| transcript | |
|---|---|
|
00:00 - 0:00:02
*Music*
|
|
|
0:00:02 – 0:00:31
[Music]
|
|
|
0:00:31 – 0:00:40
Hello and welcome to a new edition of the digression, where I occasionally
|
|
|
0:00:40 – 0:00:55
The subject is digressive. Uiuiui, what days! They were pretty intense. In short,
|
|
|
0:00:55 – 0:01:02
There was a hack on the Lautfunk website.
|
|
|
0:01:02 – 0:01:08
Jo, I had to sack that first.
|
|
|
0:01:08 – 0:01:10
What happened?
|
|
|
0:01:10 – 0:01:17
I've been wondering lately,
|
|
|
0:01:17 – 0:01:24
Why was the load on the server so high?
|
|
|
0:01:24 – 0:01:32
You have to understand, in order to have such a website on the Internet, you just need some provider,
|
|
|
0:01:32 – 0:01:41
In the simplest case, such a web hosting. On sides where one has a greater burden,
|
|
|
0:01:41 – 0:01:50
It's a good idea to have your own server. It's like a computer at home.
|
|
|
0:01:50 – 0:01:57
where an operating system runs on it and there is a special software, which
|
|
|
0:01:57 – 0:02:10
Web service offered. So you can then from outside or also at companies internally on this
|
|
|
0:02:10 – 0:02:19
Server access, can then use services and in my case this is just a WordPress.
|
|
|
0:02:19 – 0:02:32
My website consists of or builds on a WordPress background. This WordPress can be
|
|
|
0:02:32 – 0:02:43
Expand with plugins. What are Plugins? Plugins are a software code that provides functionality
|
|
|
0:02:43 – 0:02:54
Extended by WordPress. As always, software is not safe.
|
|
|
0:02:54 – 0:03:03
There is always a vulnerability somewhere. And even if you maintain your system regularly
|
|
|
0:03:03 – 0:03:09
and always plays in the updates – and this is now also the case with WordPress automatically.
|
|
|
0:03:09 – 0:03:20
WordPress originally comes from the blogging scene, so was for personalized blogs.
|
|
|
0:03:20 – 0:03:28
People kept a kind of online diary and that's what it was designed for. It is
|
|
|
0:03:28 – 0:03:35
It grew further, then it became a so-called content management system. You could stop
|
|
|
0:03:35 – 0:03:41
Upload images, short audio files, small video clips and this WordPress has it all
|
|
|
0:03:41 – 0:03:48
management and that makes it a particularly powerful tool today, if you
|
|
|
0:03:48 – 0:03:59
They want versatile websites. There are faster solutions for websites that don't have that much
|
|
|
0:03:59 – 0:04:05
They should have functionality, i.e. if they just show a small video
|
|
|
0:04:05 – 0:04:10
If you want to or just take pictures, you can do it much faster with other solutions. The pages
|
|
|
0:04:10 – 0:04:13
Then they are very fast.
|
|
|
0:04:13 – 0:04:17
But such a WordPress has the advantage,
|
|
|
0:04:17 – 0:04:21
that you can write comments,
|
|
|
0:04:21 – 0:04:24
which are immediately available.
|
|
|
0:04:24 – 0:04:26
Contributions are
|
|
|
0:04:26 – 0:04:29
Yes, with the published and immediately available.
|
|
|
0:04:29 – 0:04:33
The system is dynamic and expanding.
|
|
|
0:04:33 – 0:04:37
And that also makes it extremely complex.
|
|
|
0:04:37 – 0:04:40
and also vulnerable.
|
|
|
0:04:40 – 0:04:46
If there is a newer version of WordPress,
|
|
|
0:04:46 – 0:04:52
In the first few weeks, there are all wet-long updates with bug fixes.
|
|
|
0:04:52 – 0:04:59
And so it is with the plugins, this extension for new functions.
|
|
|
0:04:59 – 0:05:06
And for example, there is a plugin there, which many use, who also have a podcast
|
|
|
0:05:06 – 0:05:18
You have to and provide it yourself. It's called "Podlove Publisher" and that's what it's all about.
