Botnet authors crash WordPress sites with buggy code

Other sites that use complex PHP are also affected

Webmasters who find an annoying error message on their sites may have caught a big break, thanks to a slip-up by the authors of the Gumblar botnet.

Tens of thousands of Web sites, many of them small sites running the WordPress blogging software, have been broken, returning a "fatal error" message in recent weeks.

According to security experts those messages are actually generated by some buggy malicious code sneaked onto them by Gumblar's authors.

Gumblar made headlines in May when it appeared on thousands of legitimate Web sites, posting what's known as "drive-by download" code that attacks infected visitors with a variety of online attacks. The botnet had been quiet during July and August, but recently has begun infecting computers again.

Apparently, however, some recent changes made to Gumblar's Web code caused the problem, according to independent security researcher Denis Sinegubko.

Sinegubko learned about the issue about five days ago when he was approached by one of the users of his Unmask Parasites Web-site checker.

After investigating, Sinegubko discovered that Gumblar was to blame. Gumblar's authors apparently made some changes to their Web code without doing the proper testing, and as a result "the current version of Gumbar effectively breaks WordPress blogs," he wrote in a blog post describing the issue.

The bug doesn't just affect WordPress users, Sinegubko said. "Any PHP site with complex file architecture can be affected," he said via instant message.

WordPress sites that have crashed because of the buggy code display the following error message: Fatal error: Cannot redeclare xfm() (previously declared in /path/to/site/index.php(1) : eval()'d code:1)

in /path/to/site/wp-config.php(1) : eval()'d code on line 1

Other sites running software such as Joomla get different fatal-error messages, Sinegubko said. "It's a standard PHP error," he said. "But the way Gumblar injects malicious scripts make it always display strings like: eval()'d code on line 1"

The bug may seem like an annoyance to webmasters, but it's actually a boon. In effect, the messages warn Gumblar's victims that they've been compromised.

Security vendor FireEye said that the number of hacked sites could be in the hundreds of thousands.

"Because of the fact that they're buggy, you can now do this Google search and you can find hundreds of thousands of php-based sites that they've compromised," said Phillip Lin, director of marketing with FireEye. "There was a mistake made by the cybercriminals."

Not all Gumblar-infected sites will display this message, however, Lin noted.

Gumblar installs its buggy code on Web sites by first running on the desktop and stealing FTP (File Transfer Protocol) login information from its victims and then using those credentials to place malware on the site.

Webmasters who suspect that their sites have been infected can follow the detection and removal instructions posted on Sinegubko's blog.

Simply changing FTP credentials will not fix the problem, as Gumblar's authors usually install a back-door method of accessing sites.

Join the PC World newsletter!

Error: Please check your email address.

Tags exploits and vulnerabilitiesgumblarsecuritybotnetsphpWordpressblogging

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Essentials

Lexar® JumpDrive® S57 USB 3.0 flash drive

Learn more >

Microsoft L5V-00027 Sculpt Ergonomic Keyboard Desktop

Learn more >

Mobile

Lexar® JumpDrive® S45 USB 3.0 flash drive 

Learn more >

Exec

Audio-Technica ATH-ANC70 Noise Cancelling Headphones

Learn more >

HD Pan/Tilt Wi-Fi Camera with Night Vision NC450

Learn more >

Lexar® Professional 1800x microSDHC™/microSDXC™ UHS-II cards 

Learn more >

Lexar® JumpDrive® C20c USB Type-C flash drive 

Learn more >

Budget

Back To Business Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?