Last week the Australian government released a technical report explaining that there has been a large-scale global exploitation campaign targeting website content management systems such as WordPress, which many Australian small businesses use.

If you have a business website in Australia, there’s a high likelihood that it has been targeted by a sophisticated scheme by international parties to harvest your data, and the data you hold of your customers.

In some cases, they will have succeeded.

What does this mean for Australian website owners?

According to the ACSC Cyber Security and Australian Small Businesses 2023 report (link):

Australian businesses face increasingly sophisticated and capable cybercriminals targeting what matters most to them; their money, data and reputation.

If you’re affected, it means you and your customers may have had their personal data taken by foreign scammers, spammers, and otherwise unscrupulous fellows. They may get targeted by these people using various scams, which are becoming increasingly sophisticated.

Your website’s records can be immediately copied to anywhere in the world and dissected, sold, or worse.

How could this happen?

If you’re not familiar, a content management system (CMS) includes a portal that allows administrator users access to the nuts and bolts of a website.

Not only can one do the normal things we might expect to do under the hood of a website, such as editing a page or article’s contents, it can also include integrations to other aspects of the business.

These integrations can get very personal very quickly. The initial communications between a business website and its eventual customers, which is usually handled by a contact form being submitted, is often storing this data – sometimes for months, sometimes for years, sometimes forever.

But not only that – for an ecommerce store, customer purchases are usually stored there indefinitely. Also, it usually tracks product inventories.

What does this mean for web developers and website hosting businesses?

If you’re in charge of hosting or managing websites and any of them have been infected, it’s your first and foremost responsibility to fix the issue – without trying to upsell services during a disaster – and then to accurately and comprehensively report the incident to all involved parties.

The discussion around payments can come later, if at all, because first you need to rebuild all of the trust you’ve just lost.

First steps if you detect that your website has been infected

Get your friendly web developer to confirm whether any of your websites or servers have been affected. Generally, they will follow these rules:

1. Inspect the CMS for evidence of foul play, such as:
   • Any unknown users in the content management system with administrator access
     • Many of them intentionally use innocuous names like “admin” or “backup”
   • New plugins created in the directory that shouldn’t be there
     • Many of them, however, will intentionally hide or delete themselves after execution, so you may only be able to tell based on the folder’s last modified date
   • Executable scripts in the uploaded content directory
     • Many exploitations start by allowing for certain types of files that can then be used to execute code remotely
2. Once a website content management system has been identified as compromised, immediately start writing an incident report and log when, how, and by whom the malicious entity was discovered, as well as the steps taken to mitigate the issue
   • Your firm should ideally have an incident report template or process, so that should be followed
3. Treat servers with identified tampering as compromised, then isolate it and audit the network log
   • In this process, if possible for recording-keeping, you want to ideally grab the offending IP address and exact time the connections and attempts were made
4. Restore the site to the most recent “known-good” backup

Once the website has been restored to a good state, all contained software + plugins must be updated before bringing the site back online.

The website then needs to be monitored to ensure that the exploit does not continue – as they often include multiple insidious ways of reinstalling themselves even after the website has been “cleansed”. If this happens, the entire entity will need to be completely removed and reconstructed as a brand new site – this can be very tedious but it’s the only way you can make sure it’s clean.

What should Australian business website owners do?

In my opinion, we should all be honest about what happened.

This issue happened because these exploits targeted known software vulnerabilities, and in most cases there were patches publicly available.

Ultimately, this was caused by an extended lapse in judgment.

So who is to blame for the business website vulnerabilities?

It’s not always productive to play the blame game, but it does need to be investigated and understood by all parties. This is not intended to punish anyone, but to be used as an area for finding the truth, and learning from our mistakes.

If you pay for website hosting with maintenance and support, and your business website was still compromised – it is clear whose fault it was. But what if you’re paying for quarterly maintenance – where the website gets updated once every 3 months, and the exploit happened within that period of time? Then it’s not so clear-cut.

Regardless, if you pay for website hosting and your business website was compromised, you should be having a frank discussion with your website management folk about precisely what data could have been stolen, and what steps have been taken to document and mitigate the issue, and what steps are being taken to prevent it from happening again in the future.

If your web host offered maintenance plans as an optional service and your business decided to self-manage website security, then you are both to blame – firstly, the business owners who decided to forego website security to cut on costs, but secondly the developers and hosts who knowingly let their customers host websites on their own infrastructure without continuously applying updates, allowing them to be exploited.

How to fix the issue when our customers’ personal data has been stolen

The moment your business website has been infected, the deed is done – the exploiter is immediately able to make a full copy of the entire site to download and recreate offline, so you’ll never know which parts have or have not been accessed.

So all we can do then is help our customers by reaching out and telling them the truth about what happened – telling them what you currently know, and what you’re doing about it. And eventually they may begin to trust us again.

Your customers need to know that, despite the circumstances, you do take their privacy seriously and are actively working to regain their trust.

Apologise, and actually mean it.

Own it, learn from it, and make sure it doesn’t happen again.

What to do if no customer data has been compromised

Even if your website has not been infected, you can craft a message to your customers letting them know that your company or employees will never ask for bank details or your credit card number online.

Every few months, it’s worth sending a message or two like this as a security heartbeat, of sorts. And the more often it’s done, the more normal and less surprising it feels.

What to do about potential website vulnerabilities, going forward

There’s no single definitive answer about what is best for business website vulnerability mitigation, but there are some general trends one should follow:

• Live website software should be set to automatically update
  • If that’s not possible, it should at least follow a weekly, rather than monthly or quarterly, plugin update cycle
• Monitor or block the ability to create files in the execution environment
  • Making live-accessible directories read-only
  • If there needs to be a process for getting plugins installed on a website, consider adopting a formal process for this
• Restrict the amount of users with full access – provide lower levels of access for non-essential users
• Regularly reset passwords, and use a dedicated password manager
• Consider adopting more cloud services where it makes sense – for instance, the form processor doesn’t need to happen within the website, but can be handled using an external service
• Rethink your customer data retention policy – if your website does not need to keep their data for months or years, then make it automatically regularly purge itself of all unnecessary information

If you are currently, or know anyone currency experiencing a mass-scale website vulnerability, please contact us for a free website security audit and we’ll see how we can help.