WordPress sites hit by botnet

Webmasters who find an annoying error message on their sites may have caught a big break, thanks to a slip-up by the authors of the Gumblar botnet.

Tens of thousands of webstes, many of them small sites running the WordPress blogging software, have been broken, returning a "fatal error" message in recent weeks. According to security experts those messages are actually generated by some buggy malicious code sneaked onto them by Gumblar's authors.

Gumblar made headlines in May when it appeared on thousands of legitimate websites, posting what's known as "drive-by download" code that attacks infected visitors with a variety of online attacks. The botnet had been quiet during July and August, but recently has begun infecting computers again.

Apparently, however, some recent changes made to Gumblar's web code caused the problem, according to independent security researcher Denis Sinegubko.

Sinegubko learned about the issue about five days ago when he was approached by one of the users of his Unmask Parasites website checker. After investigating, Sinegubko discovered that Gumblar was to blame. Gumblar's authors apparently made some changes to their web code without doing the proper testing, and as a result "the current version of Gumbar effectively breaks WordPress blogs," Sinegubko wrote in a blog post describing the issue.

The bug doesn't just affect WordPress users, Sinegubko said. "Any PHP site with complex file architecture can be affected," he said via instant message.

WordPress sites that have crashed because of the buggy code display the following error message: Fatal error: Cannot redeclare xfm() (previously declared in /path/to/site/index.php(1) : eval()'d code:1)
in /path/to/site/wp-config.php(1) : eval()'d code on line 1

Other sites running software such as Joomla get different fatal-error messages, Sinegubko said. "It's a standard PHP error," he said. "But the way Gumblar injects malicious scripts make it always display strings like: eval()'d code on line 1"

The bug may seem like an annoyance to webmasters, but it's actually a boon. In effect, the messages warn Gumblar's victims that they've been compromised.

Security vendor FireEye said that the number of hacked sites could be in the hundreds of thousands. "Because of the fact that they're buggy, you can now do this Google search and you can find hundreds of thousands of php-based sites that they've compromised," said Phillip Lin, director of marketing with FireEye. "There was a mistake made by the cybercriminals."

Not all Gumblar-infected sites will display this message, however, Lin noted.

Gumblar installs its buggy code on websites by first running on the desktop and stealing FTP (File Transfer Protocol) login information from its victims and then using those credentials to place malware on the site. Webmasters who suspect that their sites have been infected can follow the detection and removal instructions posted on Sinegubko's blog. Simply changing FTP credentials will not fix the problem, as Gumblar's authors usually install a back-door method of accessing sites.