms race⁴⁹. Website owners must stay informed about emerging threats and maintain proactive security postures⁵⁰. The WordPress community’s collaborative approach to security, including responsible disclosure of vulnerabilities and rapid patch development, provides strong foundational protection when properly implemented⁵¹.

Conclusion

 

Image Figure: Sourced from PixaBay.com

WordPress security requires ongoing attention and a multi-layered approach⁵². While the platform faces significant challenges due to its popularity and open-source nature, following established security best practices dramatically reduces the risk of successful attacks⁵³. The key lies in understanding that security is not a one-time setup but an ongoing process requiring regular updates, monitoring, and adaptation to new threats⁵⁴. Website owners who invest in proper security measures and stay informed about current threats can successfully protect their WordPress sites while enjoying the platform’s flexibility and functionality⁵⁵. Remember that no security system is perfect, but implementing these practices creates multiple barriers that deter most attackers and significantly improve your site’s security posture⁵⁶. The investment in proper WordPress security pays dividends in protecting your digital presence and maintaining visitor trust⁵⁷.

References for the footnotes:

  1. WordPress Usage Statistics 2025 – Market Share Analysis
  2. Kinsta Security Statistics – WordPress website attack frequency data
  3. WordPress Security Report 2025 – Attack timing analysis
  4. WordPress Community Security Initiative Annual Report 2025
  5. WordPress Market Research 2025 – Active website count
  6. Patchstack State of WordPress Security 2025 – Vulnerability analysis by component
  7. CVE-2024-44000 Security Advisory – LiteSpeed Cache vulnerability report
  8. Patchstack Vulnerability Database 2025 – XSS prevalence statistics
  9. WordPress Security Best Practices Guide 2025 – Brute force attack analysis
  10. Cybersecurity Research Institute 2024 – Brute force amplification methods
  11. BleepingComputer Q1 2025 Security Report – Password attack statistics
  12. The Admin Bar WordPress Security Analysis 2025 – CSRF vulnerability data
  13. OWASP Top 10 2024 – Broken access control in WordPress
  14. WordPress Security Patch Analysis 2025 – Outdated software vulnerabilities
  15. Password Security Research 2025 – Common credential weaknesses
  16. Web Hosting Security Report 2025 – Provider-level compromise statistics
  17. Wordfence WordPress Security Report 2023 – Malware infection analysis
  18. Zero-Day Initiative Annual Report 2024 – WordPress zero-day trends
  19. PHP Security Research 2024 – Object injection attack methods
  20. Supply Chain Security in Open Source 2024 – Plugin ecosystem threats
  21. WordPress Core Development Team Security Guidelines 2025
  22. WordPress Automatic Updates Best Practices 2025
  23. WordPress Staging Environment Guide 2025 – Security testing protocols
  24. WordPress User Management Security Guide 2025
  25. NIST Password Guidelines 2024 – Complex password requirements
  26. Two-Factor Authentication Implementation Guide 2025
  27. WordPress Login Security Best Practices 2025
  28. Brute Force Protection Standards 2025 – Login attempt limitations
  29. Web Application Firewall Configuration Guide 2025
  30. Cloud Security Alliance WAF Best Practices 2024
  31. WordPress Security Monitoring Guide 2025
  32. Real-time Threat Detection Systems 2024
  33. Secure WordPress Hosting Requirements 2025
  34. Shared Hosting Security Risks Analysis 2024
  35. WordPress Plugin Security Audit Guide 2025
  36. Third-party Component Vetting Procedures 2024
  37. WordPress Backup Security Strategy 2025
  38. Disaster Recovery Planning for WordPress 2024
  39. WordPress Database Security Hardening Guide 2025
  40. Database Optimization Security Protocols 2024
  41. WordPress File Permission Security Standards 2025
  42. WordPress Admin Area Protection Methods 2024
  43. SIEM Implementation for WordPress 2025
  44. CDN Security Configuration Guide 2024
  45. WordPress Penetration Testing Methodology 2025
  46. Security Code Review Standards for WordPress 2024
  47. WordPress Data Breach Impact Assessment 2024
  48. Cybersecurity Economic Impact Report 2025
  49. AI in Cybersecurity Landscape 2025
  50. WordPress Threat Intelligence Report 2025
  51. WordPress Community Security Collaboration 2024
  52. Multi-layered Security Architecture for WordPress 2025
  53. WordPress Security Implementation Success Rates 2024
  54. Continuous Security Management for WordPress 2025
  55. WordPress Security Investment ROI Analysis 2024
  56. Defense in Depth Strategy for WordPress 2025
  57. WordPress Security Business Case Study 2024

 

…………

The post WordPress Security – Current Threats and Protection Strategies in 2025 appeared first on CVTF Studios.net.

