[NEWS] Wordpress blogs under attack - Beware!

[Gogol]

I received an warning from my hosting provider 15 minutes ago. Wordpress blogs are under a global brute-forcing attack. You are advised to change the passwords with something really strong. Install some security plugins too if possible (I opened a thread on wordpress security some days ago. Search for it).

More resources :
http://www.hostdime.com/blog/2013/04/brute-force-attack-affecting-global-wordpress-installations/
http://blog.sucuri.net/2013/04/protecting-against-wordpress-brute-force-attacks.html

 

[innozemec]

thanks for the heads up!

WP is always under attack though

 

[kappa84]

Got the same email when I think doing changes on around 100 wp blogs i get a big headache!

 

[ezines]

I've got mine hacked already, and my hosting restore it. Fortunately, the hacked websites are not the primary money-generating sites. Even my cPanel got password changed. I was not able to accessed it. Now, everything back to normal.

 

[Paranoid Android]

wp is always under attack and the stupid plugins never do much to protect you.

Is there a brute force plugin for wordpress? Logins blocked for 20 minutes if the 3rd or 5th attempt is wrong?

 

[Gogol]

This one seems to be a combined one. I am already safe though ;-)

thanks for the heads up!

WP is always under attack though

Best way is to set it up right at the first time. Your time would have been saved now

Got the same email when I think doing changes on around 100 wp blogs i get a big headache!

Sad to hear that. I hope everything is secure now

I've got mine hacked already, and my hosting restore it. Fortunately, the hacked websites are not the primary money-generating sites. Even my cPanel got password changed. I was not able to accessed it. Now, everything back to normal.

Yes there is! Try "limit login attempt" / "Login Lock Down"

wp is always under attack and the stupid plugins never do much to protect you.

Is there a brute force plugin for wordpress? Logins blocked for 20 minutes if the 3rd or 5th attempt is wrong?

 

[WebmasterDeluxe]

This was posted yesterday:

http://www.blackhatworld.com/blackh...ad-wordpress-brute-hack-attack-suspected.html

 

[Gogol]

Good to see that. I posted this because I had received an warning from my host. I can't tell you about that thread sorry

This was posted yesterday:

http://www.blackhatworld.com/blackh...ad-wordpress-brute-hack-attack-suspected.html

 

[ID Internet Marketer]

Is there a brute force plugin for wordpress? Logins blocked for 20 minutes if the 3rd or 5th attempt is wrong?

try limit login attempts plugin.

 

[HatSwitcher]

Like there weren't attacks before. If this is something to force you to protect your site what were you doing until now. You just need limit login attempts plugin installed and configured to be safe from brute force.

 

[mazgalici]

I don't know why wordpress doesn't have those plugins enabled by default...

 

[Gogol]

Well may be we can request those features to be included in in the upcoming versions. I think we are soon going to see a Login Captcha by default. Wait for that

I don't know why wordpress doesn't have those plugins enabled by default...

 

[viralking]

yeah this started yesterday morning

 

[alaltaierii]

try limit login attempts plugin.

The plugin was updated last time 2012-6-1. Do you know a similar plugin up to date ?

 

[stayliquid]

I use limited login attempts.

wp is always under attack and the stupid plugins never do much to protect you.

Is there a brute force plugin for wordpress? Logins blocked for 20 minutes if the 3rd or 5th attempt is wrong?

 

[Gogol]

Should not matter. Login Lock down is even older(m talkin bout last modified date), but works well too..

The plugin was updated last time 2012-6-1. Do you know a similar plugin up to date ?

 

[seochargers]

Mine looks safe.

 

[kvmcable]

Anyone that has a plugin that blocks an IP for so many minutes after x number of failed logins should be fine.

This is news because many hosts don't have protection in place for a flood protection or connection tracking. This recent wave is taking down servers because of high server loads. Especially on shared network hosts.

I didn't have one of my servers set up with connection tracking and sure enough a couple days ago I started receiving emails showing high server loads. I looked at the Apache log and saw IPs hitting WP sites with 100 login attempts in less than a minute.

These hackers are a little smarter (or dumber, depending on your viewpoint) and not using a block of IPs on one site which would trigger most flood protection mechanisms on servers these days. They're hitting a WP site with just a single IP hammering the login page so connection tracking on the server needs enabled that monitors each IP that visits the server.

Once you enable connection tracking these attacks are dead in the water. I have mine set to 8 hits a second before they're blocked and that put an end to them. Then are now banned before they get started and the server suffers almost no load from these attacks.

I know most of this is nonsense to those running WP on shared hosts but I typed it for those running dedis so they know what is going on and how to stop the high server load attacks. (well at least one way).

The hosts are mostly sending the notices to let customers know why their sites are going offline or running very slowly. The hosts should be blocking these brute force attacks by banning IPs that are abusing the server.

 

[Gogol]

Awesome reply I must say. I do have a lot of WP sites in shared hosting, but godaddy is hosting all of them. So, I feel they will do something about the flood for sure.

Do you suggest using Cloudflare by the way?

Anyone that has a plugin that blocks an IP for so many minutes after x number of failed logins should be fine.

This is news because many hosts don't have protection in place for a flood protection or connection tracking. This recent wave is taking down servers because of high server loads. Especially on shared network hosts.

I didn't have one of my servers set up with connection tracking and sure enough a couple days ago I started receiving emails showing high server loads. I looked at the Apache log and saw IPs hitting WP sites with 100 login attempts in less than a minute.

These hackers are a little smarter (or dumber, depending on your viewpoint) and not using a block of IPs on one site which would trigger most flood protection mechanisms on servers these days. They're hitting a WP site with just a single IP hammering the login page so connection tracking on the server needs enabled that monitors each IP that visits the server.

Once you enable connection tracking these attacks are dead in the water. I have mine set to 8 hits a second before they're blocked and that put an end to them. Then are now banned before they get started and the server suffers almost no load from these attacks.

I know most of this is nonsense to those running WP on shared hosts but I typed it for those running dedis so they know what is going on and how to stop the high server load attacks. (well at least one way).

The hosts are mostly sending the notices to let customers know why their sites are going offline or running very slowly. The hosts should be blocking these brute force attacks by banning IPs that are abusing the server.

 

[kvmcable]

Awesome reply I must say. I do have a lot of WP sites in shared hosting, but godaddy is hosting all of them. So, I feel they will do something about the flood for sure.

Do you suggest using Cloudflare by the way?

It depends on your business plan. Mine involves a lot of websites and a small hosting company for local clients. So for me it was better to learn server management and maintenance. Some people wouldn't have the same requirement so the learning curve might not be a wise investment. For them good managed hosting (very few offer this BTW) is more practical.