HTTPS Everywhere website with insecurity!

Viruses and worms
1

See: https://www.eff.org/https-everywhere/atlas/domains/lingospot.com.html
See: http://toolbar.netcraft.com/site_report?url=http://corp.lingospot.com
Certificate is not installed correctly
corp.lingospot.com
You have 1 error
Wrong certificate installed.
The domain name does not match the certificate common name or SAN.
Warnings
BEAST
The BEAST attack is not mitigated on this server.
RSA remove cross certificates
The certificate chain contains a cross root (primary intermediate) certificate that should be removed. Use Symantec CryptoReport to remove cross root certificates.
Certificate information
This server uses a Domain Validated (DV) certificate. No information about the site owner has been validated. Data is protected, but exchanging personal or financial information is not recommended.
Common name:
*.wpengine.com
SAN:
*.wpengine.com, wpengine.com
Valid from:
2014-Nov-03 01:44:06 GMT
Valid to:
2018-May-19 22:01:42 GMT
Certificate status:
Valid
Revocation check method:
OCSP
Organization:

Organizational unit:
Domain Control Validated - RapidSSL(R),See www.rapidssl.com/resources/cps (c)14,GT41552380
City/locality:

State/province:

Country:

Certificate Transparency:
Not Enabled
Serial number:
6d2a
Algorithm type:
SHA256withRSA
Key size:
2048
Certificate chainShow details
GeoTrust Global CAIntermediate certificate
RapidSSL SHA256 CA - G3Intermediate certificate
*.wpengine.comTested certificate

See: https://seomon.com/domain/corp.lingospot.com/

Outdated WordPress plug-ins: WordPress Plugins
The following plugins were detected by reading the HTML source of the WordPress sites front page.

anti-spam 3.3 latest release (4.2) Update required
http://wordpress.org/plugins/anti-spam/
digg-digg 5.3.6 latest release (5.3.6)
http://bufferapp.com/diggdigg
contact-form-7 4.0.3 latest release (4.4.1) Update required
http://contactform7.com/
jquery-updater 2.1.1 latest release (2.2.3) Update required
http://www.ramoonus.nl/wordpress/jquery-updater/
wordpress-seo 1.7.1 latest release (3.1.2) Update required
https://yoast.com/wordpress/plugins/seo/
LayerSlider
OptinSkin
wp-responsive-thumbnail-slider latest release (1.0)
http://www.i13websolution.com/wordpress-responsive-thumbnail-slider-pro.html
Plugins are a source of many security vulnerabilities within WordPress installations, always keep them updated to the latest version available and check the developers plugin page for information about security related updates and fixes.

Warning User Enumeration is possible :o
The first two user ID’s were tested to determine if user enumeration is possible.

ID User Login
1 wpengine wpengine
2 lingo2013 lingo2013
It is recommended to rename the admin user account to reduce the chance of brute force attacks occurring. As this will reduce the chance of automated password attackers gaining access. However it is important to understand that if the author archives are enabled it is usually possible to enumerate all users within a WordPress installation.

jQuery libraries to be retired - zip-file for later reference.
-http://corp.lingospot.com/
Detected libraries:
jquery - 2.1.1 :- http://e9ihb178w0g3u971p270sjeb.wpengine.netdna-cdn.com/wp-content/plugins/jquery-updater/js/jquery-2.1.1.min.js?ver=2.1.1
jquery-migrate - 1.2.1 : -http://e9ihb178w0g3u971p270sjeb.wpengine.netdna-cdn.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1
Info: Severity: medium
http://bugs.jquery.com/ticket/11290
http://research.insecurelabs.org/jquery/test/
1 vulnerable library detected

Stingray Traffic Manager XSS exploit: http://seclists.org/fulldisclosure/2014/Aug/41
http://www.domxssscanner.com/scan?url=http%3A%2F%2Foptinskin.com%2Fsrc%2Fmin%2Foptin1.min.js%3Fver%3D4.3.3

Also check: http://www.domxssscanner.com/scan?url=http%3A%2F%2Fe9ihb178w0g3u971p270sjeb.wpengine.netdna-cdn.com%2Fwp-includes%2Fjs%2Fjquery%2Fjquery-migrate.min.js%3Fver%3D1.2.1

polonus (volunteer website security analyst and website error-hunter)

2

No user enumeration or Indexing enabled on my site :stuck_out_tongue:

Only security plugins so far.

But its sad to see sso many WP sites with dated stuff, but why do they have a built-in updater then?

3

Hi Steven Winderlich,

It explains that many do not know how to properly configure WordPress. Not keeping themes or plug-ins updated is one of the biggest security risks. And what if the developer of the code has left the code, then you can just sit and wait for the code to turn vulnerable over time.
Another reason is that many coders that should know how to securely code, were not and still are not trained properly with security in mind.

Slowly there is more focus on securing code, while on the other hand there are ‘forces’ trying to undermine and weaken these efforts for their own (commercial and surveillance) ends.

Implementing http everywhere with Let’s Encrypt ‘toy’ certificates for WordPress websites is such an example. Now we can no longer discern between real safe non-ev certificate and the just slightly better as self-signed “LetsEncrypt” one :o. The only advantage is that those that were unaware enough to leave User Enumeration enabled in the settings, can now log-on a little bit safer.

I won’t discuss security headers, SRI hashes, inline scripting (yes, even google coders code CSS and JS inline!).

So will the days of true security online ever arrive? I doubt we will see them arrive soon.

polonus