Announcing Gravityscan
Today the Wordfence team has a big announcement. We are launching Gravityscan.com, a completely free vulnerability and malware scanner. You can use Gravityscan to find out if your website has been hacked and if you have any security problems that may lead to a hack in future.
The full announcement is on the Gravityscan blog.
I would encourage you to run a scan on your website now. Whether you run WordPress, Joomla, Drupal, Magento, vBulletin or any other platform, Gravityscan performs a thorough vulnerability and malware scan on your site in just a few minutes with real-time updates as the scan progresses.
Gravityscan also works seamlessly with Wordfence and is an excellent addition to your suite of security products if you are already using Wordfence or Wordfence Premium to protect your WordPress website. You can read more about how well Gravityscan complements Wordfence on this page.
Mark Maunder – Wordfence Founder & CEO
Comments
8:19 am
Hi, just a heads up, I got this error when trying to have it scan my site: https://www.dropbox.com/s/ki1lnycav043kp0/chrome_2017-05-16_08-17-13.png?dl=0
8:22 am
Thanks very much Cliff. Just chatted to the QA team. We did test with .tech .info and a few other gTLD's but we must have an issue with that one. Also just got word that .work appears to be working. So we'll get this fixed asap.
Mark.
10:35 am
I tried every single verification method and it refuses to verify site ownership for me. Not sure what im doing wrong.
12:00 pm
Hi Daniel,
Please contact support using the contact page on Gravity. Thanks.
10:41 am
Great tool! I have an issue: WordPress 2.3-4.7.4 - Host Header Injection in Password Reset
Am I able to block access to the URL in the scan result?
12:27 pm
You don't need to. Please see my reply to another commenter here regarding this exploit.
6:48 am
Great, thanks.
10:44 am
Why is it picking up errors that WF should have detected?
11:55 am
Hi Iain,
Can you provide more detail?
Thanks.
11:02 am
Hey Mark,
I went to the site and did a scan of my site via the free scan and it just sat there. It didn't do anything. I know this is a launch and may be some quirky things that will happen, which is natural for a first day launch. Very excited about this new tool and looking forward to using it.
11:03 am
Scratch that... just tried it again and it is working now.
11:53 am
Thanks. Yup, the guys chased off the gremlins and everything is running smoothly now.
11:53 am
Thanks. Yup, we had a few quirks this morning. We had a large number of scans (4 digits) running concurrently and needed to adjust our config to compensate. The results was that for about an hour users may have seen 'waiting for scanner' for a few minutes before scans started.
It's fixed now. Thanks for the feedback.
11:44 am
Any effort to improve web safety is a an effort well made. Thank you very much!
I noticed a double entry on the first 2 entires in scan results, possibly by starting (but not finishing) the scan in guest mode before sign-up and verification?
Also, the WP 0-day reported is worrying. Does (free) Wordfence provide any mitigations for it?
11:54 am
Hi Tanel,
You probably received a duplicate entry because we made a config change this morning which required that we reboot our scan workers. That resulted in your scan job being resubmitted to the queue which can produce duplicate results. It's fixed now and you can just ignore that duplicate.
I've pinged the Wordfence QA team about the 0day and should have an answer shortly.
Mark.
12:26 pm
Hi Tanel,
So this may surprise you but we've made the conscious decision to not release a firewall rule to protect against that particular exploit. The exploit is an edge case and almost impossible to exploit. The firewall rule for this exploit may result in false positives.
This is the proof of concept:
https://exploitbox.io/vuln/WordPress-Exploit-4-7-Unauth-Password-Reset-0day-CVE-2017-8295.html
The exploit requires that an attacker cause the password reset email to bounce, and that bounce will return to a malicious address. That means an attacker needs to fill up your email inbox somehow, hope that you are automatically cc'ing the return address (why would you do that?) for password reset emails or that you reply to a password reset email. (Again, why would you ever reply to a password reset email)
So it's a theoretical attack which is low priority and can only be exploited under very specific conditions and in rare cases. I'd challenge anyone to try to fill up a gmail inbox remotely. Gmail spam filtering will just start black-holing your emails.
Hope that helps.
Mark.
12:20 pm
Not working for me. When I hover over the scan button there a little icon appears that and won't let me click.
12:29 pm
Thanks. Can you send us a screenshot?
9:40 am
Here is a link to the screen shot.
http://irockproperties.com/wp-content/uploads/2017/05/gravity-scan-e1495211906817.jpg
12:36 pm
Hi,
I chatted to our devs. It's likely you're getting a javascript error. If you use Chrome, please click on View > Developer > Javascript Console. Send us any error that appears in there.
Thanks.
Mark.
9:41 am
Actually I tried on, IE, Firefox and Chrome was the same on all three.
10:08 am
Hi Mark,
Here is an update.
I brought up the java console on Chrome via ctrl + shirt J and did not see any errors, however after I did that the issue resolved itself and I was able to click through on the scan button.
I did the same in IE and that cleared IE as well.
This process did not work in Firefox. Here is the java console report on firefox:
http://irockproperties.com/wp-content/uploads/2017/05/gravity-scan-jconsole-firefox.jpg
9:24 pm
Thank you, I've shared this with the QA team.
