Slashdot Mirror
Large DDoS Attack Brings WordPress Pingback Abuse Back Into Spotlight
angry tapir writes "Attackers have abused the WordPress pingback feature, which allows sites to cross-reference blog posts, to launch a large-scale, distributed denial-of-service (DDoS) attack, according to researchers from Web security firm Sucuri. The attack involved over 162,000 legitimate WordPress websites being forced to send hundreds of requests per second to a popular WordPress site, preventing access to it for many hours. The attack exploited an issue with the XML-RPC (XML remote procedure call) implementation in WordPress that's used for features like pingback, trackback, remote access from mobile devices and others, and brought back into the spotlight the denial-of-service risks associated with this functionality that have been known since 2007."
Every nice little functional feature someone puts on a site or in an application - along come some socially dysfunctional pricks who has to exploit and ruin it for everyone. I just despair sometimes.
The post alludes to a flaw in xml-rpc, but it seems to me this is a Wordpress-exclusive vulnerability being reported on today. Drupal uses xml-rpc for example, and all is quiet for those folks it seems.
I know a fair amount of work has been spent beefing up Drupal's xml-rpc implementation, so maybe that's working now, whereas the implementation used by Wordpress is vulnerable and failing. TFA is a little light on details as to the technical source being manipulated and abused.
You can't be ahead of the curve, if you're stuck in a loop.
pingback and trackback are features of WordPress, also known as "remote comments", they are quite usefull to boost the popularity of your website if someone post the URL of your WordPress blog. As Matt Mullenweg from the WordPress project said, there's cheaper, easier and more effective ways to DDoS site. I'm going to let that feature enabled in my sites.
Dear internet, please quit using wordpress. It's constantly full of poor programming practices and it's basically the Microsoft Windows XP of blogging software.
From the description of the issue, all that seems to be happening here is that an attacker makes an HTTP request to a third-party blog that supports Pingback, and that blog makes an HTTP request to the target. As stated, there's no amplification, so all this appears to be doing is masking the source of the attack.
To what is he referring when he says that it amplifies the "scale and reach" of the attack?
Bogtha Bogtha Bogtha
That is the first thing I turn off on any Wordpress install. pingback is the absolute worst feature ever made.
Do not look at laser with remaining good eye.
Exactly. They break it because they can - otherwise how would they know what needed to be fixed?
Why would you trust any software that you know can be broken by anyone 'socially dysfunctional' rather than someone who wants to gain a financial advantage from it?
Basically, we graffiti. No more justification than the pricks who feel the need to spray-paint their names on various structures/objects, or draw genitalia, profanity, etc.
Just as dumb as the "for a good time call X" written on a washroom stall.
The whole ideal of sharing ideals and thoughts is going away from the internet. Because of things like this. I remember the days of bulletin boards and now we have better ways to communicate but we also have more malicious people out there. I though the internet was going the direction of a two way street. But maybe we are going back to a time when the internet was just about accessing information.