| |||||||||||||
|
| |||||||||||||
WordPress 2.1.1 contained a trojan horseWordPress 2.1.1 contained a trojan horsePosted Mar 4, 2007 11:34 UTC (Sun) by rickmoen (subscriber, #6943)In reply to: WordPress 2.1.1 contained a trojan horse by miah Parent article: WordPress 2.1.1 contained a trojan horse "miah" wrote: This is why checksums should also be accompanied by a cryptographic signature. Exactly so. Note that the main download page doesn't even offer the md5sum, only a tarball or Zip archive. The separate archive page lets you get the md5sums, but you're given no means of verifying their validity; evidently, the developers aren't bothering to sign their releases. This is the reason why Web apps have been the low-hanging-fruit *ix intrusion vector of choice (aside from phishing and theft of security tokens on compromised hosts) over the last few years -- and why admins should be super-careful about anything they install from upstream tarballs. Rick Moen
(Log in to post comments)
|
|
||||||||||||