I haven’t blogged in a while because I’m busy studying (yes, studying) for my OSCP certification.

But what happened over the week, was just to mind-blowingly stupid to ignore.

Here's what happened....

Most gamers brushed off the game as a lousy game wrapped in a theatrical package, but the media picked up the story and the game garnered more publicity than was warranted. So much publicity, that the Malaysian government decided to take action, but how do you take action against a game developer in Taiwan?

The fact that this RM2 company manage to raise RM500 million should be news enough, but claims that it lost all it’s money to ‘hackers’ is too hilarious for me to ignore.

If you haven’t heard, a get-rich-quick scheme called JJPTR, claimed it lost RM500 million to hackers, which even with today’s depreciating ringgit would exceed a value of USD100 million. For perspective, the hackers who hacked into the Bangladeshi central bank, pocketed ‘just’ over USD60 million.

WordPress sites get hacked all the time, because the typical WordPress blogger install 100’s of shitty plugins and rarely updates their site. On the one hand, it’s great that WordPress has empowered so many people to begin blogging without requiring the ‘hard’ technical skills, on the other it just gives criminals a large number of potential victims.

Two years ago, when I studied the details of phishing attacks that targeted Maybank and RHB, I found that attackers use compromised WordPress sites to host their phishing content. They’d first hack into a seemingly random WordPress website, host their phishing content there, and then blast out emails to unsuspecting victims with links to pointing back to their hacked bounty. If the hack works they’d get free username and passwords, and if they were ever caught, most evidence would point to the unsuspecting Wordpress site owner.

So if you have a WordPress site (like me), chances are you’re in the cross-hairs of hackers already, and securing your site is the responsible thing to do.

In general Wordpress sites should be:

• Updated Automatically
• Use a minimal number of plugins
• Use plugins only from reputable publishers
• Use themes only from reputable publishers--and have only one theme in the install directory
• Employ strong passwords for the admin & user
• Have the permissions of the underlying folders set accordingly (i.e.CHMOD them all)

Today, I’ll walk through a short bash script I wrote to backup (and restore) a WordPress installation from scratch. It took me quite a while to write this (partly because I have no experience with Bash scripts), but I thought it would be good to walkthrough the details of the script and what it does.

The full script is available on github here, and the usage instructions will be maintained there. The write-up below describes code the first production release, linked here, even though I’ve since updated the scripts to include some modifications, and as we speak I’m just about the release version 1.2.

So here we go…

Special Thanks

Thanks to Andrea Fabrizi for the awesome DropboxUploader script Thanks to Ben Kulbertis for the awesome Cloudflare update script Thanks to Peteris.Rocks for inspiring me with his Unattended WordPress Installation script

Pre-Requisites

The back ups would be stored in DropBox– Dropbox has free options (up to 2GB) and has versioning by default.All your backups are versioned and kept for 30 days (not just the latest upload, which gets destroyed if you’re hit by malware). Doing this on AWS requires extra work, which I wasn’t prepared to do, and AWS has no free tier for S3 storage.

Also, I use CloudFlare to maintain the DNS. It’s optional of course, but I needed a DNS provider that had an API, and they were the logical choice. This allowed the script to update your DNS as well.

Finally, the script assumes a standard LAMP stack, i.e. Linux (specifically Ubuntu 16.04), Apache , MySql and PHP. PHP is enforced by Wordpress itself so that’s fine.But the ’trend’ these days is to have NGINX instead of Apache, and MariaDB instead of MySQL. I kept things in ‘classic’ mode for now, I may revisit in the future.

On the 1st of February, Malaysians experienced yet another fuel price increase. Which was surprising because the price of oil and the ringgit conversion rate seemed to be favoring a drop. You see in Malaysia, the fuel prices are controlled and subsidized by the government, and it sets the price for petrol at the pump.

In the past, fuel price changes were few and far between, but since 2007, they’ve become a more common occurrence to help the government cope with the erratic pricing of oil. Eventually, a floating price mechanism was introduced, where the government would set the price of fuel on the 1st of every month, and only on the first of each month.

Customers of Singaporean ISP StarHub, suffered two major disruptions to their service over the past week, in what the telco said was a result of a “intentional and likely malicious distributed denial-of-service (DDoS) attacks”.

Oh the humanity!!

In what appears to be a copycat of the Dyn attack we saw (at roughly the same time), the attack signals the first local salvo in the war of IOT devices. But is it really that serious?

If you’re wondering what the hell happened, let’s walk this through step-by-step, from the attackers perspective.

Jais recently launched anew mobile app to allow the public to easily report any crimes that contravene syariah laws.

Obviously there’s social and legal implications here, which I won’t go into, but we need to understand just how stupid this idea is.

When you ask amateurs to give you security, what you eventually end up with is amateur security.

It’s the reason why Maths professors from Ivy league universities are wrongly profiled as terrorist, or why breast milk is incorrectly identified as explosive substances on planes, why it doesn’t take an evil genius to break into your gated and guarded housing project. Security is hard, and if you entrust into the hands of amateurs, things don’t end well.

Is it wise to use an online password manager? After all, putting your passwords on the cloud seems like a really dumb idea.

But I use password manager because while storing stuff on the cloud may present risk, it’s far riskier and dumber to re-use passwords.

Why you need a password manager?

Most people downplay the risk of this happening, ebcause they think they’re not rich enough, or famous enough to be the target of hackers. But in an era, where hacks compromise millions of accounts, and hackers can automate exploits to run on cheap cloud servers from Amazon–you’d be surprise what hackers consider a worthwhile target.

But how do hackers get your password?

On occassion they actually guess it, ala ‘the fappenning’, but more commonly they get your passwords by hacking other services. Shockingly, sometimes the easiest way to get your Google password is to hack dodgy forums, and insecure chat rooms that litter the internet.

You’ve probably heard of the hackers who almost got away with $1 billion, only to be thwarted by a typo. (if it weren’t for those meddling keyboards!)

What you probably didn’t hear was that they had already wired $100 million to themselves, are assumed to have pocketed anywhere from $21 million to $81 million in cold hard cash.

Sure, Billions is more than millions, but one a single hack that returns $21 million is a good pay-day by anyone’s standards.

A republication of my article on 2600, a hacker magazine

Greetings from Malaysia.

This is my first time writing to 2600, although I’ve been a kindle subscriber for more than 2 years now.

For my first article, I hoped to write about a little hacking expedition I embarked on a couple of months back to help me improve my coding skills as well as help me learn more about local internet users.

If you haven’t listened to it already, here’s a fantastic cut-down (no bullshit) version of Jim Comey’s testimony to congress, on why he recommended Hillary Clinton not be prosecuted for hosting her own e-mail servers.

For the uninitiated, while Hillary Clinton was US Secretary of State, she hosted her own official e-mail servers, and the contention was whether she was right in hosting a service that would handle classified e-mails in the basement of her house.