12:44 pm
I manage sites for about 18 clients, do I need to set up separate GravityScan accounts for each one? I just started with one client and created new login for him, though he has not received confirmation message or any next steps, it's been about 30 minutes.
Also, tried sending copy of report via your email dialog, it said "Sending" for a long time, and then error of Adapter Error showed up on screen.
12:46 pm
Hi Liz,
You can bulk import sites via Google Analytics which should make things much easier!
Thanks for the bug report about sending the report copy. I'm filing that now.
Mark.
1:10 pm
Hi Mark,
Just an observation on friction from someone who just arrived to the site and wanted a quick test.
Both urls I entered just say "This domain must be verified before starting a scan." and nothing else happens. This is terrible FTUE and will likely result in many people dropping off right away at that point.
Why even offer a url box if you need to verify first as if you can scan any site by just going to the page? At least without any instructions about how to verify, what to do next, etc.
I realize you probably need to sign up, verify each site, then run scans, but I'm just trying to help you view this situation through the eyes of a first-time visitor.
11:00 pm
Thanks Artem. Your site receives higher traffic than normal. We have identified sites like that and have set gravityscan up so that you have to prove you own those sites before you can scan them. This is protect you from someone who could use gravityscan to scan your sites for security holes.
Most people who use gravityscan don't get that experience. They can simply run a scan. So I've filed a bug to make that message more helpful. Thanks.
1:15 pm
Hi again, Mark,
I wanted to whitelist Gravityscan in Cloudflare, as per your instructions here https://www.gravityscan.com/help/scan-settings/whitelisting-gravityscan/, but CF doesn't support /27 that you list in the post:
"68.64.48.0/27"
"Only an IPv4 range (CIDR) value of /16 or /24 is allowed for Access Rules"
http://i.imgur.com/h8WKslE.png
1:21 pm
I think our docs actually say that and suggest to use a /24. I'll check that.
Just replace the /27 with /24. You will whitelist a few extra IP addresses. Unfortunately this is a problem with Cloudflare so I'd suggest contacting them if you would like them to change that.
Mark.
1:24 pm
Looks like your docs here https://www.gravityscan.com/help/scan-settings/scanning-with-cloud-waf/ do specify that, but not here https://www.gravityscan.com/help/scan-settings/whitelisting-gravityscan/.
10:53 pm
Thanks Artem, fixing that now.
6:01 pm
Great again! Thank you very much.
Just some feedback for the current Wordfence version:
I had to whitelist Gravityscan in Wordfence to make it work ( 68.64.48.[0-31] ).
Wordfence then found the gravityscan agent file and suggested to check it as it is not a WP file and might contain malicious executable code.
10:53 pm
Thanks Oliver.
9:35 pm
Just tested my site and had a few critical issues referring to directories, not files. Directories such as wp-includes/js wp-includes/css and wp-content/uploads . Not useful to pinpoint issues nor could I find issues myself there myself. Perhaps a file like GeoIP.dat set off the alarm in uploads, not sure. Inside wp-includes I did not see anything malicious at all. Perhaps old version JS and CSS files triggered things as my WordPress site has been around for ages. But will check things some more at a later stage to be sure. It also found http://bit.ly/getsizebug1 inside my WP Rocket cached js file , and stated it was malicious and it isn't . It refers to Firefox bug in a Github repo.
10:52 pm
Thanks, have logged these with the team. This is the second report we've received of gravityscan pointing to dirs instead of files.
4:47 am
Hi, so gravityscan says my IP is blacklisted on JustSpam.org.
I wonder how trustworthy this blacklist is. It looks like thise website is not being maintained. The copyright in the footer says 2011, there is no contact information to be found and when I try to unlist it there, I get this:
Your IP xxx.xxx.xxx.xxx is not listed by other well-known blacklists.
To remove it from dnsbl.justspam.org fill the captcha to get your delistinglink.
Couldn't connect to server
So it doesn't display a captcha and I can't unlist and since there is not contact info I can't report it to them.
I tried to send an email to info@JustSpam.org + to the registrants e-mail address (which is a yahoo address) and both are bounced.
So is JustSpam.org a real blacklist that is still in use?
Also, is it an idea to not having to install the accelerator when the website already runs WordFence?
Thanks
John-Pierre
9:53 am
We removed JustSpam John, based on user feedback. It has no removal process so we yanked them. Thanks for your feedback. Problem solved.
12:12 pm
Thanks! What about the idea to not having to install the accelerator when the website already runs WordFence?
2:10 pm
We may implement something like that in future. Either provide the ability to install Accelerator via the Wordfence UI, or build Accelerator into Wordfence.
6:50 am
Me again!
Two things....
1) It looks like the scan is checking my entire multisite (as you might expect). Would you advise scanning every domain still in case there is a problem with a file that isn't common?
2) I couldn't authorise with GA yesterday. PHP file was fine though.