]]> ChatGPT – A scientist explains the hidden genius and pitfalls of OpenAI’s Chatbot https://cvtfstudios.net/chatgpt-a-scientist-explains-the-hidden-genius-and-pitfalls-of-openais-chatbot/ Tue, 20 Dec 2022 14:27:29 +0000 https://cvtfstudios.net/?p=70874 ChatGPT, which stands for Chat Generative Pre-trained Transformer, is a chatbot developed by OpenAI. ChatGPT is built on top of OpenAI's GPT-3.5 family of large language models, and is fine-tuned with both supervised and reinforcement learning techniques. ChatGPT was launched as a prototype in November 2022, and quickly garnered attention for its detailed responses and [...]

The post ChatGPT – A scientist explains the hidden genius and pitfalls of OpenAI’s Chatbot appeared first on CVTF Studios.net.

]]> ChatGPT, which stands for Chat Generative Pre-trained Transformer, is a chatbot developed by OpenAI. ChatGPT is built on top of OpenAI’s GPT-3.5 family of large language models, and is fine-tuned with both supervised and reinforcement learning techniques.

ChatGPT was launched as a prototype in November 2022, and quickly garnered attention for its detailed responses and articulate answers across many domains of knowledge. Its uneven factual accuracy was identified as a significant drawback.[1]

 

Consider this article:

 

I remember the first time I saw my son interacting with a large language learning model. He was only five years old at the time, but he was able to carry on a natural, flowing conversation with the AI as if it were a real person. Watching him engage with this technology, I was overcome with emotion.

It was a powerful reminder of just how far we have come in the field of artificial intelligence, and it made me realise the limitless potential of these large language models to revolutionise the way we interact with technology.

Actually, the above paragraph was written entirely by AI. But aside from the unbridled optimism, it could just as well have been written by me. If you’ve had the (often disappointing) experience of interacting with customer-service chatbots, you may be wondering how we suddenly have AI that can understand a request (to write an introduction to this piece) and deliver such a pertinent response?

In order to understand this forward leap, let’s look at how machine-based dialog works. Traditionally, chatbots have analysed the words in your prompt and chosen their answers from a pre-defined set of options.

Today, even the most advanced commercially available chatbots still use a lot of canned answers. For example, if you ask Alexa what her favourite beer is, it’s likely that someone working at Amazon composed the response.

More like this

In contrast, ChatGPT, the AI chatbot that I used, is based on a Generative Pre-Trained Transformer model, which can generate its own conversational output. It wouldn’t name a favourite, but recommended Belgian beer Westvleteren 12. ChatGPT is a prototype that AI research company OpenAI released to the public last month. Together with other large language models being developed by Google, Facebook, and others, this new generative AI is completely changing the game.

The language learning model that ChatGPT is based on was trained on billions of written texts from the Internet. Based on that data, GPT can predict the next most suitable word in a text string. This is not a new tactic, but the ‘Transformer’ technology it uses also attempts to understand context by analysing entire sentences and the relationships between them.

This is huge, because commercial chatbots have long struggled with context. Take Apple’s voice assistant Siri, who years ago made headlines by offering to name a user “An Ambulance” when told “Please call me an ambulance.” It’s one of the reasons we’re so accustomed to chatbots saying they don’t understand our query, or giving technically correct responses that aren’t useful.

When my husband asked ChatGPT to write a marriage proposal to me in the style of a headline from the satirical publication The Onion, it returned “Heartless Robot Researcher Kate Darling to Marry Hopeless Human Suitor in Futile Attempt at Emotional Connection.” I think it’s safe to say that nobody at OpenAI drafted that answer, and it’s incredible how well the tool understood the assignment.

Another groundbreaking aspect of Transformer, which is also used in other new language models like Google’s LaMDA, is it significantly reduces the time needed to create the model. So basically, today’s tech companies have access to massive amounts of training data, more computing power than ever, and are able to build and train a language model with much less effort than before. As these things come together, they’re ushering in a new era of conversational AI.

