Attacking WordPress
The best part about this presentation, aside from the scrollable slides, is that it <i>didn't break the back button</i>. :-)<p>I think it's a nice high level intro to exactly how easy it is to exploit an un-patched site. Obviously not ground breaking, but a nice intro nonetheless.<p>I think the key takeaway is, assume anything on or near your Wordpress is compromised. Because the attackers have IP maps of pretty much every Wordpress site, what versions, and what plugins they are running, so the moment an exploit is published their botnets will be attacking you within minutes. This already happened to Drupal and no reason to expect it's not happening to Wordpress as well.<p>The best defense is not storing anything which is not already public on the server, and a single-click restore feature which should be used liberally anytime a priv-escalating exploit is patched. (assume you were compromised, even in the absence of any logs indicating that you were)