Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Huge attack on WordPress sites could spawn never-before-seen super botnet

arstechnica.com

Post reply on HN
Print view View original

81–86 of 86 posts

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#81

Post by jacques_chester »

pbogdan wrote: post #77
jacques_chester wrote: post #47

Earlier quoted context omitted.

It has been consistent, all right. Consistently terrible. For years. Every time I duck under the hood to debug something I always come away stunned and disturbed by the frequent use of globals, the frequent interleaving of different concerns and basically the all-round untraceability of the design as soon as themes or plugins are added. It's horrid. Oh! And there are still no unit or functional tests. And no concept…

Not sure of the quality of it but Wordpress does have automated test suite: http://make.wordpress.org/core/handbook/automated-testing/ https://unit-tests.svn.wordpress.org/trunk . Do you have any experience with those?

Well I am happy to eat my hat on this one, with a side of crow.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#82

Post by jakejake »

jacques_chester wrote: post #47
jakejake wrote: post #45

Earlier quoted context omitted.

I actually find Wordpress to be much lighter and cleaner than many other CMS systems. It's impressive to me that the code is relatively consistent despite going through years of iterations. I also find the plugin mechanics of Wordpress to be simple to understand. It's got plenty of room for improvement but I think it's got a lot of good qualities too.

It has been consistent, all right. Consistently terrible. For years. Every time I duck under the hood to debug something I always come away stunned and disturbed by the frequent use of globals, the frequent interleaving of different concerns and basically the all-round untraceability of the design as soon as themes or plugins are added. It's horrid. Oh! And there are still no unit or functional tests. And no concept…

Well the entire style of WordPress uses the global namespace for everything so you do have to get over that shock. But, once you do there's a kinda simplicity to the whole thing. That's my impression anyway.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#83

Post by NuZZ »

WA wrote: post #52
NuZZ wrote: post #42

Earlier quoted context omitted.

Or just generate random 15+ character passwords for admin accounts. From the article it appears the concern is from brute forcing "admin" account passwords. Good luck bruting MT#r!}A1(hIQ4^pC*7`K.KGiL\&[A\k#TUC4R<R?

Good luck typing that without a password manager ;)

I dont think it's practical to rely on memory for passwords anymore. If it's a site you really couldnt give a damn about, then sure, as long as you're okay with whatever information you submit being potentially linked to that password and to any other information.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#84

Post by uptown »

dadum wrote: post #28
uptown wrote: post #3

Rate-limiting login attempts out-of-the-box is something Wordpress should have included a LONG time ago. Maybe 1% of installs will setup the plugin to do this. No idea why they haven't added this yet.

Unfortunately it doesn't look like that would do any good here. With over 200k different botnet controlled machines, all that tracking the IP sources would do here is create massive blocklists. There's already evidance growing that the botnet is trying 2-3 passwords per source IP - effectively bypassing existing limiting plugins. A solution to the above is to limit the logins per account per timeframe, but that just…

I get what you're saying but if the default setup were to rate-limit per-account logins, there'd be little reason for these botnets to do what they're doing. They don't want to block admin access to their CMS. They want to have actual access. Effective rate-limiting per-account would kill the effectiveness of their efforts.

Re: Huge attack on WordPress sites could spawn never-before-seen super botnet

#85

Post by WA »

johnpowell wrote: post #54
WA wrote: post #52

Earlier quoted context omitted.

Good luck typing that without a password manager ;)

I just use a text file on my computers desktop and a usb thumb drive. I don't note what the password is for. So my Amazon password is something like dkwjRw#4camzR4% 7hjfgde lsdshWE

And how do you solve that if you want to log in to amazon form your computer and from your mobile phone?
Post reply on HN