Some of you may have noticed that my blog was hacked twice during February. The first hack was someone entering links for some obscure medical shop in all postings. The second hack was a simple defacing. You could say that it should be embarrassing to be hacked and that me as a security expert should be totally safe. \ud83d\ude09<\/p>\n
However, as you are perfectly aware of, security erodes over time and a constant vigilance is needed. This however is true only if the things you have are valuable enough. In my case the value lies only in my postings. There is no confidentiality near them as they are published. Integrity is however an issue and availability even more. <\/p>\n
I have further looked at the risks and applied the risk triangle making sure that I understand the likelihood of a threat agent actually posing a threat to me. In my case the probability is extremely low that someone would hack me just to hack me. However, an automated attack may make me a possible target. And this was of course the case these times.<\/p>\n
The first hack affected the integrity of my posts and was rather easily thwarted by restoring a backup. That however took a few days before my hosting company was able to do that. During that time I probably suffered a reputation loss. The reason for the hack was mainly a vulnerability in WordPress that I hadn\u00b4t patched as I do not check my blog daily. This will now be mitigated by subscribing to the update service making sure that my blog is patched immediately. This is a change I need to do because my blog is now on the radar for automated attacks.<\/p>\n
The second hack was however impossible for me to stop as it was aimed at the webserver itself and used a weak password in some others website. From there it was possible to exchange the index files on all sites pointing the visitors to a default picture. I have suggested for my hosting company a possibility to sandbox the websites making sure that not the whole server is wreaked if it would happen again. Furthermore I will strengthen the ACL\u00b4s on the index files to make sure an automated attack fails.<\/p>\n
All in all, the blog is up running again, I didn\u00b4t lose any information, and I got the possibility to discuss this topic. And I have updated my risk analysis making sure that I at least get to patch WordPress quickly. \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"
Some of you may have noticed that my blog was hacked twice during February. The first hack was someone entering links for some obscure medical shop in all postings. The second hack was a simple defacing. You could say that it should be embarrassing to be hacked and that me as a security expert should […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[12,4],"tags":[],"class_list":["post-332","post","type-post","status-publish","format-standard","hentry","category-methodology","category-security-architecture"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=332"}],"version-history":[{"count":2,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/332\/revisions"}],"predecessor-version":[{"id":1089,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/332\/revisions\/1089"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}