Version 3.0.4 of WordPress…is a very important update to apply to your sites as soon as possible because it fixes a core security bug in our HTML sanitation library, called KSES. I would rate this release as “critical.”

Simple enough. He goes on to refer to the vulnerability as an XSS vulnerability which caused a bit of angst on Twitter about what that means and if non-technical users should be given more information due to the terminology.

So, as a public service, I give you some basic definitions and concepts of web security and what we mean. These concepts are rightly scary, but the names tend to be scarier to those who don’t understand them.

XSS

XSS means cross site scripting. Cross site scripting attacks are generally attacks that occur because something is injected into a URL or “event” on a site to make the site do something else. Do something else can mean “hijack” a site so all visitors are sent somewhere else, or special HTML is injected into a site (often in the form of hidden links that diminish Google search results for the site, etc). This was the nature of the vulnerability fixed in WordPress yesterday.

XSS attacks are almost always carried out because of JavaScript injection. WordPress does have security API that makes dangerous characters (that is, special characters that make JavaScript do things) and it is encouraged that all plugin and theme developers use these APIs. [Docs]

CSRF

CSRF means Cross Site Request Forgery. With CSRF attacks, browsers (and sometimes other things) are hijacked to “do” things to a website without a user knowing. It’s the proverbial trojan horse where there is an inherent trust from a site that the user/browser is doing something trusted and so attacks riding the coat tails of such trust are given the same trust that the user would also get.

A simple example (does not actually exist) would be that an authenticated user in WordPress with admin privileges is tricked into clicking a link (as the authenticated user) and then admin privileges are transferred to the attacker. We’ve seen this kind of attack on Facebook and Twitter before where DMs or messages are spread across Facebook walls or via Twitter DM).

SQL Injection

SQL Injection is an attack that, without going into the technical details, allows an attacker to send special queries to the database that can alter, modify or even delete a database altogether. You don’t see many of these anymore because most apps are built on frameworks or platforms (like WordPress or Drupal) that have built in routines and APIs that prevent this. In WordPress, there is a prepare() function in the database class which ensures that no SQL injection is possible.

0Day Vulnerabilities

0Day (that is Zero, not “Oh”) is a vulnerability that is exploited before it has been disclosed. Many security researchers work closely with web application developers to alert them to newly discovered vulnerabilities before they are publicly disclosed. They then work with the developers to close the hole before disclosing the vulnerability. The term 0Day comes from the idea that the web app developer knows about the exploit on the 0th day after public disclosure (it hasn’t been disclosed yet).

Denial of Service/(D)DoS

(D)DoS is a (Distributed) Denial of Service attack. These attacks are carried out by flooding a site with traffic/requests to the point where the site can no longer handle the traffic and collapses. If the attack comes from a single source, it’s a DoS but if it comes from more than one, it is a DDoS.

Obviously, there are many aspects of security. We could go way complicated on terminology and concepts, but these are some of the basics you should know when you see something about a vulnerability.

Photo Credit: heathbrandon

I call bullshit. Here’s why.

The current security paranoia is around an exploit that has already been fixed! That’s right, it was known and fixed two releases ago. The problem is, the people complaining about WordPress’ security are running old software. They didn’t bother to do the responsible thing and keep their blog up to date!

See, WordPress has two different types of releases. Major releases (2.5, 2.6, 2.7, 2.8, etc) provide new features. These releases keep the software innovative, bringing new functionality to bloggers every 4-6 months. Security releases (2.8.1, 2.8.2, 2.8.3, 2.8.4, etc) are arguably more important than major releases because they keep you safe!

Bloggers who ignore these security releases do so at their own risk.

And because of that, when you are hacked, I will charge you an assload of money to fix you up! Believe it.

There is nothing more I want to do on a holiday weekend that also happens to be my birthday weekend, than to fix peoples blogs who didn’t bother to take care of themselves. It’s personal responsibility. Oh, I’ll do it. You won’t like the bill, though.

If you’re using WordPress 2.7+, as said loudmouth blogger was, it’s so simple to keep things up to date with the auto-upgrade button. WordPress even informs you when your version is out of date and provides a direct link to the upgrade page. If you ignore that, it’s not my fault… it’s yours.

For clients hosted on my servers, you are up to date. Why? Because I make sure of it. For the rest of you, do your part, so I don’t have to. Because my part will be making your blog secure, but it will also be sending you a sizable invoice.

Cheers, and happy Labor Day!

Today, that concrete example fell in my lap as I read this post by IT Security company, Websense. The post outlines how malicious users added an image to a “user generated” section of My.Barack.Obama. The image led to a trojan download site that is infecting user computers.

Granted, the MBO site is not a government site, but it is certainly related, wouldn’t you say?

Veteran federal IT Administrators are vicious about protecting internal systems and intranets. Trust me, I know. I come from a Lockheed Martin, CSC and Northrop Grumman background where projects I worked on were all government-facing or oriented. This is what we did.

For as much complaint as there is about the lack of transparency, the lack of public facing services that engage the public in a Web 2.0 way, I’d point out that there is a valid reason for it. I would love to see the Government opened up to more Web-savvy ways, but there are very tangible reasons why they are not!

