Huge attack on WordPress sites could spawn never-before-seen super botnet • Hacker News Board

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#41

Post by GabrielF00 » Sat, Apr 13, 2013, 9:25 AM UTC

modernerd wrote: post #32

Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ It works with the Google Authenticator app. Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/ The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wo…

One problem is that WordPrss sites are often built by small web designers for clients with limited computer skills and very little patience for complex passwords, much less two-factor authentication.

For 2/3 of the WordPress sites I administer, I use a very long, complex admin password. The other site is for a group that wanted multiple admin accounts, but the people who use these accounts have a lot of trouble with complex passwords. After several emails telling me that "the website doesn't work" because the user had trouble with a long password with special characters, I gave up and switched it to an easy-to-remember password with just uppercase and lowercase letters.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#42

Post by NuZZ » Sat, Apr 13, 2013, 9:25 AM UTC

modernerd wrote: post #32

Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ It works with the Google Authenticator app. Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/ The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wo…

Or just generate random 15+ character passwords for admin accounts. From the article it appears the concern is from brute forcing "admin" account passwords. Good luck bruting MT#r!}A1(hIQ4^pC*7`K.KGiL\&[A\k#TUC4R<R?

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#43

Post by radio4fan » Sat, Apr 13, 2013, 9:31 AM UTC

jacques_chester wrote: post #20

uptown wrote: post #3

Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.

History has shown that Wordpress developers prioritise shiny new features over all other concerns.

Yep, I have to develop 'WordPress sites' sometimes and the only consistency is its awfulness. It's the PHP of PHP.

Having a default username in the first place is incredibly poor practice. So many users stick to 'admin', making it just a case of guessing the password.

And don't get me started on that bloody "the loop" finite state machine. I mean, really?

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#44

Post by MattBearman » Sat, Apr 13, 2013, 10:02 AM UTC

radio4fan wrote: post #43

jacques_chester wrote: post #20

Earlier quoted context omitted.

History has shown that Wordpress developers prioritise shiny new features over all other concerns.

Yep, I have to develop 'WordPress sites' sometimes and the only consistency is its awfulness. It's the PHP of PHP. Having a default username in the first place is incredibly poor practice. So many users stick to 'admin', making it just a case of guessing the password. And don't get me started on that bloody "the loop" finite state machine. I mean, really?

"It's the PHP of PHP" - quote of the year.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#45

Post by jakejake » Sat, Apr 13, 2013, 10:03 AM UTC

radio4fan wrote: post #43

jacques_chester wrote: post #20

Earlier quoted context omitted.

History has shown that Wordpress developers prioritise shiny new features over all other concerns.

Yep, I have to develop 'WordPress sites' sometimes and the only consistency is its awfulness. It's the PHP of PHP. Having a default username in the first place is incredibly poor practice. So many users stick to 'admin', making it just a case of guessing the password. And don't get me started on that bloody "the loop" finite state machine. I mean, really?

I actually find Wordpress to be much lighter and cleaner than many other CMS systems. It's impressive to me that the code is relatively consistent despite going through years of iterations. I also find the plugin mechanics of Wordpress to be simple to understand. It's got plenty of room for improvement but I think it's got a lot of good qualities too.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#46

Post by francescolaffi » Sat, Apr 13, 2013, 10:19 AM UTC

lenazegher wrote: post #39

ck2 wrote: post #19

If you still have user id #1 and/or the user "admin" on your wordpress install, you just haven't been using wordpress long enough to know what bad ideas those are.

I've not heard of the problem of a user with id #1 before, can you explain please? What's the issue with a user id #1 when the username is not admin?

if user #1 is still an admin but with a different name you can just go to wpurl/?author=1 and if url rewriting is enabled you'll be redirected to wpurl/author/nicename and nicename is usually equal to the username

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#47

Post by jacques_chester » Sat, Apr 13, 2013, 10:24 AM UTC

jakejake wrote: post #45

radio4fan wrote: post #43

Earlier quoted context omitted.

