Leave It Alone, and You Become the Gun

For once, an email from YOOtheme was worth opening.

Normally they announce new features or sales, and I have to admit I do not read them very carefully. This one had a different subject line: an important security update. Inside it said that serious vulnerabilities had been found in both ZOO and YOOtheme Pro, and that we should update immediately.

I have already applied the updates. So this is not really a report about that. It is about what I found myself thinking while I applied them.

What actually happened

ZOO is a content construction kit for Joomla, installed under the name com_zoo. The worst of the flaws found this time required no login and no account at all: an attacker could send a file from outside and have the server run it. The severity score was the maximum. Maximum means there is no way to make it worse, and that is not a score handed out often.

The YOOtheme Pro side was narrower. Two flaws, both exploitable by users who already have permission to create articles or drafts. The email said so honestly: if you have no untrusted users of that kind, there is no need to rush. For a site that does not open registration to the public, this is the category you can take at a normal pace.

The details are all published under CVE numbers, and searching for them turns up plenty. If you are curious, follow the trail yourself. You will find that a surprising number of people explain it clearly.

What changed is not the danger. It is the speed

Here is what actually caught my attention: not the vulnerabilities, but the way the fixes came out.

Version 4.1.64 was released, and one hour later came 4.1.65. Within a few days it had reached 4.1.66.

In other words, "we fixed it, except we had not quite fixed it" happened in public, twice in a row. I have no interest in blaming anyone for that. Publishing openly and repeatedly is the right thing to do. But from the user's side, the meaning changes.

Updating used to be an errand. Something you remembered once a month, opened the admin panel for, and got on with your life. Now it is closer to being on call. The update you applied today can be stale tomorrow. Perfect safety was never guaranteed, and that part has not changed at all. What has changed is how long you get to stay safe.

The gap between disclosure and mass scanning has closed

There is something else I have seen with my own eyes.

Some time ago, a critical hole was found in another page builder extension. Within days, scanners appeared in my access logs that openly named that exploit in their user agent string. From the moment it was published to the moment those scanners started sweeping the world, there was almost no gap at all.

It used to take a while. Once a vulnerability was disclosed, somebody with real skill had to sit down and write the attack tool, and that took time. Now, given a published write-up, building the tool has become considerably easier. There is no shortage of clever machinery in the world these days.

So the grace period is gone. The few days between the update notice arriving and you actually applying it are not the safe few days they used to be.

A compromised site does not stay a victim

Everything so far is about damage to yourself. But the part I most wanted to write down comes after that.

My server gets visitors I never invited, every single day. They look for admin panels that do not exist, request files I never put there, and type in the names of extensions I have never installed. As a number, a few percent of the day's requests are of that kind.

So where do those requests come from?

Some of them, certainly, run on machines the professionals set up themselves. But a fair share of them are almost certainly somebody's forgotten site. Built three years ago, updates stopped, the domain still quietly renewing. The owner has no idea it was ever broken into. And a small program left behind on it is out there hammering the world, looking for the next target.

An abandoned site becomes a relay for spam, a container for phishing, and a scout looking for the next victim. It does not stay a victim itself. Without ever noticing, it has moved over to the other side.

Some of those addresses in my logs are, I suspect, the remains of sites somebody let go of.

Leave it alone, and you become the gun.

So should amateurs stay out of it?

Quite the opposite.

I believe you should own the place you stand on. If you only ever sit on somebody else's flat ground, then the day the terms change, all of it disappears. So I rent my own server, build it myself, and fix it myself. I have no intention of changing that view.

But if you are going to keep doing it, there are conditions. And they are not conditions of knowledge.

One. Do not keep things you are not using. ZOO this time is exactly that case: something people did not even remember installing turned out to be the hole that handed over full control. An extension you tried once, did not like, and left sitting there. Look down the list in your admin panel and read every name. If there is one whose purpose you cannot state out loud, you can remove it. The reason to keep something is that you use it, not that it still runs.

Two. Make sure the news reaches you. I found out about this from an email. If I had changed my address and never fixed the registration, I would still not know. For paid extensions it is the subscription period; for free ones it is wherever the developer posts. You should be able to say, without checking, where you would learn that a new version exists.

Three. Be able to undo it. The reason applying an update feels frightening is that failing feels frightening. If you know you can roll back, you can apply it the same day. A backup protects you against accidents, but it is also the tool that lets you update without hesitating.

None of the three requires deep knowledge. What they require is carrying less, and deciding your procedure in advance.

Carry less

In the end, perhaps that is all I am trying to say.

The more you have to protect, the less you can protect it. A site with fifteen extensions installed has fifteen water pipes running through it, and if any one of them splits, you get wet. Very few people can understand all fifteen. So the fastest move is to reduce the number of pipes.

Safety is not about becoming an expert. It is about carrying fewer things. That is what I took away from this.

I once wrote here that having no money is not a security strategy: the idea that nobody bothers with small sites is an illusion. This is the sequel to that one. Without noticing it, you can end up being the one doing the shooting.

Owning a site means accepting that responsibility too. And I still choose to own one.