Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Huge attack on WordPress sites could spawn never-before-seen super botnet

arstechnica.com

Post reply on HN
Print view View original

11–20 of 86 posts

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#11

Post by bigiain »

callmeed wrote: post #5

I can confirm. We host a lot of WordPress blogs (for photographers) and our scans have have detected an uptick in installs infected with malicious files. I'm not sure if it's the same attack mentioned in the article but the last 2 weeks have been the worst I've seen. In my experience people get compromised due to bad folder permissions or old versions of WP. I hadn't considered brute-force password attacks.

Can I suggest it might be worth investigating the "Wordfence Security" plugin?

I use it pretty much everywhere that I have anything to do with WordPress - I'd noticed an uptick early this week of random ip addresses from far-flung countries getting locked out after 5 login attempts or multiple lost password attempts.

(One site in particular gets a _lot_ of drive-by login attempts - it's got the word "anonymous" in the domain, which I suspect attracts mostly the wrong sort of traffic... Wordfence is locked down _much_ tighter on that site.)

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#12

Post by Lifescape »

eksith wrote: post #6
uptown wrote: post #3

Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.

That's usually the first mod done for clients who insist on using WP. For a few clients specifically, we don't let any users set their passwords at all; they get a randomly generated password upon registering or reset; WP is a good platform that does a lot out of the box (performance could use some work too though), so I don't think we should throw the baby out with the bathwater. There's just some housekeeping that…

Which particular plugin would you recommend?

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#13

Post by krapp »

bigiain wrote: post #11
callmeed wrote: post #5

I can confirm. We host a lot of WordPress blogs (for photographers) and our scans have have detected an uptick in installs infected with malicious files. I'm not sure if it's the same attack mentioned in the article but the last 2 weeks have been the worst I've seen. In my experience people get compromised due to bad folder permissions or old versions of WP. I hadn't considered brute-force password attacks.

Can I suggest it might be worth investigating the "Wordfence Security" plugin? I use it pretty much everywhere that I have anything to do with WordPress - I'd noticed an uptick early this week of random ip addresses from far-flung countries getting locked out after 5 login attempts or multiple lost password attempts. (One site in particular gets a _lot_ of drive-by login attempts - it's got the word "anonymous" in th…

I was just about mention this ... I'm using Wordfence on a wordpress site right now, already had logins limited.

And the 'live scan' is scary -- constant attempts to login as 'admin'.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#16

Post by forrestthewoods »

socillion wrote: post #7

"...the distributed attacks are attempting to brute force the administrative portals of WordPress servers, employing the username "admin" and 1,000 or so common passwords." I'm a little surprised that such a simple attack vector is a legitimate threat in creating a "super botnet."

4.7% of users have the password password;

8.5% have the passwords password or 123456;

9.8% have the passwords password, 123456 or 12345678;

14% have a password from the top 10 passwords

40% have a password from the top 100 passwords

79% have a password from the top 500 passwords

91% have a password from the top 1000 passwords

http://xato.net/passwords/more-top-worst-passwords/

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#17

Post by medell »

Lifescape wrote: post #12
eksith wrote: post #6

Earlier quoted context omitted.

That's usually the first mod done for clients who insist on using WP. For a few clients specifically, we don't let any users set their passwords at all; they get a randomly generated password upon registering or reset; WP is a good platform that does a lot out of the box (performance could use some work too though), so I don't think we should throw the baby out with the bathwater. There's just some housekeeping that…

Which particular plugin would you recommend?

I've been using Better WP Security, one of the two linked in the article, and have nothing but good things to say. And the developer is on top of it.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#18

Post by eksith »

medell wrote: post #17
Lifescape wrote: post #12

Earlier quoted context omitted.

Which particular plugin would you recommend?

I've been using Better WP Security, one of the two linked in the article, and have nothing but good things to say. And the developer is on top of it.

Ditto for BWPS. You always want to pick plugins where the developers are actively participating in the community and regularly staying on top of any potential security issues.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#20

Post by jacques_chester »

uptown wrote: post #3

Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.

History has shown that Wordpress developers prioritise shiny new features over all other concerns.
Post reply on HN