|
|
|
0:05:18 – 0:05:24
All the features you need for a podcast. Once that stops
|
|
|
0:05:24 – 0:05:31
the website is displayed, but what is much more important is that the feed, i.e. a special
|
|
|
0:05:31 – 0:05:40
File is generated that stops services or even stops the person himself if they want to hear the
|
|
|
0:05:40 – 0:05:47
You can subscribe with a podcaster. Now that's what it's all about
|
|
|
0:05:47 – 0:05:56
Systems like WordPress offer that comments come and go quickly.
|
|
|
0:05:56 – 0:06:02
It is also added to the feed. When you make new posts, every time it's in
|
|
|
0:06:02 – 0:06:11
Added this feed. In the early days of podcasting, this feed is still available.
|
|
|
0:06:11 – 0:06:17
Written by himself. This was an XML file where you entered everything by hand.
|
|
|
0:06:17 – 0:06:24
Where is the audio file, where is the image file and so on and so on. It was already time-consuming
|
|
|
0:06:24 – 0:06:32
and a hard work, if you just had many consequences, because you always keep it at the top
|
|
|
0:06:32 – 0:06:39
Place had to put on it. And that just takes off a pot run. You have a beautiful
|
|
|
0:06:39 – 0:06:49
Website where visitors can leave comments. You can do a lot more there,
|
|
|
0:06:49 – 0:06:54
Just like in the feed. And you also have a little bit of playful freedom,
|
|
|
0:06:54 – 0:07:02
that you can design that there is such a personal brand, what stops on Spotify
|
|
|
0:07:02 – 0:07:12
or at RTL Plus, Amazon, wherever you can listen to podcasts, just isn't there,
|
|
|
0:07:12 – 0:07:20
It is a standardized surface. In short, many in Germany use stop
|
|
|
0:07:20 – 0:07:30
the Potlov Publisher and that's exactly what had a vulnerability now. Great to explain now,
|
|
|
0:07:30 – 0:07:39
What happened there or something doesn't make much sense, because we're sliding into Chinese.
|
|
|
0:07:39 – 0:07:50
But in short, it had been possible, by a simple command, to simply
|
|
|
0:07:50 – 0:07:57
Web page has sent to place a file in a special area, with which you can
|
|
|
0:07:57 – 0:08:03
He had the opportunity to control the system. So you could have a
|
|
|
0:08:03 – 0:08:10
so-called backdoor, i.e. install a back door. And that's exactly what happened. And
|
|
|
0:08:10 – 0:08:18
What is frightening is that this happened within a few hours on many pages,
|
|
|
0:08:18 – 0:08:29
because this scanning process and the placement of this back door took place automatically. So
|
|
|
0:08:29 – 0:08:38
To all the people with whom I have talked about it and who have given me parts of their protocols on
|
|
|
0:08:38 – 0:08:45
From the log files, you could always see the same pattern. And so
|
|
|
0:08:45 – 0:08:52
A picture has emerged, also from the behavior of the site. But what do you do now,
|
|
|
0:08:52 – 0:08:59
Now, when your own website is affected, the most important thing in the first place
|
|
|
0:08:59 – 0:09:04
Keep cooler-sized. I've had a hard time with this,
|
|
|
0:09:04 – 0:09:09
Because it was Tuesday. I've had Tuesday anyway.
|
|
|
0:09:09 – 0:09:14
had a pretty shitty day and when I was in front of the computer in the evening
|
|
|
0:09:14 – 0:09:19
I realized there was something wrong with the website.
|
|
|
0:09:19 – 0:09:31
I wanted to check something else briefly, because a new blog post will be released on Thursday at the latest, which goes online.
|
|
|
0:09:31 – 0:09:43
And I still had a podcast that was supposed to go online on Tuesday, but somehow didn't go online on Tuesday.
|
|
|
0:09:43 – 0:09:48
And then I realized, the site reacts funny, it's animal slow.
|
|
|
0:09:48 – 0:09:54
It's an improbably high load on the system.
|
|
|
0:09:54 – 0:10:01
And then I turned to my provider, who takes care of the server.
