The importance of keeping scripts updated.

On your website, you may have scripts that deliver certain functionality. These scripts must be kept up to date to ensure they have the most recent bug fixes and security updates. This also applies to any plugins you may have installed within these scripts.

A common type of script is a content management system. The most popular being WordPress.

WordPress is an incredible piece of software, and I can fully understand why it has become so popular. It allows anyone with next to no understanding of how websites work to manage and administer a website.

The popularity of WordPress has, to an extent, drawn the wrong kind of attention. Because it is open source and can be downloaded and reviewed by anyone, bad actors will look over the source code looking for possible weaknesses. These weaknesses can then be used to exploit a WordPress installation. As exploits are detected, WordPress will provide updates. You should always install these updates to ensure you are protected from any previously identified weaknesses.

I have used WordPress as an example because of its popularity, but in reality the same thing is happening on a smaller scale to just about every script that can be downloaded and installed. People who wish to find exploits will download the software and examine it. With the rise of AI, this is becoming more and more of a problem. AI can analyse code way faster than humans. This means software vendors are having to act faster to ensure they provide patches or updates as soon as an exploit is discovered.

The best practice is to enable auto-updates within your scripts if this feature is provided. Always ensure that you are running the latest version of the software, including any themes or plugins that you have installed. Plugins and themes are also vulnerable to exploits, and you need to ensure they are also kept up to date. A vulnerable plugin or theme can lead to your core site being exploited.

Going back to our WordPress example, you should ensure that WordPress is set to receive updates. You should also enable auto-updates for your themes and plugins. If you have themes or plugins installed but do not use them, it is good practice to remove them. Just because they are not being used does not make them immune from being compromised if there is an exploit targeting them.

Website script exploitation takes place on an industrial scale. Every day there are servers that simply scan the web looking for script versions that have a known exploit. Once a vulnerable site is discovered, it can then be attacked using automation. This can lead to the website being defaced, going down or being used to send mass mail.

Once a website has been compromised due to an exploit, it can be quite a process to recover the site to its previous state. It is not just a case of reverting to a backup and updating the script version. Very often, the exploit has left backfdoors than can be used to reinfect the website. A good analogy would be playing “whack-a-mole”. You spend time removing malicious files, and they keep reappearing.

We have developed software to try and prevent and mitigate the effects of a compromised script. We have a piece of software that runs all the time called “IP Vigilant” It checks for IP addresses making lots of requests (typical bot scanning behaviour) and then checks the IP address against a database of known malicious IPs. If the IP is found to be bad, it is blocked at the firewall.

We also have Ulatu Guard that can be deployed after a website has experienced a compromise. This monitors the affected web space and checks for new files that match certain criteria. Any file that is considered suspicious is quarantined. This is not a “fix” to the problem, but it does allow the site owner time to fully address the issue.

If you ever suspect your site has been compromised, you must contact us as soon as possible so that we can assist you.