Why hackers LOVE open source CMS

The source code for open-source software is available (under license) for anyone to use, which has plenty of advantages when compared to proprietary alternatives. It’s inexpensive (if not free), there’s ample support available through thriving online communities, it’s transparent, it’s reliable (because so many people are keeping an eye on it,) and there’s no lock-in.

Open-source software gives you the power of the crowd. But, the crowd is made up of both good and bad actors. Inspecting the source code of open-source CMSs for security defects has become big business, and the leading players in this industry can be split into two groups:

1. ‘White Hat’ hackers

White-hat hackers are paid handsomely for preventing damaging security exploits (a security exploit is just another term for a security vulnerability.) They do so by finding and secretly reporting exploits to software creators. WordPress offers a “Bug Bounty” of thousands of dollars to those who report significant security bugs, which has helped turn the color of many a hacker’s hat from black to white.

Once reported, software creators develop a solution to the exploit, consulting with the hacker to make sure it can’t be worked around. If the solution’s successful, an update to the software is released, and the public’s notified that their system needs to be updated immediately.

But, despite these steps taken by white-hat hackers to keep the public safe, a large proportion of open-source software users don’t actually apply the updates, which means their systems can easily be compromised.

2. ‘Black-Hat’ hackers

Black-hat hackers sell the exploits they find on the black market, rather than reporting them to software creators. With millions of websites built on open-source platforms such as WordPress (which powers more than 30% of the web) these exploits are like gold dust in the wrong hands.

One of the favored techniques of black-hat hackers everywhere is called “Google hacking.” When Google crawls websites, it unintentionally, but unavoidably, indexes the identity and version of every site’s CMS. Hackers then use this information to create vast lists of sites running outdated CMS versions, along with their specific vulnerabilities (there are currently 5,000 entries in the Google Hacking Database.)

With ready-made exploits freely available online for most vulnerabilities (here are the listings for WordPress and Drupal,) it’s all-too-easy for anybody with a shred of hacking experience to do severe damage to listed businesses. So, maintain your systems with the latest security patches.