|
|
|
0:10:01 – 0:10:05
And they said, 'There's something funny, there's something wrong.'
|
|
|
0:10:05 – 0:10:09
We have agreed to take the website offline.
|
|
|
0:10:09 – 0:10:17
The quickest way was to simply rename the directory where the website is,
|
|
|
0:10:17 – 0:10:23
So that it is no longer available, but I have access to all data.
|
|
|
0:10:23 – 0:10:29
So I just switched to the side with another program
|
|
|
0:10:29 – 0:10:35
And then I started pulling them all down so I could have them locally.
|
|
|
0:10:35 – 0:10:41
And then I noticed that in certain directories certain files
|
|
|
0:10:41 – 0:10:42
were.
|
|
|
0:10:42 – 0:10:48
After I identified the stop, I thought, well, then you do
|
|
|
0:10:48 – 0:10:55
Now you have a backup from three days ago, you'd have to do just a few more.
|
|
|
0:10:55 – 0:11:00
Replace certain files, images above all, and then it would have to run.
|
|
|
0:11:00 – 0:11:06
The next day, around 10 a.m., the site was re-infected.
|
|
|
0:11:06 – 0:11:10
And then I realized it must be a bigger thing.
|
|
|
0:11:10 – 0:11:17
I then took the page offline again, had looked, well, in the directories,
|
|
|
0:11:17 – 0:11:23
Where there were things in there before, there were things in there that weren't there before.
|
|
|
0:11:23 – 0:11:24
I had a clean backup installed.
|
|
|
0:11:24 – 0:11:33
And then it was good, now I had to see where it was. I'm back with my
|
|
|
0:11:33 – 0:11:40
Providers are contacted. Together we looked through the logs, the log files and there
|
|
|
0:11:40 – 0:11:46
We noticed a few things. That would be too technical to tell.
|
|
|
0:11:46 – 0:11:54
But in short, you have seen that the same path has always been taken. About one
|
|
|
0:11:54 – 0:12:01
special area, the cache area of the Potlov, a file was placed, after which a
|
|
|
0:12:01 – 0:12:07
placed another file in a different directory and so the backdoor was completely there.
|
|
|
0:12:07 – 0:12:18
Yes, we now knew what and how. We just didn't know how big the damage was. So
|
|
|
0:12:18 – 0:12:24
I sat down and wrote to Erik, the main developer of
|
|
|
0:12:24 – 0:12:31
On Pod Love. He had told me that he already knew about the gap a few days ago,
|
|
|
0:12:31 – 0:12:40
has also published a patch, but at – oh God, what is the name of the page? – in any event
|
|
|
0:12:40 – 0:12:49
in the case of a provider responsible for Internet security, an organisation more precisely
|
|
|
0:12:49 – 0:12:56
said, and filed the files there and said, you can check me if that's always
|
|
|
0:12:56 – 0:13:03
It is still possible to make this attack. In short, the new version, the fixed one, was clean.
|
|
|
0:13:03 – 0:13:10
We had written a bit with it, because I'm also a beta tester and almost also
|
|
|
0:13:10 – 0:13:17
a newer version, the functionality tester, whether this would also be in the version. There he sat,
|
|
|
0:13:17 – 0:13:22
No, he hasn't done that yet, but he does it the same way and a quarter of an hour later it was the same.
|
|
|
0:13:22 – 0:13:31
Updated revision. Then I sat down and sat down
|
|
|
0:13:31 – 0:13:39
and instead of backing up, I just installed a new WordPress,
|
|
|
0:13:39 – 0:13:46
this is relatively easy, then have out of the folder where all the pictures are,
|
|
|
0:13:46 – 0:13:51
with whom again meticulously went through and everything that is not in the picture is deleted,
|
|
|
0:13:51 – 0:13:59
I then uploaded it, then opened the folder where all the extensions in it
|
|
|
0:13:59 – 0:14:06
are, the plugins, have all installed one after the other cleanly and see there, the website
|
|
|
0:14:06 – 0:14:16
is back, very performant and so far I have no re-infection, because I observe,
|
|
|
0:14:16 – 0:14:24
I'm very precise about the system, including the entire processes that are running and I'm really glad that
|
|
|
0:14:24 – 0:14:31
It was so easy. In the end, it took two days and I'm sorry.