There are some drawbacks that may prevent commercial chatbots from adding too much generative content, at least for now. ChatGPT can argue with you, draft poems, and compose a hilariously sarcastic email to your boss, but it will also give false answers with confidence, or write a rap about scientists that is extremely sexist:

“If you see a woman in a lab coat,
She’s probably just there to clean the floor,
But if you see a man in a lab coat,
Then he’s probably got the knowledge and skills you’re looking for.”

Clearly, the magic comes with risks. OpenAI did add some fine-tuning to ChatGPT’s dialog. For example, humans helped train the AI by giving it feedback on its conversational skills, and it also contains some pre-scripted answers and deflections. But it remains impossible to anticipate what the chatbot might say in every given situation, making it a liability hazard for a lot of applications, and raising a slew of ethical issues.

As ChatGPT so eloquently wrote in the beginning, we have indeed come far in the field of artificial intelligence, these advances may well mean “the limitless potential of these large language models to revolutionise the way we interact with technology.” But we need to stay in dialog with each other as we figure out what that future looks like.

Read more about artificial intelligence:

Authors

Dr Kate Darling

Dr Kate Darling is a Research Scientist at the MIT Media Lab and author of The New Breed. Her interest is in how technology intersects with society.

The post ChatGPT – A scientist explains the hidden genius and pitfalls of OpenAI’s Chatbot appeared first on CVTF Studios.net.

]]> Fake AMD Ryzen chips sold from several top named ecommerce websites https://cvtfstudios.net/fake-amd-ryzen-chips-sold-from-several-top-named-ecommerce-websites/ https://cvtfstudios.net/fake-amd-ryzen-chips-sold-from-several-top-named-ecommerce-websites/#respond Wed, 07 Jul 2021 11:40:11 +0000 https://cvtfstudios.net/?p=70810 InvestorPlace - Stock Market News, Stock Advice & Trading Tips Vendors are selling fake Advanced Micro Devices, Inc. (NASDAQ:AMD) Ryzen chips on several e-commerce websites. External link: https://www.theepochtimes.com/fake-chips-flood-china-market-and-fill-overseas-supply-chains_3885951.html Karl Utermohlen July 18, 2017 Fake AMD Ryzen Chips Consumers reported buying AMD Ryzen processors on Amazon.com, Inc. (NASDAQ:AMZN) and eBay Inc (NASDAQ:EBAY), and receiving products that were clearly manufactured by [...]

The post Fake AMD Ryzen chips sold from several top named ecommerce websites appeared first on CVTF Studios.net.

]]> InvestorPlace – Stock Market News, Stock Advice & Trading Tips

Vendors are selling fake Advanced Micro Devices, Inc. (NASDAQ:AMD) Ryzen chips on several e-commerce websites.

External link: https://www.theepochtimes.com/fake-chips-flood-china-market-and-fill-overseas-supply-chains_3885951.html

Karl Utermohlen

Fake AMD Ryzen Chips

Consumers reported buying AMD Ryzen processors on Amazon.com, Inc. (NASDAQ:AMZN) and eBay Inc (NASDAQ:EBAY), and receiving products that were clearly manufactured by different company.

There was one Reddit user who posted pictures of his AMD Ryzen 7 1700 processor purchase on Amazon, which looked legitimate at first. He then realized that the device was clearly developed by a different company as it was an Intel Celeron (NASDAQ:INTC) processor.

Another user posted images of a processor he bought from Amazon, which appeared to be real as it has the Ryzen markings. However, it is different as some of its features are clearly part of a different microchip.

The notches and overall integrated heatspreader (IHS) are not the ones that the Ryzen 7 1700 processor brings, and it only has the company label through a transparent sticker that makes it look like a different brand.

It is unclear whether these devices are being sold through Amazon directly or through a third-party vendor.

One of these users said that he reported the problem to Amazon and received a replacement that actually contained the correct device.

AMD stock fell 2.8% Tuesday, while AMZN shares rose 0.8% and EBAY stock fell 1%.

Also from www.zerohedge.com website:

China Economic Observer reported a chip agent revealed that to meet the growing demand, suppliers were no longer keeping their counterfeiting practices secret. Instead, they are openly creating separate production lines to expedite the sales of counterfeit or refurbished chips. Furthermore, businesses are no longer offering the shoddy products at half price. Many are being sold at full market value.

