Slashdot Mirror
Wordpress Sites Under Wide-Scale Brute Force Attack
New submitter NitzJaaron writes "Some of us have been experiencing attacks on Wordpress sites for the last few days, but it's now beginning to be widely reported that there's a fairly large brute force attack happening on Wordpress users on multiple hosts, including HostGator and LiquidWeb. 'This attack is well organized and again very, very distributed; we have seen over 90,000 IP addresses involved in this attack.' CloudFlare has announced that they're giving all users (free and paid) protection from said attacks with their services. 'The attacker is brute force attacking the WordPress administrative portals, using the username "admin" and trying thousands of passwords.'"
Further reports available from Immotion hosting and Melbourne server hosting.
something they should have been prepared for in the first place......
I see automated attacks on wordpress sites in the logs all the time. Same with phpmyadmin and other popular FOSS software. What else is new?
advising all our clients who use WordPress to install an additional plugin 'Limit Login Attempts' that will help to prevent brute force attacks
Not being familiar with wordpress, I'll ask why isn't that on by default?
Yes, god forbid.
Nobody gives a shit about your crappy blog, but they will give a shit about your crappy forms that allow massive amounts of spam to be sent out.
Though admittedly, you usually don't need to brute force your way in for that.
that the administrative account uses 'administrator' not 'admin'. They'll be attempting that brute force for quite a while.
Whenever a player quits EVE to go play WoW, the Average IQ of both games increase.
Or even better to get a foot in the door via your crappy blog and then go to work on the hosting company's server.
The no remote admin access makes sense for a computer login, but for a web-based app like WordPress often run on a remote hosting account there's no such thing as "local" access. Or I suppose there is, but most users don't have access to the host server and wouldn't know how to use it even if they did.
The Quirkz Handbook of Self-Improvement for People Who Are Already Pretty Okay
Great! Now all I have to do is compromise your user account, add some aliases to your .bashrc, and I get promoted to root.
I've been seeing these for the past few days across a wide variety of customer servers, sometimes with enough traffic to push the box into swap death. All I've found online are people warning if it and how to defend against it, but has anyone done any forensics on a compromised install? If so, can you share what to look for?
If I'm an internet service provider and I have a client who is sending request after request, at an inhumane rate, do I then have the right to put their service on hold for the sake of the guy at the other end of the line?
I'm looking for where the ISPs stand in these situations.
Better yet, fail2ban...
> but for a web-based app like WordPress often run on a remote hosting account there's no such thing as "local" access
SSH tunnels.
And how will you do that if you don't know my regular username or password? All you've done is turn an easy problem (brute force guess the password for the known account "root"), into a harder problem (guessing both my username and password, and then guessing the root one or sneaking something into an alias and hoping I invoke it during an "su" or "sudo"). If you're talking about some other way to compromise the system, then the account name/pass is irrelevant.
All I'm saying is, these guys are apparently knocking on the "remote root login" door, hoping for an easy win that way. I don't understand why anyone's machine would be set up to allow such an easy way in. Don't have a "root", "admin", or "administrator" account with remote login enabled. Taking the guesswork out of the account name defeats half the value of having a username/pass pair, so don't make it so easy (there are of course other ways to authenticate, but assuming that's the method you're using -- do it right).
Someone else mentioned that for something like WordPress, you have to have remote login for administrators. Yes, but I don't see why the account *name* has to be "admin". Sure, it's easy to remember, but why couldn't it be something random like "SuperLuser782", which would be unlikely for a bot to try out in the first hundred common guesses for an administrator account.
I've used Wordpress since forever (2006?), and I seem to remember that at least back in the bad old days the admin username had to be "admin." Nothing else. There are probably millions of people who set their blogs up back then and haven't looked at that setting since.
I wonder what they're doing this for? What does blowing up a planet's worth of little blogs get anyone? Does anyone know what this thing actually does?
Gaaa. That subject line should read "username," not password.
There's a plugin I use on my sites that utilized the tarpit concept. The more attempts that are made to brute force an id from a given IP, the slower the response time becomes. It's called Login Security Solution.
I have written a rather detailed article on next steps for anyone affected - which is just about anyone with a Wordpress site. Unfortunately at least 10% of accounts hit have been successfully compromised, and many are being used to send spam or attack other sites. The Global Wordpress Brute Force Attacks of 2013 - http://calladeveloper.blogspot.com/2013/04/global-wordpress-brute-force-attacks.html This includes the method to htaccess block direct automated requests for wp-login.php as well. The attackers have gotten around some fairly advanced countermeasures including mod_security rules so all Wordpress site owners should be following these steps.
Quite true. In fact I think I'll just switch off my pager this weekend, after all I can only worry about one thing at a time, so I may as well worry about one I can do nothing about.
Wordpress allowa for a space in the username which is nice and seems more unlikely to be guessed :)
Anveto
I've found the "Better WP Security" plugin to be pretty good at stopping all of this. You can set login limits, 404 limits, etc., and have it automatically deny offenders IP addresses from accessing your site by modifying the site's root .htaccess file. But even it doesn't cover everything.