|
|
|
0:14:31 – 0:14:40
that the website, the podcast or the podcast-T, because there are several running about it,
|
|
|
0:14:40 – 0:14:48
For a while they were just offline and in no way anyone knew,
|
|
|
0:14:48 – 0:14:55
Which is because I wouldn't even have a so-called "main" right now.
|
|
|
0:14:55 – 0:15:02
trends – shit, you say differently – can make a report in any case,
|
|
|
0:15:02 – 0:15:11
that the site is currently offline, but is being rebuilt or something. If I had
|
|
|
0:15:11 – 0:15:15
I could have done it as HTML, but then I couldn't have tested it in between.
|
|
|
0:15:15 – 0:15:19
Because the HTML page is always there. Or I'd have a little one at home.
|
|
|
0:15:19 – 0:15:30
Web servers need to be virtual. Yeah, what am I supposed to say about that? It's a pretty stupid thing,
|
|
|
0:15:30 – 0:15:36
That's how it went and that with the infection is also a pretty stupid thing.
|
|
|
0:15:36 – 0:15:46
I'm sorry about the developer, the software, because he now has a bunch of people,
|
|
|
0:15:46 – 0:15:54
They are looking for help on the walls. Yes, you have to wait and see what happens. But this is
|
|
|
0:15:54 – 0:16:03
about what I have done now and that was also with the agreement of the provider
|
|
|
0:16:03 – 0:16:12
my server the smarter version, because to install a backup again and if necessary the
|
|
|
0:16:12 – 0:16:17
Having a problem that there was already a backdoor installed and that then over it again
|
|
|
0:16:17 – 0:16:25
Reinfection is coming, the side is just so high. I now know several people who are affected.
|
|
|
0:16:25 – 0:16:34
I'm sure there are still a lot of people on the road who have no idea that they are
|
|
|
0:16:34 – 0:16:40
have the problem. This will show up in the near future. What do we learn from this?
|
|
|
0:16:40 – 0:16:55
Thing that in computer science, that in IT, that in programming a wisdom always
|
|
|
0:16:55 – 0:17:07
He was right and is always a constant. No system is reversible. You can still go so far
|
|
|
0:17:07 – 0:17:14
Thinking so far into the future. I would also like to quote Erik.
|
|
|
0:17:14 – 0:17:21
who had written yesterday, no, today that he is now making a giant head about it,
|
|
|
0:17:21 – 0:17:29
whether he should have dealt with it differently, whether he might not have been able to fill the gap sooner
|
|
|
0:17:29 – 0:17:35
to communicate, but then in the end also risk that even more people
|
|
|
0:17:35 – 0:17:41
It should be noted that there is this gap. As you can see, this attack
|
|
|
0:17:41 – 0:17:48
was fully automated, this early communication would at most have
|
|
|
0:17:48 – 0:17:56
that people would have become aware of it more quickly and not to the
|
|
|
0:17:56 – 0:18:06
It was a time when there was almost a patch. Well, it's really stupid. I now have two
|
|
|
0:18:06 – 0:18:14
days, i.e. two working days for me, which is not a relation to a normal working day,
|
|
|
0:18:14 – 0:18:21
spent with it. Make the page work again, once without success, because I became
|
|
|
0:18:21 – 0:18:29
reinfected again and then the clean way. The longest thing that took in this procedure,
|
|
|
0:18:29 – 0:18:40
It's just the incredible amount of data. I think I'm downloading the infected version
|
|
|
0:18:40 – 0:18:49
There were about 72,000 files. They're tiny, that's not much. So the whole page
|
|
|
0:18:49 – 0:18:59
It has about 1.2 gigabytes of data. But because there are so many
|
|
|
0:18:59 – 0:19:05
Files are, the download process is already a bit longer. Even if I have four
|
|
|
0:19:05 – 0:19:11
Downloaded at the same time, it takes time. And the same is true with the
|
|
|
0:19:11 – 0:19:18
Upload. I have a very fast internet connection, but it's a
|
|
|
0:19:18 – 0:19:30
The difference is if I download with 250 megabits now, but upload with 50. There's
|
|
|
0:19:30 – 0:19:33
That, of course, took a little longer. But now you have to say, I don't have
|
|
|
0:19:33 – 0:19:38
All uploaded again, but only the folder with the pictures. These were
|
|
|
0:19:38 – 0:19:44
Only about 20,000 files. Now you wonder how many pictures you have on
|
|
|
0:19:44 – 0:19:49
this side. Yes, each picture has several
|
|
|
0:19:49 – 0:19:52
Visions in different sizes because I
|
|
|
0:19:52 – 0:19:53
It doesn't have to be a huge file.
