Security Incident Reported by Rank Math: Malware Linked to PRO Version 3.0.123
In a recent announcement, Rank Math disclosed a security incident involving malware that was distributed through the compromised PRO version of their popular SEO plugin, specifically version 3.0.123. This unfortunate event raises serious concerns for WordPress website administrators who may have activated this version of the plugin.
The company has issued a warning, advising users that their WordPress sites are at risk if they have activated the affected plugin. In response to this incident, Rank Math acted swiftly by removing the compromised files and releasing a clean version, designated 3.0.124. This proactive measure underscores their commitment to user safety and security.
Affected User Base
The impact of this security breach appears to be limited, affecting only a small number of users who downloaded the compromised premium plugin between October 15, 2023, at 20:02 UTC, and October 16, 2023, at 07:12 UTC. Significantly, Rank Math assured users that its free SEO plugin, available through WordPress.org, is unaffected by this incident. As such, users who have only downloaded the free version need not take any action related to the security advisory.
Understanding the Malware
The advisory issued by Rank Math details the nature of the malware, noting that it employs persistence mechanisms that complicate the cleanup process. More specifically, the malware is capable of recreating a hidden backdoor each time an infected website is visited. As a consequence, simply disabling the plugin or removing suspicious files does not fully eliminate the security threat.
Website administrators engaging in manual recovery efforts are required to delete the entire "rank-math-pro" directory. Additionally, they must remove any malicious entries identified in the WordPress options table. In this case, the specific option_name values that need to be deleted include _uf6qdn2hmm, t8krdk990phb, and _np5pvf754c. To further mitigate the threat, Rank Math recommends that organizations block outbound connections to rank1cdn[.]com, where hosting or firewall controls permit such actions.
Indicators of Compromise
Rank Math’s advisory outlines potential indicators of compromise (IoC) associated with this malware incident. Administrators should be on the lookout for dubious PHP files located in must-use plugins, other plugin directories, and non-default theme folders, as well as within Rank Math’s includes directory. Key code indicators to investigate include combinations of base64_decode and XOR loops, along with specific keywords such as "xmmqhn," the function proc_open, and code related to PHP-FPM sockets.
Further investigation targets are unauthorized administrator accounts prefixed with "wpsupport_," email addresses that end in "@wp-mail[.]net," and a fraudulent WordPress core file named wp-includes/class-wp-cache-util.php. Additionally, a thorough examination of .htaccess rules that enable PHP execution in .cache files is crucial, as well as reviewing system cron entries marked with #ms6v46.
Recommended Actions for Affected Users
Rank Math strongly advises organizations that may have been compromised to assume that sensitive information accessible through the affected website could have been exposed. While this does not definitively indicate that every installation experienced credential theft, it highlights the critical need for comprehensive credential rotation.
Administrative teams are urged to change various credentials, including WordPress passwords, database credentials, security keys, API tokens, payment gateway keys, SMTP credentials, and any environmental secrets. Furthermore, the administrator should review and reset two-factor authentication settings as necessary to enhance security.
The recommended recovery method involves restoring website files and databases from a clean backup created before the incident began on October 15, 2023. Following restoration, administrators should conduct a security scan, replace any compromised credentials, and install the clean version of the plugin, 3.0.124. Those without appropriate backups must eliminate persistence mechanisms before investigating any additional malicious alterations.
Post-Cleanup Measures
After completing the cleanup process, administrators are advised to run commands such as wp core verify-checksums and wp plugin verify-checksums –all, in addition to scanning the website using reputable security tools. Continuous monitoring of outbound traffic and scrutinizing deleted files for any signs of recurrence of the malware is imperative. It is noteworthy that premium plugins may lack public checksums, necessitating a comparison against clean official packages.
The advisory does not provide information regarding the identity of the attacker, the method by which the distribution files were compromised, or quantify the number of affected installations. Users who downloaded the contaminated version but did not activate it should uninstall it, install the clean release, and conduct a security scan, as merely downloading the compromised version does not automatically imply a website compromise.
Conclusion
As cyber threats continue to evolve, the Rank Math incident serves as an important reminder for website administrators to remain vigilant and proactive in their security practices. By adhering to recommended recovery and preventive measures, they can better safeguard their WordPress installations against potential vulnerabilities.