Huge attack on WordPress sites could spawn never-before-seen super botnet • Hacker News Board

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#61

Post by pdkp » Sat, Apr 13, 2013, 1:06 PM UTC

francescolaffi wrote: post #46

lenazegher wrote: post #39

Earlier quoted context omitted.

I've not heard of the problem of a user with id #1 before, can you explain please? What's the issue with a user id #1 when the username is not admin?

if user #1 is still an admin but with a different name you can just go to wpurl/?author=1 and if url rewriting is enabled you'll be redirected to wpurl/author/nicename and nicename is usually equal to the username

I don't think this adds the layer of security you think it does, merely a minor bit of obscurity. In context of the specific vector you reference, author={$user_id}, it probably doesn't do anything at all to protect you.

Not that there is anything wrong with adding a bit of obscurity, not using 'admin' as a username and using a non-privileged author for posts can go a long way.

However, if you are worried about someone getting your username from "author={$user_id}," using a user_id of 2,3,4,5, ect, probably isn't going to protect you. I think you are incorrectly assuming that the person that would use this method to get a username is going to stop if they get a 404 at #1(or even after just a single attempt.)

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#62

Post by sikhnerd » Sat, Apr 13, 2013, 1:37 PM UTC

It's actually two separate, but extremely similar attacks. One is exactly as described in the article, fairly distributed dictionary attack with user admin against wp-login.php. The second one is slightly more advanced, much much more distributed and I've seen it go for Joomla and wordpress, trying common usernames at times (though generally sticking to administrator/admin) and going through what appears to be a dictionary of about 3000 passwords. The bigger issue is these are coming in so fast and from so many directions, on resource constrained machines this is essentially ending up like a DDoS, which has a lot of ancillary effects. mod_sec and other similar methods of identifying these incoming before hitting apache and spawning a php thread are proving to be very much not enough.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#63

Post by infinity » Sat, Apr 13, 2013, 1:59 PM UTC

OGC wrote: post #56

infinity wrote: post #49

I write all (futile) login attempts on my site to a log file. I can confirm this rise in password bruteforcing attempts during the last days. This is what the bruteforce passwords look like, these tried to login as "admin": [Sat Apr 13 05:30:31 2013] nevalidniipass [Sat Apr 13 05:30:34 2013] gfhjkm [Sat Apr 13 05:30:37 2013] gggggggg [Sat Apr 13 05:30:39 2013] ghbdtn [Sat Apr 13 05:30:41 2013] ghgftmn6 [Sat Apr 13 05…

nitpick: that's a dictionary attack, not brute-force

Yes, of course you're right, my mistake. Mainly I wanted to share some information and give examples of passwords.

Here are some more observations which I made during the last months:

Most of the time it seems that the attackers are using a list of popular passwords, the same passwords appear over and over again: 12345, qwerty, 1q2w3e4r, and so on.

Most of the time they try to login as "admin", "Admin", "administrator", "root" or the name of the domain or blog or a part of that name, for example omitting a ".com".

In the HTTP requests, the parameters "log" (for the user name) and "pwd" (for the password) are always transmitted, but the parameters "wp-submit=Log In" and "testcookie=1" are not always transmitted.

Many of these attacks do not transmit a user-agent field in the HTTP headers. Blocking the empty user-agent seems like a good idea to me.

These attacks look simple, but I guess that they are successful on a big number of sites.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#64

Post by desbest » Sat, Apr 13, 2013, 2:05 PM UTC

Just get the Login Lockdown plugin and install it.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#65

Post by didip » Sat, Apr 13, 2013, 2:21 PM UTC

GabrielF00 wrote: post #41

modernerd wrote: post #32

Use a two-factor auth plugin like https://wordpress.org/extend/plugins/google-authenticator/ It works with the Google Authenticator app. Duo Security is also good: http://wordpress.org/extend/plugins/duo-wordpress/ The WordPress.com team have already announced two-factor auth support for wp.com blogs, and are working on an official solution for wp.org sites: http://macmanx.com/2013/04/12/two-step-authentication-on-wo…

One problem is that WordPrss sites are often built by small web designers for clients with limited computer skills and very little patience for complex passwords, much less two-factor authentication. For 2/3 of the WordPress sites I administer, I use a very long, complex admin password. The other site is for a group that wanted multiple admin accounts, but the people who use these accounts have a lot of trouble with…

I try to educate using [XKCD style password](http://xkcd.com/936/) to mainstream people. So far, they seemed to get it.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#66

Post by chii » Sat, Apr 13, 2013, 2:31 PM UTC

danenania wrote: post #60

ZoFreX wrote: post #58

Earlier quoted context omitted.

No. The key word in the comment you replied to was "random". "mycatmiffylikesbiscuits" is a pretty terrible password.

How so? Assuming about 100,000 common words in the English language, with a five word phrase aren't you talking about 10000000000000000000000000 combinations for a dictionary attack to churn through? Even if you narrow it down to phrases that make grammatical sense (which certainly isn't a trivial thing to do algorithmically), you're still talking pretty astronomical numbers, and that doesn't account for the large in…

But if the attacker knew with good probability that your passphrase is a valid sentence, they'd have ways to eliminate incorrect sentences, and so reduce the search space a bit (or a bit more, depending on how clever they are).

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#67

Post by ZoFreX » Sat, Apr 13, 2013, 2:42 PM UTC

danenania wrote: post #60

ZoFreX wrote: post #58

Earlier quoted context omitted.

No. The key word in the comment you replied to was "random". "mycatmiffylikesbiscuits" is a pretty terrible password.

How so? Assuming about 100,000 common words in the English language, with a five word phrase aren't you talking about 10000000000000000000000000 combinations for a dictionary attack to churn through? Even if you narrow it down to phrases that make grammatical sense (which certainly isn't a trivial thing to do algorithmically), you're still talking pretty astronomical numbers, and that doesn't account for the large in…

Have you ever used SwiftKey or Swype on Android? Vaguely the same principles apply here. It actually wouldn't be hard to generate passphrases where you try the most "predictable" phrases first. E.g. if you start your brute-forcing at "my cat" you would try "my cat likes" a long time before you tried "my cat algorithmically".

Also, 100,000 common words is a bit more than you would need. If people are plucking words from their heads, rather than rolling dice and picking from a list, you can assume a more limited corpus and still crack a lot of passwords.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#68

Post by ajtaylor » Sat, Apr 13, 2013, 2:46 PM UTC

I've used WordPress in the past because it was easy to setup and use. However, given the consistently bad security record I'd love to try something different. Anyone have recommendations for other open source CMS's? Similar functionality to WP is enough - I don't need anything fancy.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#69

Post by Datsundere » Sat, Apr 13, 2013, 3:13 PM UTC

ZoFreX wrote: post #58

ra wrote: post #53

Earlier quoted context omitted.

Or any slightly obscure memorable phrase. e.g. mycatmiffylikesbiscuits or tallspeakerswithoutafaceplaterattle or emptyhandlebeerglasshasfoam ...

No. The key word in the comment you replied to was "random". "mycatmiffylikesbiscuits" is a pretty terrible password.

",uvsy,oggu;olrdnodvioyd" is not terrible though. If you see what I did there.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#70

Post by joshaidan » Sat, Apr 13, 2013, 3:20 PM UTC

What URL is the login requests sent to? Would changing the wp-admin directory to something random help avoid the attacks? Or does wordpress have another point of entry for authentication?