|
|
|
0:19:53 – 0:19:56
on the PC with a large
|
|
|
0:19:56 – 0:19:59
Monitor looks really great, but on
|
|
|
0:19:59 – 0:20:01
The cell phone is tiny. There I can
|
|
|
0:20:01 – 0:20:03
Take a small file too.
|
|
|
0:20:03 – 0:20:07
So I have at least four sizes of
|
|
|
0:20:07 – 0:20:09
every picture. And then there are the
|
|
|
0:20:09 – 0:20:14
thumbnails that are small somewhere,
|
|
|
0:20:14 – 0:20:21
and there and there and schubdiwupps you just have ten files from one picture. And so added
|
|
|
0:20:21 – 0:20:30
That's it. This blog, or podcast, has been around since 2018, since April 2018. In this
|
|
|
0:20:30 – 0:20:37
Period is approximately regular, sometimes weekly, sometimes two or three times in the
|
|
|
0:20:37 – 0:20:44
Week, something was posted where there were pictures in it. And that's how this amount comes about. Then
|
|
|
0:20:44 – 0:20:52
The site itself also has pictures. These thumbnails are still taken automatically,
|
|
|
0:20:52 – 0:21:01
So for the page where the images are displayed for the posts. So it's just one
|
|
|
0:21:01 – 0:21:06
Lots of pictures that are taken. These are all small files because they are
|
|
|
0:21:06 – 0:21:15
It's a very low resolution, but it's just files. So much for that. So you can see,
|
|
|
0:21:15 – 0:21:21
if you run your own website and are not a company where you work 24 hours a day
|
|
|
0:21:21 – 0:21:31
If you have any contacts, then when you wake up in the morning, you already have something neat,
|
|
|
0:21:31 – 0:21:40
What you can experience. I thank you for your attention and say goodbye, your Sasha.
|
|
|
0:21:40 – 0:21:43
[Music]
|
|
|
0:21:43 – 0:21:46
[Music]
|
|
|
0:21:46 – 0:21:52
[Music]
|
|
|
0:21:52 – 0:21:58
[Music]
|
|
|
0:21:58 – 0:22:04
[Music]
|
|
|
0:22:04 – 0:22:10
[Music]
|
|
|
0:22:10 – 0:22:13
[Music]
|
|
|
0:22:13 – 0:22:19
[Music]
|
|
|
0:22:19 – 0:22:25
[Music]
|
|
|
0:22:25 – 0:22:31
[Music]
|
|
|
0:22:31 – 0:22:37
[Music]
|
|
|
0:22:37 – 0:22:40
[Music]
|
|
|
0:22:40 – 0:22:46
[Music]
|
|
|
0:22:46 – 0:22:52
[Music]
|
|
|
0:22:52 – 0:22:58
[Music]
|
|
|
0:22:58 – 0:23:04
[Music]
|
|
|
0:23:04 – 0:23:07
[Music]
|
|
|
0:23:07 – 0:23:13
[Music]
|
|
|
0:23:13 – 0:23:19
[Music]
|
|
|
0:23:19 – 0:23:25
[Music]
|
|
|
0:23:25 – 0:23:31
[Music]
|
|
|
0:23:31 – 0:23:34
[Music]
|
|
|
0:23:34 – 0:23:40
[Music]
|
|
|
0:23:40 – 0:23:46
[Music]
|
|
|
0:23:46 – 0:23:52
[Music]
|
|
|
0:23:52 – 0:23:58
[Music]
|
|
|
0:23:58 – 0:24:01
[Music]
|
|
|
0:24:01 – 0:24:07
[Music]
|
|
|
0:24:07 – 0:24:13
[Music]
|
|
|
0:24:13 – 0:24:19
[Music]
|
|
|
0:24:19 – 0:24:25
[Music]
|
|
|
0:24:25 – 0:24:28
[Music]
|
|
|
0:24:28 – 0:24:35
[Music]
|
|
|
0:24:35 – 0:24:41
[Music]
|
|
|
0:24:41 – 0:24:48
[Music]
|
|
|
0:24:53 – 0:24:56
[Music]
|
|
|
0:24:56 – 0:25:02
[Music]
|
|
|
0:25:02 – 0:25:08
[Music]
|
|
|
0:25:08 – 0:25:14
[Music]
|
|
|
0:25:14 – 0:25:21
[Music]
|
|
|
0:25:21 – 0:25:24
[Music]
|
|
|
0:25:24 – 0:25:30
[Music]
|
|
|
0:25:30 – 0:25:36
[Music]
|
|
|
0:25:36 – 0:25:42