This is also why Government 2.0 will not rule the day. At least not soon. Until there is a sensible way to prevent user-generated content from being user-generated security nightmares, such as this incident was, Government 1.0 will rule the day.

Security will always trump anything else and right now, there is too much opportunity for mischief to entrust the federal systems to user-generated anything.

Still though, there is a significant amount of new functionality that I find quite nice.

Google Gears Support

Gears is the Google technology that allows for Firefox (apparently IE 6 too, but I can’t confirm) to “pre-cache” pages and speed up access. Gears has been integrated with WordPress 2.6 on the admin side and speeds things up tremendously. This is particularly important where broadband access is limited or inaccessible (third world, for instance). To enable Gears in your new WordPress 2.6 installation, click on the Turbo link in the upper right corner of your WordPress admin.

XML-RPC Editor Functionality

Quietly, a new bit of functionality snuck into WordPress trunk that threw a number of developers and kicked off an interesting discussion. In the development cycle, XML-RPC and Atom Pub API for remote editing was turned off by default as a “security precaution” since many recent WordPress security issues seem to stem from the XML-RPC protocol.

Daniel took the issue up on his blog in a bit of a vicious manner because he has a vested interest in desktop client support for blogs. He is the developer behind the very nice MarsEdit client for Mac which, incidentally, I’m using to write this post. He took his battle up, a bit more congenially among WordPress developers, and the result was a compromise. New WordPress 2.6 installs would be given the option at install to enable XML-RPC editing and upgraded blogs (pre-existing) ware grandfathered in to an “enabled” paradigm.

This is an important shift in the way bloggers think about writing. Most of us simply want to write. We don’t want to worry about the technical aspects of maintaining a blog. This is the philosophy that drove the b5media team, whom I worked for from very early days, to develop a network of bloggers that were able to simply write without worrying about the logistics of maintenance, upgrades, monetization, etc. Unfortunately, while most bloggers are not technical, malicious parties ‘out there’ are technical and look for any opportunity to attack blogs and other websites. XML-RPC and APP provide a vector which, though pretty secure, has seen its share of exploits in the past. Disabling functionality that is not explicitly used by every user makes sense for security reasons.

Bloggers can enable or disable the functionality via the Settings > Writing page in WordPress admin and most desktop editors still only support the XML-RPC protocol so unless you’re explicitly using the Atom Publishing Protocol, you’re probably safe to leave only XML-RPC checked.

Post Versioning

Developers familiar with Subversion, or SVN, understand the concept of versioning and diffs. Compare one file, or revision, against another file, or revision, and see a breakdown of differences between the two. With the help of GUI tools, developers can see a color-coded red vs. green (removed vs. added) presentation.

This concept has now been applied to posts so you can view differences between posts as well as “revert” to an earlier version of a post. I absolutely love this feature and you can see an example of a “revision compare” built directly into WordPress.

SQL Security – $wpdb->prepare()

Back in WordPress 2.3, the

first emerged, initially unused… but there. The method was very experimental at the time and was not ready for prime-time so, though it was included, it was not yet used. We started to see its emergence in WordPress 2.5 and in WordPress 2.6 it is being used just about everywhere.

The idea behind

, if you’ll allow me to get geeky for a minute, is to sanitize SQL in such a way that SQL injection is prevented. So, plugin developers, in particular, should be happy with this method (part of the

class). Not only should they be happy, but from a best practice standpoint, you should be using it.

In my opinion, this should be a part of a “dot release” and not as a major feature of a major release.

Shift-Click Selection of Multiple Checkboxes in WP-Admin

As the backend of WordPress continues to evolve after the release of the drastically redesigned admin in WP 2.5, usability enhancements are also making their way in.

One of the better usability enhancements added in WordPress 2.6 is the ability to “shift click” to select multiple checkboxes at once. Say, for instance, you want to clean up an unwieldy category system (as I need to), Simply navigate to your category management page, click on the first category you want to delete, for instance (posts will go into the default category), and “Shift-click” on a checkbox farther down the list. Magically, all checkboxes in between will also be selected.

This, of course, works anywhere where checkboxes are employed in the WordPress admin.

More Avatar Options

With the Automattic acquisition of Gravatar last year, in-built support for Gravatars was introduced in WordPress 2.5. WordPress 2.6 gives the blogger more options by allowing for selection of the “default” avatar. Out of the box, the default Gravatar can be “Mystery Man”, a generic grey avatar with a white silhouette of someone. Default avatars can also be “blank” (self-explanatory), the Gravatar logo, Identicons, Wavatars or MonsterIDs. These have all been a part of WordPress.com for some time and now come to the rest of us. For more information, Matt wrote a post for the WP.com community that you should probably check out. The difference here being, of course, that WordPress.com offers “dashboard avatars” and WPFROU (WordPress for the Rest of Us) does not include this functionality.