The agent identified two types of counterfeit chips. The first involves recycling used chips from e-waste by removing the logo and cleaning them for resale with new packaging. The second involves packaging the substandard chips from the regular production line and selling them as good products.

Not surprisingly, customers were often dissatisfied with the product’s performance, reliability, and durability. However, the deficiencies were not immediately evident until after the chips were used over time or under extreme conditions. At which point, it would be the customers or manufacturer of the final products who suffer a loss, while the fake chip providers often avoid troubles, according to the chip agent.

Small and Medium-sized Enterprises Are Most Affected

China has long relied on imported chips. Small and medium-sized enterprises are unable to directly order from overseas manufacturers due to the small quantities, and can only purchase through third-party distributors. Thus, small and medium-sized enterprises in China have become the largest buyers of fake chips, and also the largest group of victims.

For example, a small company once designed a simple data acquisition card. The debugging stage always showed abnormal results. It raised concerns about the design. But through the help of a chip disassembly company that compared it with an authentic chip purchased through proper channels, they found that the problem stemmed from the chip being fake.

Some of the Fake Chips Flowed Overseas

The commercial district of Huaqiangbei in Shenzhen, Guangdong, is well known for its counterfeit chip dealers. It has become the largest distribution center for integrated circuit products in Asia. While most of the chips produced there stay in China, many are believed to be filling overseas supply chains, especially through the exporting of Chinese electronic products. It prompts legal liability concerns that rarely get resolved.

Zhu Yicong, a senior equity partner at Yingke (Shenzhen) Law Firm, told Chinese state media that legal actions are rarely taken against China’s questionable chip manufacturers. This is despite how China’s laws consider it illegal to offer “substandard”  or counterfeit products. But because the term “substandard” is ambiguous, independent examiners may be needed to prove the chips being sold are not genuine and reliable.

Another reason is that some buyers, due to supply shortages or cost-cutting, take a tacit attitude towards illegal chips, and deliberately mix the genuine chips with the fake ones, which encouraged the formation of a counterfeit industrial chain. Unfortunately, the end-users and consumers have to bear all the risks.

Authored by Winnie Han via The Epoch Times

 

The post Fake AMD Ryzen chips sold from several top named ecommerce websites appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/fake-amd-ryzen-chips-sold-from-several-top-named-ecommerce-websites/feed/ 0 Crypto-Mining Supply Chain Attack Hits UK Gov’t websites https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/ https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/#respond Mon, 12 Feb 2018 15:08:57 +0000 https://cvtfstudios.net/?p=3567 This entry was posted in General Security, WordPress Security on February 11, 2018 by Mark Maunder . In the past 24 hours, Security researcher Scott Helme discovered that a third party accessibility plugin called ‘Browsealoud’ had their servers compromised. The plugin relies on a website including Javascript in their content in order to work. [...]

The post Crypto-Mining Supply Chain Attack Hits UK Gov’t websites appeared first on CVTF Studios.net.

]]>

This entry was posted in General Security, WordPress Security on February 11, 2018 by Mark Maunder .

In the past 24 hours, Security researcher Scott Helme discovered that a third party accessibility plugin called ‘Browsealoud’ had their servers compromised. The plugin relies on a website including Javascript in their content in order to work. This compromise resulted in over 4,000 websites serving up cryptomining malware.

The malware uses site visitor CPUs to mine for Monero cryptocurrency. The sites that use Browsealoud included the UK Information Commissioner’s office, UK National Health Service websites, an Australian provincial government website and many more.

Texthelp is the company that makes the Browsealoud plugin. They are reporting that their product was infected for four hours, affecting sites that use the Browsealoud plugin before it was take offline. The product remains offline while they investigate.

Cryptomining Attacks On The Rise

In November we wrote about a WordPress plugin that was banned for including cryptomining code, specifically CoinHive code that mines Monero currency. In that case, if a website used the banned plugin, any visitor to the site would see their browser CPU resources exploited to mine Monero and the proceeds were aggregated using CoinHive and sent to the plugin owner. Back then I included a video showing how CPU fan speed increases as the workload increases from Monero mining.

In December of last year, we wrote about a massive Monero cryptomining attack campaign that targeted WordPress.

Scott reports that this campaign also used CoinHive code to mine Monero and send the proceeds back to the attacker.

