Incident Response for Malware Attack via qTranslate

Rapid Response

Thorough Malware Containment and Remediation

SEIRIM deployed a thourough and rapid incident response process for our client to identify, contain, eradicate and recover from a powerful and persistent malware infestation caused by unpatched vulnerabilities in their website's language translation program. 

 

Due to extenuating factors, the process had unfortunate complexities, but provided valuable lessons learned and in the end full recovery was achieved.

PROJECT AIMS

Objectives

Identify the Vulnerability and Malware Infection

Our first step was to perform a thorough assessment of the client’s WordPress website. Through our vulnerability scan, we identified that the outdated qTranslate plugin was the primary source of a security vulnerability, allowing malware to infiltrate the site. We detected malicious code hidden in the plugin files, which had given cybercriminals unauthorized access to the website.

Remove the Vulnerable qTranslate Plugin

After confirming the vulnerability, we immediately removed the qTranslate plugin from the website. This action was necessary to eliminate the opening that had been exploited by the attackers. During the removal process, we also ensured that any associated files or configurations left behind by the plugin were fully cleaned to prevent future exploitation.

Clean the Malware and Restore Website Integrity

Once the plugin was removed, we carried out an in-depth malware cleaning process. We scanned the entire website for hidden malicious code and backdoors that had been introduced through the plugin. Any traces of the infection were fully eradicated with a complete wipe of the server, and a restoration of the website from a backup plus rebuild to a newly more secure state to ensure no malware remained in the system.

Update and Patch WordPress and Other Plugins

To prevent further security issues, we ensured that the client’s WordPress installation and all remaining plugins were up to date. We patched any outdated software to close security loopholes and eliminate the risk of similar vulnerabilities arising in the future. This included updating both core WordPress files and non-vulnerable plugins, ensuring the site was equipped with the latest security enhancements.

Install a Secure and Compatible Translation Plugin

As part of the remediation process, we installed a more secure, compatible translation plugin to replace qTranslate. We selected a well-supported and frequently updated plugin, Polylang Pro, that met the client’s multilingual needs without compromising website security. This new plugin was thoroughly tested to ensure it wouldn’t introduce vulnerabilities or conflicts into the site.

Implement Continuous Monitoring and Security Hardening

To ensure the ongoing protection of the client’s website, we implemented continuous monitoring and security hardening measures. This included setting up a web application firewall (WAF) from Imunify360 to block malicious traffic, monitoring for suspicious activity, and configuring automated vulnerability scans. We also provided the client with guidance on best practices for maintaining site security and staying vigilant against future threats.

Precision Impacts

The Results

First Scan Awareness
High and Medium Level Issues
High level vulnerability
Confirm Malware in the code
Confirm Malware matching
Malware in the Code
Crosssite Scripting Detailed
qTranslate Crosssite Scripting Detail
Impacts List
qTranslate Alternatives
Lessons Learned

Quick Action and More Vigilance Going Forward

WordPress plugins can present significant vulnerabilities if they are not regularly updated or properly managed.

 

As part of our remediation efforts, we implemented essential updates and patches to both the WordPress core and the remaining plugins. This was done not only to eliminate the immediate vulnerabilities but also to ensure that the site was protected against future exploits. Updating software and keeping systems current is a basic yet often overlooked security measure. It was clear from this case that security is an ongoing process, and regular patching and updating are key to preventing similar vulnerabilities.