Attacks on Newly Registered Content Management Websites – A Comparison

Web Content Management Systems (CMSs) are tools for creating and maintaining commercial-quality websites. Their popularity has increased, but so has their complexity and the number of third-party modules. These, however, increase the risk of vulnerabilities. This paper presents a case study of hacker/intrusion activities on CMS websites. We study how much of the incoming traffic is potentially malicious and where it originates from. Additionally, we study if CMS’s based on different CMS software attract different kinds of traffic. To implement our study, we have registered and launched three virtual websites (running on the same computer). Each site runs its own popular CMS software, but their content is identical (a weblog with a simple template). The sites run for six months on a platform of a commercial web hosting provider. Our methodology is empirical, and our analysis is based on logging every HTTP request that was sent to the sites. This was done using the logging capabilities of the webserver software, Apache. We compare the sites with each other, with an established website, and an empty website. Our analysis shows that more than 90% of all traffic to the websites (both old and new) is potentially malicious. Further, we find that a large majority of the intrusion attempts are very unsophisticated: they do not try to exploit any specific vulnerabilities of the underlying CMS. Therefore, keeping the CMS up-to-date and following CMS hardening practices is enough to repel these attacks.