Yep, I have to develop 'WordPress sites' sometimes and the only consistency is its awfulness. It's the PHP of PHP. Having a default username in the first place is incredibly poor practice. So many users stick to 'admin', making it just a case of guessing the password. And don't get me started on that bloody "the loop" finite state machine. I mean, really?

I actually find Wordpress to be much lighter and cleaner than many other CMS systems. It's impressive to me that the code is relatively consistent despite going through years of iterations. I also find the plugin mechanics of Wordpress to be simple to understand. It's got plenty of room for improvement but I think it's got a lot of good qualities too.

It has been consistent, all right. Consistently terrible. For years.

Every time I duck under the hood to debug something I always come away stunned and disturbed by the frequent use of globals, the frequent interleaving of different concerns and basically the all-round untraceability of the design as soon as themes or plugins are added. It's horrid.

Oh! And there are still no unit or functional tests. And no concept of release management (such as having security patches released independently of feature patches), which is why every Wordpress administrator gets to play their favourite game when there's a new release: continue with known-security-flaw code, or install code that might just blow away your data?

Place yer bets, place yer beeeets!

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#48

Post by [deleted] » Sat, Apr 13, 2013, 10:31 AM UTC

[deleted]

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#49

Post by infinity » Sat, Apr 13, 2013, 10:33 AM UTC

I write all (futile) login attempts on my site to a log file. I can confirm this rise in password bruteforcing attempts during the last days.

This is what the bruteforce passwords look like, these tried to login as "admin":