/wp-content/ directory (which includes uploads, themes, and plugins). Simply adding a .htaccess file to the /wp-content directory with something like the following in it will protect against poorly written themes, plug-ins, and most not-yet-known exploits of WordPress.
/wp-content
Many WP attackers probe for themes and plugins with known weaknesses, or exploit the upload system to upload executables. But what most people don't know (including most WP developers I've worked with) is that there is no reason for PHP files to be directly accessible anywhere in the
# Add allowable extensions as needed
Order Deny,Allow
Deny from all
<FilesMatch "\.(jpe?g|gif|png|mp3|mpe?g|flv|swf|js|css|pdf|xml|html|gz)$">
Allow from all
</FilesMatch>
If that breaks a plugin or theme you use, then it's not written very well and you shouldn't risk using it. Contact the developer and tell them they should not need direct access to executables in
It's not just bloggers, a lot of businesses use wordpress. If i remember correctly, spotify's website is wordpress based
Anveto
There is several captcha plugins available, wont help with the DDOS but will help with machines trying to guess passwords. http://rawcell.com
The root cause of this attack is that Wordpress allows unlimited login attempts for the admin account. I know there is some plugin that can fix it, but it should be built into the core.
And the blog I run is for my church. He said he did not know how this happened. Someone hacked a blog running an unpatched Drupal blog. This is what he said, anyway. Then used that breach to hack everything else. Since I could not determine what had been hacked/changed on the church blog, (user accounts wee created that I did not create!) I wiped it, deleted all the databases and started from scratch. So it isn't just crappy blogs - although if you happen to be a godless nerd you may think my church blog is crappy anyway.... B-) I support your right to be a godless nerd.
"Let us raise a standard to which the wise and honest can repair" - George Washington
If I wanted to be a leet haxor...
If I was in it for the lulz...
If I had a grudge...
If I owned a major news portal...
If I had facebook stock...
Hard to say. This seems high on the bumble-o-meter, like someone didn't care or didn't think it would get noticed.
I ended up making some tiny changes to my WP install that basically causes requests to /wp-admin to die immediately, unless you're accessing it via a specific HTTP port that I've opened in Apache specifically for this purpose.
I've got disk permissions set up so that the regular Apache user cannot write at all to the disk - a common source of WP problems seems to be exploits writing new files to disk, so stopping that seemed like a good idea. Unfortunately it also bones a lot of WP functionality like being able to automatically install skins/plugins.
Using some Apache module (can't remember which one) I've set it up so that requests made to /wp-admin under the correct Apache port operate under a different user - one that /does/ have write access to the disk. So it means I can do any administrative stuff and take advantage of the full WP functionality without having to leave write access in there for normal use.
Conceptually this seems like a much more default setup for WP - certainly I haven't had any security problems. As a side benefit it means I don't need to worry about random attacks like this.
There's a few minor problems I haven't resolved (most notably when adding new posts, the URL it stores for them includes the administrative port in them and publicly displays them in things like the RSS feed :) but I'm hoping to find time one day to resolve those.
duh....
NEVER EVER use the default administrator login name for a public-facing site management interface.
and if you can, at least lock down the admin interface login URL with an extra layer, even basic http auth or some htaccess deny/allow rules will help immensely.
God forbid someone gets access to a hosting company that is so bad a clients blog can gain access to their server.
I just enabled conn limit on the (CSF) firewall on the web server then limit port 80 to 30 connections per IP.. any more than 30 connections from an IP and it gets temp ban for an hour. Since they are hitting the server with so many connections its a instant ban for the abusers. Solved the whole problem for me..
change the wp-login.php name to wp-ThwartSupidScriptBotts-login.php or whatever variant you like
(and one other place in the code, if i remember correctly)
I'm getting 3000+ 404 errors a month from seemingly random IP
scripts cant deal with various names (though you may want to remember what the log in is )
Your user name... you don't happen to live in the Mount Pocono area, do you?
If I mod you up, it doesn't necessarily mean I agree with what you've said, sorry.
all articles either are not saying what is the purpose or just talking about creating a zombienet for future use, but one wordpress I know of got hacked just 2 weeks ago by brute-forcing his way in, then someone was able to install a plugin call "boss" which was the r57shell and with this script, was able to put new files in the blog which was serving 7727 websites with a virus when someone visited their site and didn't had flash. The virus in question was the trojan Meredrop, so the wordpress got hacked and was already being used for spreading a trojan. It's high time that WordPress install by default Login Lockdown or Limit Login or some plugins like that, can't believe they don't put it by default.
" CloudFlare has announced that they're giving all users (free and paid) protection from said attacks with their services." - and there's the meat of this whole post. Like the "Unprecedented DNS attacks" from a couple of weeks ago, if you follow the trail of this article it is nothing but a press release from CloudFlare designed to whip everyone into a frenzy and buy their product to protect them. - 90,000 hosts? Haven't we seen attacks with half a million or more hosts?