Page Templates over XML-RPC

In addition to the XML-RPC/APP security measures listed above, a new key bit of functionality has now been exposed for API editors (and also, if you think about it, demonstrates the power behind XML-RPC and why you might want to turn it off if you don’t use it). The XML-RPC interface now allows for managing page templates from an API editor. To the best of my knowledge, no editor supports this yet and may not. However, increasingly there is the ability to remotely post content from places like YouTube, Utterz and others. None of these services would have any real use for this functionality either, however I want to point out that because they can post remotely anything that is exposed to the remote world can also be managed.

It’s also conceivable that an offline WordPress client could be built that replicates WordPress admin in a desktop client, and this is one more step in that direction.

Press This

Press this! is a new enhancement of a long-existing concept. Bookmarklets. In fact, WordPress used to have a bookmarklet included that would allow a user to quickly start a new post from the browser toolbar, but the functionality was limited.

The Press This! functionality rocks, actually, because it allows the user to be on any website, click the bookmarklet and get a miniaturized version of WordPress admin with options to snip text, photos from the page, quotes or video embeds.

Obviously, we can lead you to water but we can’t make you drink. BE VERY CAREFUL OF COPYRIGHT VIOLATIONS! Oh, and the Associated Press sponsored this. (kidding!)

Integrated Theme Preview

Theme previewing has been a bugaboo for many a theme designer. How do we check and develop without affecting the rest of the site. Some folks resorted to using Ryan’s venerable Theme Preview plugin. Others setup a beta version of a site that was sandboxed off from the rest of the world. Lots of different approaches, all of which remain valid.

However, for theme developers and bloggers looking to see how a theme will look on their site, with their content, there is now theme preview bling. When you are on your Design page, click on one of the theme screenshots and your site will be loaded in a lightbox-like overlay to allow you a live preview. Heavily inspired, I’d imagine, by the Mac OS X Leopard Quick Look functionality.

Remember when Technosailor looked like this?

Plugin Management Overhaul

Finally, the plugin management interface has received a face-lift and some added functionality. Active plugins and inactive plugins are segregated and with that new fangled Shift-click functionality I talked about before, plugin management just got really freaking simple. Note that Active plugins can be deactivated in bulk and Deactivated plugins can be activated or even deleted in bulk. Clean up that stale plugin list in a snap. But… there’s always a but… make a backup before you go nuts.

It is unclear as to whether Microsoft is a willing ally in this, as Borat put it, “war of terror”.

More info as I get it.

Added: As pointed out by commenters below, there is not enough evidence here to prove one way or another. Cryptome also has a considerable history of “waving the flag” around government crypto issues. However, in theory, the potential risk does exist as the exploit is in similar fashion as Windows Update. In WU, users allow a web service remote administrative access to their machine during the period of time surrounding an update. As this is the window of time that Cryptome alleges is the “backdoor” period, it would not surprise me if this is indeed true. Microsoft PR handling this issue has no comment at this time but promises to “look into it” – whatever that means.

Photo Attribution: Jnxyz

WordPress celebrated it’s 500,000 install last month and cheers to them. The platform is stable, fast, easy to use. It has no cumbersome plugin architecture (like Textpattern). That’s not to say that it has never had its share of security vulnerabilities. In fact, there have been a number of documented fixes over the years.

WordPress has it’s own contact address for securtiy issues. It is security@wordpress.org. In a dangerous world of XSS and SQL injection, the proper way to handle the discovery of a security flaw is to report it first and allow the vendor to provide a patch or a new version. I demonstrated this process when I reported the XSS flaw in the Democracy 1.2 plugin for WordPress. I alerted the plugin author, gave him an opportunity to provide a fixed version and he did.

That’s the responsible thing to do. Alert the autrhor. Let the vendor produce a fix. When a solution is handy, make the exploit public. Instead, J. Angelo Racoma, in his quest to be popular after buying Blog Herald, leaked the story the day before WordPress 2.0.6 was released.

Now, I’m not in on the day to day conversations at Automattic. I really have no idea if the release was scheduled for today or not. But regardless, reporting a bug that has not been publicized before ample time was provided for a bugfix, is irresponsible. The thousands of readers at the Blog Herald could very well have gone into a panic. The rumor mill could have begun to spin. And for what? Simply waiting a day or two would have meant Blog Herald could suggest installing WordPress 2.0.6. Instead, they mentioned a beta (read: could have bugs still) version of WordPress 2.0.6 was being publically tested.

J. Angelo’s comment to me was this:

the news would’ve spread even without us posting about it, so I thought it best to post this as a warning. Patching WP to fix bugs would always be a good idea.

Ah, but the word would spread after the public had been notified – which happened today with two reports – a day after J. Angelo decided to spook the world. Wave your hands in the air but offer no solution. Sounds like Democrats in Congress regarding Iraq.

Blog Herald’s reputation slipped with me ater the purchase from Matt Craven and BlogMedia. This incident causes me less to trust them because it appears they are only concerned with getting the scoop and not behaving as good blogizens.

If you manage more than, say, 10 blogs then perhaps Brian Layman’s script will be useful for you. As I noted in his comments, I do something similar but in a different way. It took me 4 minutes and 15 seconds to upgrade all 181 blogs currently active or being prepped in our network.