31–40 of 86 posts
Don't know if this is a dumb question: but would it be possible for a good party to use the same method to get admin access and install rate-limiting login plugins on all of these insecure WordPress blogs? Seems like that would be badass.
Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/
The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wor...
Earlier quoted context omitted.
That's usually the first mod done for clients who insist on using WP. For a few clients specifically, we don't let any users set their passwords at all; they get a randomly generated password upon registering or reset; WP is a good platform that does a lot out of the box (performance could use some work too though), so I don't think we should throw the baby out with the bathwater. There's just some housekeeping that…
Which particular plugin would you recommend?
Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.
Unfortunately it doesn't look like that would do any good here. With over 200k different botnet controlled machines, all that tracking the IP sources would do here is create massive blocklists. There's already evidance growing that the botnet is trying 2-3 passwords per source IP - effectively bypassing existing limiting plugins. A solution to the above is to limit the logins per account per timeframe, but that just…
https://github.com/mojombo/jekyll/wiki/blog-migrations
P.S.: I have migrated a few days ago myself from Posterous to Octopress. It was a piece of cake.
It is time for every Wordpress user to consider to switch to Octopress. Static sites have no attack vector, don't need security updates and are faster out of the box. Octopress has importers for many blogging systems including Wordpress: https://github.com/mojombo/jekyll/wiki/blog-migrations P.S.: I have migrated a few days ago myself from Posterous to Octopress. It was a piece of cake.
It is time for every Wordpress user to consider to switch to Octopress. Static sites have no attack vector, don't need security updates and are faster out of the box. Octopress has importers for many blogging systems including Wordpress: https://github.com/mojombo/jekyll/wiki/blog-migrations P.S.: I have migrated a few days ago myself from Posterous to Octopress. It was a piece of cake.
What about non-technical users? Multi-author blogs? Idiot-proof extensibility? Updates from phones and tablets? Huge sites with thousands of posts? Editorial and review systems? Access to thousands of cheap or free themes?
The ideal static site user is in a pretty privileged group. Most WordPress users would be better off securing WordPress and using a caching plugin that gives them the benefits of a powerful, dynamic platform while serving static files with automatic serverside compilation: http://wordpress.org/extend/plugins/wp-super-cache/
If you still have user id #1 and/or the user "admin" on your wordpress install, you just haven't been using wordpress long enough to know what bad ideas those are.
I can confirm. We host a lot of WordPress blogs (for photographers) and our scans have have detected an uptick in installs infected with malicious files. I'm not sure if it's the same attack mentioned in the article but the last 2 weeks have been the worst I've seen. In my experience people get compromised due to bad folder permissions or old versions of WP. I hadn't considered brute-force password attacks.
I've lost count of how many times I've seen people chmod /wp-content/upload to 777. I blame laziness, stupid presets in "one-click" installations and silly how-to's found all over the web.
The difficulty with the democratisation of software and web development is that inevitably, people will make mistakes like this. The sad part is there's probably millions of articles explaining why this is a bad idea, but the people most at risk will never see them.