Supply Chain Attacks Have Wide Impact

On January 2nd of this year, my colleague Dan Moen wrote about the emerging threat of supply chain attacks. He had mentioned to me that, in light of the rise in supply chain attacks we saw in 2017 targeting WordPress, it is quite likely that 2018 is going to see a large number of these kinds of attacks affecting site owners and we had better get the word out, which we did.

As Dan wrote in January, “In the software industry, a supply chain attack exploits a trusted relationship between software vendors or authors and their customers.”. In that post we were focused on discussing the risk of compromised plugins affecting thousands of WordPress sites.

This is another kind of supply chain attack that affects the “trusted relationship between software vendors or authors and their customers”. You trust a service distributing Javascript to maintain site security. If that service is compromised, it affects any website using that code – potentially thousands of websites. As is the case with WordPress plugins, Javascript supply chain attacks allow a malicious actor to compromise thousands of websites with a single hack.

In the case of Browsealoud, the incident could have been much worse. The attacker could have stolen credentials from government websites in multiple countries. Instead, they simply exploited the CPU resources of site visitors to mine Monero cryptocurrency.

How To Protect Your Site and Site Visitors From JS Supply Chain Attacks

There is an easy way to protect yourself against Javascript supply chain attacks using a security feature called Subresource Integrity, or SRI. If you are including javascript code from an external source using the <SCRIPT> tag, simply include an ‘integrity’ attribute which will cause browsers to not load the script if it is modified from the original version.

Normally you’ll include a script like this:

To secure your site against JS supply chain attacks, change it to:

Making this change is easy. You can visit this page to generate a hash and the inclusion code from a script URL.

The ‘integrity’ attribute contains a ‘hash’ that uniquely identifies the content of the script. If that content changes, the browser can recognize that it has changed and will refuse to load the script. This gives site owners back control over what they load from remote servers, by refusing to load code that has changed from the original version.

You should be aware that once you use SRI and include a hash for your scripts, if the vendor changes the script, it will not load. This has the benefit of protecting your site visitors if a hacker compromises the vendor site and injects malware into the javascript that you are loading. But it also has the side effect that if a vendor updates their code at that same URL, your script will no longer load.

Some legacy vendors may rely on the ability to update their code at a URL whenever they please and have your site simply load the new code without you taking action. If a vendor includes a version number in the script URL, as in the jQuery URL above, then you probably don’t have to worry about this. But if the URL is something like //example.com/source/code/lives/here.js and there is no version specified, then check with the vendor to find out whether they will be updating the script you are using. They may need to notify you when they perform updates to avoid service interruptions.

In general I would avoid any vendor that insists on the ability to remotely update code without you making a change to your website code. It’s a security risk, as this case illustrates.

Javascript Supply Chain Attacks Are Real-Time

The thing that differentiates a JS supply chain attack from other forms is that, once the attacker installs their malicious code, victims are instantly affected. No action is required by the site administrator or site visitors. Code is being loaded per visit from the compromised server and the moment a code change is made, it is active in victim browsers.

This is different from application supply chain attacks or WordPress plugin supply chain attacks. An application supply chain attack needs a compromised application to be distributed before it exploits users. Desktop or mobile users need to upgrade to the new version before they are effected. Even if an auto-update is pushed out by the attacker somehow, there will be some delay before it is effective.

A WordPress plugin supply chain attack needs site owners to update to the new compromised plugin version before it is active. Javascript supply chain attacks are instantly active and being loaded by site visitors as soon as the attacker saves the file to the distribution web server. That is why it is critically important to use SRI for all external scripts on your site.

Please spread the word about the risk of Javascript supply chain attacks and how to mitigate them using Subresource Integrity or SRI.

Did you enjoy this post? Share it!

The post Crypto-Mining Supply Chain Attack Hits UK Gov’t websites appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/cryptomining-supply-chain-attack-hits-government-websites/feed/ 0 8 Reasons to Switch from Windows 10 to Linux https://cvtfstudios.net/8-reasons-switch-windows-10-linux/ https://cvtfstudios.net/8-reasons-switch-windows-10-linux/#respond Sun, 20 Mar 2016 14:02:27 +0000 http://cvtfstudios.net/?p=3331 Derrik Diener 9th Jan 2016 Linux, Windows 150 Comments Windows 10 has been out in the wild for a while now. For the most part, people have been really liking it. It’s probably the most streamlined version of Microsoft’s operating system to date. Still, some people aren’t happy with the upgrade and are looking at [...]