Thanks
6:56 am
Also got a weird issue with Elegant Themes - Bloom:
https://www.dropbox.com/s/amgmf737ltgxdjb/bloom.png?dl=0
It's giving three errors for the plugin saying update it. These weren't there yesterday. Strange thing is the suggested upgrade versions are all different (1.2.4, 1.2.7 and 2.6.4) and the plugin is up to date?
Any ideas?
9:50 am
Thanks, have passed this on.
1:58 am
The recommneded plugin version numbers reflect the version numbers of Divi/Extra/another ET plugin at the time of the security problem found 2 years ago or whenever it was.
9:51 am
Thanks Dave. Gravity doesn't work that well with Multi-site currently although it does provide basic scanning. We're working on that.
GA error messages will be more descriptive after a release later today. That will help you diagnose the issue.
Mark.
7:25 am
Hello,
Great tool! Quick question though, it keeps returning several errors on my site that says something like this:
Title: WordPress 4.7.0-4.7.1 - Unauthenticated Page/Post Content Modification via REST API
Description: Vulnerability found in WordPress. Upgrade to at least version 4.7.2.
However, we're on the most current version of Wordpress, but it keeps pointing to my /readme.html file. I'm a little confused on why it's saying we're on a lower version of Wordpress when we're really not on the most current?
Thanks,
Chris-
9:49 am
Thanks Chris, passing this on.
7:42 am
I applaud your intentions and release of Gravity scan. Thank you.
Having said this, I have had three problems in using it.
a) it (incorrectly) recognises my Engage themes plugins as being out of date, and vulnerable to Privilege escalation. They are the latest version.
b) even when cloudflare has your IPs whitelisted, it still says blocked.
c) even when I have successfully uploaded the verify php file and checked it, verify says there is an error.
Finally I communicated all of this to your guys through the gravity contact page and have received no response or even acknowledgement - so I am trying here.
My guess is that this is just teething for a new product, but not sorting these things out will not help. Can you help?
Regards,
Mark Holtom
9:49 am
Thanks Mark. We very much appreciate you using the contact page. That has created a ticket. Our CS team is prioritizing fixes and making sure they happen. We're aware of the issues you've raised and they're in the queue. We aren't able to respond to all tickets immediately so my apologies for that.
Mark.
6:27 am
I scanned my site yesterday at 5:50 pm EST and it came up with 4 critical issues all involving the following FILES:
/wp-includes/js/
/wp-content/uploads/2016/05/
/wp-content/uploads/
/wp-includes/css
It turns out these are really DIRECTORIES - based on a comment above as well as checking with another source ... are these things that are really critical and I need to check out and how? I'm not sure where to go from here and/or if there is any issue at all.
9:49 am
This has been fixed. It was a bug. The fix now makes it clear we are pointing out that your site is allowing directory listing. Please try your scan again.
3:56 pm
Many thanks for you help and work!
8:26 am
Thanks for all you do to keep our websites safe! How is this different from Wordfence? I'm currently using the free version. Does Gravityscan offer additional service? Thanks again.
9:48 am
Please see: https://www.gravityscan.com/help/general-help-topics/gravityscan-complements-wordfence/
10:09 am
So is GravityScan different that the scan with the plugin? Or is GravityScan now incorporated in the plugin daily scan?
9:23 pm
Gravityscan is a separate product. When you perform a Wordfence scan it does not include a scan by Gravityscan.
Mark.
4:06 pm
Hi Mark.
Wordfence is reporting that the Gravityscan Accelerator file may contain malicious executable code: gravityscan-agent-XXXXXXXXXXXXXX.php when HIGH SENSITIVITY scanning is enabled.
Your dev team might want to add these as safe files to the WF filter otherwise website owners might think there is an issue with it.
"This file is a PHP executable file and contains the word 'eval' (without quotes) and the word 'base64_decode(' (without quotes). The eval() function along with an encoding function like the one mentioned are commonly used by hackers to hide their code. If you know about this file you can choose to ignore it to exclude it from future scans. This file was detected because you have enabled HIGH SENSITIVITY scanning. This option is more aggressive than the usual scans, and may cause false positives."
I know I can ignore it within my own website, however many other users of both Wordfence and Gravityscan could be seeing the same warnings and if managed by several people, it could get deleted by accident, or people think they have been hacked.
Cheers, Ian
9:14 pm
Thanks Ian. We're aware of this issue and it will be fixed this week.
Mark.
5:04 am
GravityScan noted that my "sites" have been blacklisted by McAfee, SpamHaus, abuseat, etc, due to the overall IP's being . So when I got more info, I contacted my hosting provider since it is ANOTHER domain that is causing the problem and asked them to correct the issue per the report. My hosting provider states that they are "not responsible for content on hosted websites" and are not obligated to fix the problem. Great. So the rest of us get "blacklisted" via the overall IP/server that we are sharing hosting together on...not great. Or maybe it doesn't matter if my sites are blacklisted? My sites are hobby sites anyway so don't need fancy $$$ hosting, but do need secure hosting which, silly me, I was expecting already. Not sure what Wordfence/GravityScan can do to help since my sites (domains) are not the ones spewing spam. And yes, Wordfence is installed on my sites.