Huge attack on WordPress sites could spawn never-before-seen super botnet
1–10 of 86 posts
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#2Ahaha, great headline...
Seriously, the security of password protected systems are a disaster(, when combined with the average user).
We should push static content generators like jekyll & co the reduce the surface, till somebody solves the authentication problem.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#3Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#4The effect is probably reasonably limited though. Most of the time you're going to be in safe mode or on shared hosting, which means no SYN floods and no bitcoin mining.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#5I can confirm. We host a lot of WordPress blogs (for photographers) and our scans have have detected an uptick in installs infected with malicious files. I'm not sure if it's the same attack mentioned in the article but the last 2 weeks have been the worst I've seen.
In my experience people get compromised due to bad folder permissions or old versions of WP. I hadn't considered brute-force password attacks.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#6Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.
That's usually the first mod done for clients who insist on using WP. For a few clients specifically, we don't let any users set their passwords at all; they get a randomly generated password upon registering or reset;
WP is a good platform that does a lot out of the box (performance could use some work too though), so I don't think we should throw the baby out with the bathwater. There's just some housekeeping that needs to be taken care of beforehand.
The alternative, of course, is building something custom with the bare minimum of necessities server-side and scrubbing all input/global vars. A lot of flexibility can still be retained by implementing a taxonomy system that define what posts can be (which is pretty much a very loose Entity-Attribute-Value model).
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#7"...the distributed attacks are attempting to brute force the administrative portals of WordPress servers, employing the username "admin" and 1,000 or so common passwords."
I'm a little surprised that such a simple attack vector is a legitimate threat in creating a "super botnet."
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#8I can confirm. We host a lot of WordPress blogs (for photographers) and our scans have have detected an uptick in installs infected with malicious files. I'm not sure if it's the same attack mentioned in the article but the last 2 weeks have been the worst I've seen. In my experience people get compromised due to bad folder permissions or old versions of WP. I hadn't considered brute-force password attacks.
I've lost count of how many times I've seen people chmod /wp-content/upload to 777. I blame laziness, stupid presets in "one-click" installations and silly how-to's found all over the web.
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#9I'm sorry but white on black makes my eyes angry
Re: Huge attack on WordPress sites could spawn never-before-seen super botnet
#10[deleted]