Category: Outdated Web Software

In the recent past we have mentioned that the websites of the White House, Department of Homeland Security, and FEMA are failing to take the basic security step of keeping the software powering their websites up to date. It then should not come as too much surprise to see this:

CIO.gov is the website of the U.S. Chief Information Officer and the Federal CIO Council and on the website it is described as “serving as a central resource for information on Federal IT”and “identifying best practices”.

Since the website is running WordPress 3.4.2 they failed to update WordPress for seven months and more importantly they failed to update when a security release was put out back in January.

With the US government’s and CIO Council’s claimed focus on cybersecurity it is troubling that they are failing to do something so basic. It also begs the questions about one of the CIO Council’s areas of cybersecurity focus, “Continuous Monitoring“:

Continuous monitoring is a risk management approach to cybersecurity that maintains an accurate picture of an agency’s security risk posture, provides visibility into assets, and leverages use of automated data feeds to quantify risk, ensure effectiveness of security controls, and implement prioritized remedies. A well-designed and well-managed continuous monitoring program can effectively transform an otherwise static security control assessment and risk determination process into a dynamic process that provides essential, near real-time security status.

In today’s environment of widespread cyber-intrusions, advanced persistent threats, and insider threats, it is essential for agencies to have real-time accurate knowledge of their enterprise IT overall security posture. Agencies need to constantly know and remain aware of their enterprise security status so that responses to external and internal threats can be made swiftly.

If continuous monitoring is being used for their own website it isn’t working. If it isn’t being used, you have wonder why it is one of their focuses when they haven’t even started using it themselves.

Keeping software running on a website up to date is an important part of keeping it secure, but, as we have been focusing on a lot lately, organizations that you would expect to be up to task of handling their security are failing to do that. Whether it is web security companies, a web security organization, or major government websites (the DHS did finally get their website up to date, though) they are all failing to taking this easy security step. We can now add to this recent list, web security journalism.

Here is the WordPress version powering Wired’s Threat Level blog, which covers “Privacy, Crime and Security Online”:

Since they are running 3.4.2 they failed to update WordPress for seven months and more importantly they failed to update when a security release was put out back in January. If an important source of security information isn’t aware they need to keep their website up to date, it isn’t a good sign that others will be getting that information either.

Impermium promotes itself as “Protecting the Web from Security Threats“, that they are “run by leading anti-spam and cybersecurity experts“, and that they have “a cutting-edge comment spam filter“; but a quick look shows that they can’t even handle web security and spam on their own website.

Keeping software running on a website up to date is one of the basic website security measures that should be taken, so a company run by “cybersecurity experts” is going to be doing that right? Wrong:

Not only have they failed to update WordPress for over six months, but they failed to update when a security release was put out back in January. WordPress makes it very easy to update, so there isn’t any excuse for not doing it. They are not alone in this; a few weeks ago we mentioned that that the web security company StopTheHacker also was running the same outdated version of WordPress. What does it say that web security companies either don’t know the basics of website security or don’t care about it?

As for spam, here is the Impermium Knowledge Base:

 

If you are an anti-spam company you shouldn’t miss spam entries like “Significant Bad Credit Loans for Debt Consolidation Loan” and “Know how different types of loans could benefit you” in your Knowledge Base.

They are many companies providing hack/malware cleanup services for websites that are based around providing detection that a website has been compromised. This isn’t really necessary as a properly secured website is very unlikely to be compromised. Unfortunately, from what we have seen of these services, when they do a cleanup they don’t actually determine how the website was hacked in the first place, fix that issue, and make sure the website is otherwise secured (including updating any software running on the website). Doing those things are fundamental components of a proper cleanup and they website will remain vulnerable if they are not done.

Too often we have clients that come to us after having hired one of these services and had their website continue to be hacked. The client ends up paying to have the website cleaned up twice (or more) and suffering additional costs related to the continued issue with their website instead having it fixed the first time.

Our experience has also been that these services are not good at actually detecting hacks, so your website is not only left vulnerable to being hacked again, but you may not even get alerted that it has been hacked again. Detecting that website has been hacked quickly instead of preventing it from being hacked is also of little use in some instances. For example, if your website is hacked and your customer’s information is compromised no matter how fast afterwards that it gets detected, the damage has already been done and the information is in the hands of the hacker.

This brings us to StopTheHacker, which based on their name you would assume would be focused on actually protecting websites from hackers. Unfortunately for their customers that isn’t the case. If you look at the features of their service they are mainly focused on detecting that a website has already been hacked instead of making it secure in the first place. That would be bad on its own, but if you are using our Meta Generator Version Check extension, which is available for Chrome and Firefox, and you visit their website you will find something even more surprising:

That’s right a website security company is failing to take the basic security measure of keeping software running their website up to date, which in the case of WordPress is very easy to do. Not only has StopTheHacker failed to update WordPress for over six months, but they failed to update when a security release was put out back in January.

If StopTheHacker actually did the “Vulnerability Assessments” they claim to do as part of their service, they would be aware that their own website is insecure. Or maybe they don’t use their own service? That would say a lot about what they think of it, wouldn’t it?

A company shouldn’t have anything to do with website security if they don’t care about the security of their own website like the StopTheHacker clearly does not, so we strongly recommend you avoid StopTheHacker and focus on doing the things that will actually protect your website instead of using services like theirs that will leave your website insecure.