Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Huge attack on WordPress sites could spawn never-before-seen super botnet

arstechnica.com

Post reply on HN
Print view View original

51–60 of 86 posts

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#51

Post by yaix »

modernerd wrote: post #32

Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ It works with the Google Authenticator app. Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/ The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wo…

Simply use five random dictionary words as a password and you are fine. The browser will store then the password easy login.

Two-facor auth just adds to complexity, and that is a bad thing when it comes to secutiry. You want to be able to easily understand that a system is secure. The more complex a system is, the larger the likelyhood of a surprise "whoops, I overlooked that" somewhere down the road.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#52

Post by WA »

NuZZ wrote: post #42
modernerd wrote: post #32

Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ It works with the Google Authenticator app. Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/ The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wo…

Or just generate random 15+ character passwords for admin accounts. From the article it appears the concern is from brute forcing "admin" account passwords. Good luck bruting MT#r!}A1(hIQ4^pC*7`K.KGiL\&[A\k#TUC4R<R?

Good luck typing that without a password manager ;)

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#53

Post by ra »

yaix wrote: post #51
modernerd wrote: post #32

Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ It works with the Google Authenticator app. Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/ The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wo…

Simply use five random dictionary words as a password and you are fine. The browser will store then the password easy login. Two-facor auth just adds to complexity, and that is a bad thing when it comes to secutiry. You want to be able to easily understand that a system is secure. The more complex a system is, the larger the likelyhood of a surprise "whoops, I overlooked that" somewhere down the road.

Or any slightly obscure memorable phrase. e.g. mycatmiffylikesbiscuits or tallspeakerswithoutafaceplaterattle or emptyhandlebeerglasshasfoam ...

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#54

Post by johnpowell »

WA wrote: post #52
NuZZ wrote: post #42

Earlier quoted context omitted.

Or just generate random 15+ character passwords for admin accounts. From the article it appears the concern is from brute forcing "admin" account passwords. Good luck bruting MT#r!}A1(hIQ4^pC*7`K.KGiL\&[A\k#TUC4R<R?

Good luck typing that without a password manager ;)

I just use a text file on my computers desktop and a usb thumb drive. I don't note what the password is for. So my Amazon password is something like dkwjRw#4camzR4%7hjfgdelsdshWE

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#55

Post by kmfrk »

modernerd wrote: post #38
js4all wrote: post #35

It is time for every Wordpress user to consider to switch to Octopress. Static sites have no attack vector, don't need security updates and are faster out of the box. Octopress has importers for many blogging systems including Wordpress: https://github.com/mojombo/jekyll/wiki/blog-migrations P.S.: I have migrated a few days ago myself from Posterous to Octopress. It was a piece of cake.

Static site generators require a lot of sacrifices: What about non-technical users? Multi-author blogs? Idiot-proof extensibility? Updates from phones and tablets? Huge sites with thousands of posts? Editorial and review systems? Access to thousands of cheap or free themes? The ideal static site user is in a pretty privileged group. Most WordPress users would be better off securing WordPress and using a caching plugi…

Exactly. My own static blog is pretty much the perfect CMS that I wouldn't recommend to anyone for the life of me.

At the very least, it needs something like http://prose.io/ on top of it, and since their website keeps not working, you don't want to put all your eggs in one basket, if shit hits the fan.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#56

Post by OGC »

infinity wrote: post #49

I write all (futile) login attempts on my site to a log file. I can confirm this rise in password bruteforcing attempts during the last days. This is what the bruteforce passwords look like, these tried to login as "admin": [Sat Apr 13 05:30:31 2013] nevalidniipass [Sat Apr 13 05:30:34 2013] gfhjkm [Sat Apr 13 05:30:37 2013] gggggggg [Sat Apr 13 05:30:39 2013] ghbdtn [Sat Apr 13 05:30:41 2013] ghgftmn6 [Sat Apr 13 05…

nitpick: that's a dictionary attack, not brute-force

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#57

Post by FuzzyDunlop »

minimaxir wrote: post #30
socillion wrote: post #7

"...the distributed attacks are attempting to brute force the administrative portals of WordPress servers, employing the username "admin" and 1,000 or so common passwords." I'm a little surprised that such a simple attack vector is a legitimate threat in creating a "super botnet."

On older Wordpress installs (pre-3.0 I believe), you couldn't change the username of the first user from "admin" when setting up a blog, and you had to manually change it later. Yes, it was stupid.

I remember having to perform some magical incantation to actually pull that off around then. Set up WP, log in, create new user, set it as admin, log in as the new user, try to delete the admin account, log back in as admin because you forgot something, log in as the new user again, actually delete account.

No wonder everyone stuck with 'admin'.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#58

Post by ZoFreX »

ra wrote: post #53
yaix wrote: post #51

Earlier quoted context omitted.

Simply use five random dictionary words as a password and you are fine. The browser will store then the password easy login. Two-facor auth just adds to complexity, and that is a bad thing when it comes to secutiry. You want to be able to easily understand that a system is secure. The more complex a system is, the larger the likelyhood of a surprise "whoops, I overlooked that" somewhere down the road.

Or any slightly obscure memorable phrase. e.g. mycatmiffylikesbiscuits or tallspeakerswithoutafaceplaterattle or emptyhandlebeerglasshasfoam ...

No. The key word in the comment you replied to was "random". "mycatmiffylikesbiscuits" is a pretty terrible password.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#59

Post by namwen »

jacques_chester wrote: post #47
jakejake wrote: post #45

Earlier quoted context omitted.

I actually find Wordpress to be much lighter and cleaner than many other CMS systems. It's impressive to me that the code is relatively consistent despite going through years of iterations. I also find the plugin mechanics of Wordpress to be simple to understand. It's got plenty of room for improvement but I think it's got a lot of good qualities too.

It has been consistent, all right. Consistently terrible. For years. Every time I duck under the hood to debug something I always come away stunned and disturbed by the frequent use of globals, the frequent interleaving of different concerns and basically the all-round untraceability of the design as soon as themes or plugins are added. It's horrid. Oh! And there are still no unit or functional tests. And no concept…

Yeah that hits home. I build Wordpress websites daily and also manage a number of them which are years old and I had no hand in making. Pressing that update button on some of these sites really is like russian roulette.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#60

Post by danenania »

ZoFreX wrote: post #58
ra wrote: post #53

Earlier quoted context omitted.

Or any slightly obscure memorable phrase. e.g. mycatmiffylikesbiscuits or tallspeakerswithoutafaceplaterattle or emptyhandlebeerglasshasfoam ...

No. The key word in the comment you replied to was "random". "mycatmiffylikesbiscuits" is a pretty terrible password.

How so? Assuming about 100,000 common words in the English language, with a five word phrase aren't you talking about 10000000000000000000000000 combinations for a dictionary attack to churn through? Even if you narrow it down to phrases that make grammatical sense (which certainly isn't a trivial thing to do algorithmically), you're still talking pretty astronomical numbers, and that doesn't account for the large increase in the corpus that would be needed for an attack that could include a name like "miffy" in its attempts.
Post reply on HN