Detecting Malware Hidden in a Fake JPEG in WordPress BackupsDetecting Malware Hidden in a Fake JPEG in WordPress Backups
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Malware in a WordPress backup, disguised as a photo A client wanted me to restore a WordPress site from a zip backup and asked for one thing before paying: a screenshot of the site running on my own computer, with localhost in the address bar.
Loading a WordPress site runs its PHP on whatever machine serves it. So I read the zip with a script first and didn't extract it.
WordPress core matched the official checksums. In wp-content/mu-plugins, though, there was a file that looked for a 4.6 MB "JPEG" in uploads, renamed it to .exe and tried nine ways to launch it. The first two bytes of that "JPEG" were MZ, which is how a Windows executable starts. Opening localhost for the screenshot would have been enough to run it.
My first script missed it because it trusted file extensions. Now it reads the first bytes of every file.
The write-up has the loader code and the checks I now run before importing a backup I didn't make. If the same file reached you, the SHA-256 hashes are at the end. https://helban.dev/en/case-studies/fake-wordpress-backup-malware/
Post image
Akib's avatar
The MZ check is such a good catch. Worth adding for anyone restoring sites: mu-plugins run on every request and can't be switched off from the dashboard, so they're a favourite hiding spot. Did the client ever reply after you flagged it?
Adam's avatar
Thanks. I never wrote back to them. I reported the account to Upwork instead. The flag got a template reply saying there was no violation, so I went through support chat and reached a person. Later that day the job was gone and the account was banned. Upwork's security team...
Akib's avatar
Good on you for pushing past the template reply. That probably saved the next person who picked up that job. And that's a great point about the plugin list: nothing changes in the database, so the Plugins screen looks clean. A quick look inside mu-plugins is going on my restore checklist.
Back to feed
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started