Botnet authors crash WordPress sites with buggy code

Other sites that use complex PHP are also affected

Webmasters who find an annoying error message on their sites may have caught a big break, thanks to a slip-up by the authors of the Gumblar botnet.

Tens of thousands of Web sites, many of them small sites running the WordPress blogging software, have been broken, returning a "fatal error" message in recent weeks.

According to security experts those messages are actually generated by some buggy malicious code sneaked onto them by Gumblar's authors.

Gumblar made headlines in May when it appeared on thousands of legitimate Web sites, posting what's known as "drive-by download" code that attacks infected visitors with a variety of online attacks. The botnet had been quiet during July and August, but recently has begun infecting computers again.

Apparently, however, some recent changes made to Gumblar's Web code caused the problem, according to independent security researcher Denis Sinegubko.

Sinegubko learned about the issue about five days ago when he was approached by one of the users of his Unmask Parasites Web-site checker.

After investigating, Sinegubko discovered that Gumblar was to blame. Gumblar's authors apparently made some changes to their Web code without doing the proper testing, and as a result "the current version of Gumbar effectively breaks WordPress blogs," he wrote in a blog post describing the issue.

The bug doesn't just affect WordPress users, Sinegubko said. "Any PHP site with complex file architecture can be affected," he said via instant message.

WordPress sites that have crashed because of the buggy code display the following error message: Fatal error: Cannot redeclare xfm() (previously declared in /path/to/site/index.php(1) : eval()'d code:1)

in /path/to/site/wp-config.php(1) : eval()'d code on line 1

Other sites running software such as Joomla get different fatal-error messages, Sinegubko said. "It's a standard PHP error," he said. "But the way Gumblar injects malicious scripts make it always display strings like: eval()'d code on line 1"

The bug may seem like an annoyance to webmasters, but it's actually a boon. In effect, the messages warn Gumblar's victims that they've been compromised.

Security vendor FireEye said that the number of hacked sites could be in the hundreds of thousands.

"Because of the fact that they're buggy, you can now do this Google search and you can find hundreds of thousands of php-based sites that they've compromised," said Phillip Lin, director of marketing with FireEye. "There was a mistake made by the cybercriminals."

Not all Gumblar-infected sites will display this message, however, Lin noted.

Gumblar installs its buggy code on Web sites by first running on the desktop and stealing FTP (File Transfer Protocol) login information from its victims and then using those credentials to place malware on the site.

Webmasters who suspect that their sites have been infected can follow the detection and removal instructions posted on Sinegubko's blog.

Simply changing FTP credentials will not fix the problem, as Gumblar's authors usually install a back-door method of accessing sites.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags botnetsphpexploits and vulnerabilitiesWordpressblogginggumblar

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert McMillan

IDG News Service
Show Comments

Father’s Day Gift Guide

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?