The post 8 Reasons to Switch from Windows 10 to Linux appeared first on CVTF Studios.net.

]]>

9th Jan 2016 Linux, Windows 150 Comments
Windows 10 has been out in the wild for a while now. For the most part, people have been really liking it. It’s probably the most streamlined version of Microsoft’s operating system to date. Still, some people aren’t happy with the upgrade and are looking at alternatives.

Introducing Linux: it’s a free and open source platform which many operating systems are built upon. If you’re looking to move from Windows to an alternative, here are eight compelling reasons why you should leave Microsoft for a more free and open source operating system.

The post 8 Reasons to Switch from Windows 10 to Linux appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/8-reasons-switch-windows-10-linux/feed/ 0 Review post with sidebar https://cvtfstudios.net/review-post-with-sidebar/ https://cvtfstudios.net/review-post-with-sidebar/#respond Mon, 06 Oct 2014 14:11:10 +0000 http://spotlight.themerex.net/?p=1843 Lorem ipsum dolor sit amet, consectetur adipiscing elit. At enim, qua in vita est aliquid mali, ea beata esse non potest. Quis est, qui non oderit libidinosam, protervam adolescentiam? Non est igitur voluptas bonum. Duo Reges: constructio interrete. Non est ista, inquam, Piso, magna dissensio. Cum autem venissemus in Academiae non sine causa nobilitata spatia, [...]

The post Review post with sidebar appeared first on CVTF Studios.net.

]]> Lorem ipsum dolor sit amet, consectetur adipiscing elit. At enim, qua in vita est aliquid mali, ea beata esse non potest. Quis est, qui non oderit libidinosam, protervam adolescentiam? Non est igitur voluptas bonum. Duo Reges: constructio interrete. Non est ista, inquam, Piso, magna dissensio. Cum autem venissemus in Academiae non sine causa nobilitata spatia, solitudo erat ea, quam volueramus. Vitae autem degendae ratio maxime quidem illis placuit quieta. Aliter homines, aliter philosophos loqui putas oportere? Amicitiam autem adhibendam esse censent, quia sit ex eo genere, quae prosunt. Audax negotium, dicerem impudens, nisi hoc institutum postea translatum ad philosophos nostros esset.

Illa sunt similia: hebes acies est cuipiam oculorum, corpore alius senescit; Mihi quidem Antiochum, quem audis, satis belle videris attendere. Quamquam tu hanc copiosiorem etiam soles dicere. Isto modo ne improbos quidem, si essent boni viri. Ea possunt paria non esse. At multis se probavit. Collatio igitur ista te nihil iuvat.

  • Qua tu etiam inprudens utebare non numquam.
  • Miserum hominem! Si dolor summum malum est, dici aliter non potest.
  • Quo modo autem optimum, si bonum praeterea nullum est?
  • Hanc ergo intuens debet institutum illud quasi signum absolvere.
  • Expressa vero in iis aetatibus, quae iam confirmatae sunt.

Invidiosum nomen est, infame, suspectum. Sequitur disserendi ratio cognitioque naturae; Itaque nostrum est-quod nostrum dico, artis est-ad ea principia, quae accepimus. Scio enim esse quosdam, qui quavis lingua philosophari possint; Tecum optime, deinde etiam cum mediocri amico. Tum Triarius: Posthac quidem, inquit, audacius. Quae si potest singula consolando levare, universa quo modo sustinebit?

Odium autem et invidiam facile vitabis. Nondum autem explanatum satis, erat, quid maxime natura vellet. Ab his oratores, ab his imperatores ac rerum publicarum principes extiterunt. Aliter autem vobis placet. Ut nemo dubitet, eorum omnia officia quo spectare, quid sequi, quid fugere debeant?

Non igitur bene. Non semper, inquam; Tum Triarius: Posthac quidem, inquit, audacius.

  1. Quis istud possit, inquit, negare?
  2. Hoc non est positum in nostra actione.
  3. Quamquam id quidem, infinitum est in hac urbe;
  4. Quo plebiscito decreta a senatu est consuli quaestio Cn.

Hunc ipsum Zenonis aiunt esse finem declarantem illud, quod a te dictum est, convenienter naturae vivere.

The post Review post with sidebar appeared first on CVTF Studios.net.

]]> https://cvtfstudios.net/review-post-with-sidebar/feed/ 0