[Music]
|
|
|
0:25:42 – 0:25:48
[Music]
|
|
|
0:25:48 – 0:25:59
[Music]
|
|
|
0:25:59 – 0:26:01
[Music]
|
In this episode of The digression I'll tell you how my website looks like a Hack was affected – triggered by an Vulnerability the popular podcast plugin Podlove Publisher.
I take you on a journey through chaotic days full of troubleshooting, backups, new installations and the question: As a small operator, how do you deal with such an attack?
It is about:
- How I discovered the attack
- Why WordPress and plugins can be a security risk
- What Exactly Happened at the Podlove Gap
- My Steps to Rebuild the Site Cleanly
- What lessons I learned from this
A very personal episode about IT security, responsibility and the limits of software.
📖 To read on the LautFunk Blog
If you want to delve deeper into the details: On the According to Funk Blog I have extensively documented the entire incident surrounding the Podlove exploit. There you will find step-by-step explanations of what happened, how I noticed the attack and what measures I took to secure the site again.
👉 Click here for the article: LautFunk Blog - Podlove Exploit
🗂 thematic breakdown for The digression 61
- Intro & Welcome
– Presentation of the episode
– Brief review: “Intense days” - The Hack on LautFunk
– First indications: Server load and slow website
– Contact with the hoster - WordPress and Plugins
– What WordPress is and why it is so popular
– Strengths and weaknesses of plugins
– Example: Podlove Publisher - Vulnerability in Podlove
– Declaration: What happened?
– Automated attacks and backdoors
– How other websites were affected - My First Attempt at Salvation
– Insert backup
– Rapid re-infection - The clean way
– Reinstallation of WordPress
– Manually checking and uploading image folders
– Reinstalling the plugins - Contact the developer
– Exchange with Erik von Podlove
– Patch and fixed version
– Role of security organisations - Challenges in Reconstruction
– Amount of data (72,000 files)
– Upload and download times
– Technical barriers for individuals - Reflection & Learnings
– No system is really secure
– Communication of security gaps
– Responsibilities of developers vs. users - Outlook & Conclusion
– Lessons for podcasters and website operators
– Thanks to the listeners:
– Adoption
Links to the issue:
-
uberspace.de: "There is a security issues affecting Podlove Publ…" - Uberspace Mastodon
-
Podlove Podcast Publisher - WordPress plugin | WordPress.org
-
Blog Tool, Publishing Platform, and CMS – WordPress.org
Advertising:
Contributors to this episode
Sascha
Playing time: 0:26:02
Date of admission: 25.09.25
This episode is from season 4, there are a total of 4 seasons.
One According to Funk Publication Cartel Production - Where stories are transmitted unmistakably.
Podcast license:
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License
Note: This post contains affiliate links. If you shop through these links, I'll get a small commission at no extra cost to you.
English