Slashdot Mirror
Pwnd Aethra Routers Used To Brute-Force WordPress Sites (voidsec.com)
An anonymous reader writes: Security researchers found around 8,000 Aethra routers (with no admin passwords) as part of a botnet that attacked WordPress sites, trying to brute-force admin accounts. Most routers were deployed in enterprise networks in Italy. Each device could have be used to launch DDoS attacks with a capability between 1 to 10 Gbps, based on the company's bandwidth.
Things could be worse, though: Additional investigation also revealed that some of the routers were also susceptible to various reflected XSS and CSRF attacks that would also allow attackers to take control of the device, even if using different login credentials.
Using Shodan, a search engine for locating Internet-connected devices, researchers found over 12,000 of Aethra routers around the world, 10,866 in Italy alone, and over 8,000 of these devices were of the model detected in the initial brute-force attack (Aethra Telecommunications PBX series). At that time, 70% of these Aethra routers were still using their default login credentials
I think it must!
It always worked on the first try for most!
Why guess when you can know? Measure!
zZZzzz....
What? Please wake me up when something really new happens.
zzZZZZzzzz....
Everything I write is lies, read between the lines.
Why are ISPs deploying routers with no goddamn admin password.... that's the problem here.... and why are they messing with the firmware...
Shodan search results mistakenly selected as Slashdot article for fourth time in a single month. Details at eleven.
Since when has Slashdot become a lazy frontend for softpedia? Do the editors get revenue from the ads on their site, or some such?
The articles there are a paragon of bad technical journalism. The editors are anonymous, and they often don't link to the original content or source of data for the article. Softpedia has the stigma of technical ignorance, much like wired and gizmodo. Do us all a favour and spare us this drivel.
- 'Rename Login' Plugins - there are various. Use them.
- Use random character strings for usernames, especially admin users. Rename the nicename and the displayname to the role using a db tool.
- use a db prefix other than wp_ , I use random strings.
Do all this upon or directly after the WP installation. This very basic security stuff deters attacks like the one mentioned in TFA and mitigates most of its effects.
We suffer more in our imagination than in reality. - Seneca
You should have renamed Admin when you created the site. You should never have a test ID. And you should have https://wordpress.org/plugins/... to spam you in times like these...
Really? Such a professional-sounding headline. "Compromised" might have offered a little more credibility rather than years-old teen l33t speak.
Please stand clear of the doors, por favor mantenganse alejado de las puertas
They mention numbers like 8000, but nowhere do they directly say how many were infected. Only that such number had the default (no) password. Damn fine journalism if you ask me!
Really? Such a professional-sounding headline. "Compromised" might have offered a little more credibility rather than years-old teen l33t speak.
Which part of "News for Nerds, Stuff that Matters" escaped your corporate brain?
It's like a tube. A tube full off piss.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."