  [Sat Apr 13 05:30:31 2013]   nevalidniipass 
  [Sat Apr 13 05:30:34 2013]   gfhjkm 
  [Sat Apr 13 05:30:37 2013]   gggggggg 
  [Sat Apr 13 05:30:39 2013]   ghbdtn 
  [Sat Apr 13 05:30:41 2013]   ghgftmn6 
  [Sat Apr 13 05:30:43 2013]   ghghgh 
  [Sat Apr 13 05:30:44 2013]   ghjkju 
  [Sat Apr 13 05:30:46 2013]   ghjrdjcn 
  [Sat Apr 13 05:30:48 2013]   gjkzyjxr 
  [Sat Apr 13 05:30:50 2013]   globax123 
  [Sat Apr 13 05:30:52 2013]   go0gle 
  [Sat Apr 13 05:30:54 2013]   go2fuck 
  [Sat Apr 13 05:30:55 2013]   gogogo 
  [Sat Apr 13 05:30:57 2013]   goldz 
  [Sat Apr 13 05:30:59 2013]   gthtw112 
  [Sat Apr 13 05:31:02 2013]   guest 
  [Sat Apr 13 05:31:05 2013]   h69s9t 
  [Sat Apr 13 05:31:07 2013]   hackett 
  [Sat Apr 13 05:31:08 2013]   hal9000 
  [Sat Apr 13 05:31:10 2013]   hazem200 
  [Sat Apr 13 05:31:12 2013]   heccrbqh 
  [Sat Apr 13 05:31:14 2013]   herbie 
  [Sat Apr 13 05:31:16 2013]   hghgh 
  [Sat Apr 13 05:31:18 2013]   hhhh1 
  [Sat Apr 13 05:31:20 2013]   hhhhhaaaaa 
  [Sat Apr 13 05:31:21 2013]   hockey 
  [Sat Apr 13 05:31:23 2013]   home555 
  [Sat Apr 13 05:31:25 2013]   honda 
  [Sat Apr 13 05:31:27 2013]   htrdbtv 
  [Sat Apr 13 05:31:29 2013]   http 
  [Sat Apr 13 05:31:31 2013]   hycvibck 
  [Sat Apr 13 05:31:33 2013]   i_am 
  [Sat Apr 13 05:31:35 2013]   ib6ub9 
  [Sat Apr 13 05:31:37 2013]   icing 
  [Sat Apr 13 05:31:38 2013]   icq123 
  [Sat Apr 13 05:31:40 2013]   icqpass 
  [Sat Apr 13 05:31:42 2013]   if6was9 
  [Sat Apr 13 05:31:44 2013]   ifhgtq79 
  [Sat Apr 13 05:31:46 2013]   ifyfif 
  [Sat Apr 13 05:31:48 2013]   iiiiiiii 
  [Sat Apr 13 05:31:50 2013]   ikaihsot 
  [Sat Apr 13 05:31:52 2013]   il0vey0u 
  [Sat Apr 13 05:31:54 2013]   iloveaol 
  [Sat Apr 13 05:31:56 2013]   iloveu 
  [Sat Apr 13 05:31:57 2013]   iloveyou 
  [Sat Apr 13 05:31:59 2013]   inferno 
  [Sat Apr 13 05:32:01 2013]   infinity 
  [Sat Apr 13 05:32:05 2013]   infree 
  [Sat Apr 13 05:32:08 2013]   iof314 
  [Sat Apr 13 05:32:11 2013]   jake4440 
  [Sat Apr 13 05:32:13 2013]   jamie1 
  [Sat Apr 13 05:32:15 2013]   janice 
  [Sat Apr 13 05:32:16 2013]   jay18birdman 
  [Sat Apr 13 05:32:18 2013]   jc5000 
  [Sat Apr 13 05:32:20 2013]   jeffery 
  [Sat Apr 13 05:32:22 2013]   john1 
  [Sat Apr 13 05:32:24 2013]   joomla 
  [Sat Apr 13 05:32:26 2013]   joshua 
  [Sat Apr 13 05:32:27 2013]   keys 
  [Sat Apr 13 05:32:29 2013]   kholmsk3 
  [Sat Apr 13 05:32:31 2013]   kir11421 
  [Sat Apr 13 05:32:33 2013]   kkkkkk 
  [Sat Apr 13 05:32:35 2013]   kngvhpg 
  [Sat Apr 13 05:32:37 2013]   ko#]|7sz 
  [Sat Apr 13 05:32:39 2013]   kxvq4k2d 
  [Sat Apr 13 05:32:41 2013]   laksmi 
  [Sat Apr 13 05:32:42 2013]   lefty 
  [Sat Apr 13 05:32:44 2013]   lex1977 
  [Sat Apr 13 05:32:46 2013]   linux 
  [Sat Apr 13 05:32:48 2013]   lol 
  [Sat Apr 13 05:32:50 2013]   lol777 
  [Sat Apr 13 05:32:52 2013]   lollol 
  [Sat Apr 13 05:32:54 2013]   lovelove 
  [Sat Apr 13 05:32:55 2013]   lucille2000 
  [Sat Apr 13 05:32:57 2013]   lyxasgje 
  [Sat Apr 13 05:32:59 2013]   m@$ter 
  [Sat Apr 13 05:33:02 2013]   m@ster 
  [Sat Apr 13 05:33:07 2013]   m1911a1 
  [Sat Apr 13 05:33:11 2013]   google 
  [Sat Apr 13 05:33:13 2013]   facebook 
  [Sat Apr 13 05:33:15 2013]   microsoft 
  [Sat Apr 13 05:33:17 2013]   obama 
  [Sat Apr 13 05:33:18 2013]   twitter 
  [Sat Apr 13 05:33:20 2013]   wp 
  [Sat Apr 13 05:33:22 2013]   wordpress 
  [Sat Apr 13 05:33:24 2013]   060890 
  [Sat Apr 13 05:33:26 2013]   060891 
  [Sat Apr 13 05:33:28 2013]   060893 
  [Sat Apr 13 05:33:30 2013]   060988 
  [Sat Apr 13 05:33:32 2013]   060989

They also try to get access as "administrator".

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#50

Post by micheljansen » Sat, Apr 13, 2013, 10:42 AM UTC

jameswyse wrote: post #23

Another nice bit of advertising for Cloudflare.. There's some more about this on their blog: http://blog.cloudflare.com/patching-the-internet-fixing-the-...

Exactly what I thought when I read "Operators of WordPress sites can take other measures too, including installing plugins such as this one and this one, which close some of the holes most frequently exploited in these types of attacks. Beyond that, operators can sign up for a free plan from CloudFlare that automatically blocks login attempts that bear the signature of the brute-force attack.".

Then I saw the source for this "news": Cloudflare's blog.