Wordpress botnet - dont panic :-)

If you've not already seen about the current wordpress/joomla botnet --- you need to lock your sites down!

Theres been some good threads here recently: see "securing wordpress"

Read about it here: http://www.slashgear.com/wordpress-sites-targeted-by-mass-brute-force-botnet-attacks-13277728/

As well, there's a good hacker news discussion thats worth following imo: https://news.ycombinator.com/item?id=5542203

Beam me up scotty
http://www.youtube.com/watch?v=hShY6xZWVGE

We've been getting a lot of these, but we're fighting back. Brute force attacks is why we're encouraging our clients to switch to CloudFlare - helps a lot against these + speeds up their sites.

I read somewhere these hackers are only interested in using their servers. I wonder if this is their attempt to mine botcoins?

Seems to be only dictionary attacks not brute.

I'm hoping that the Word Fence plugin with logins limited will keep the buggers out. Have to start looking as obfuscating WP's footprints.

I hope that will not affect too many sites.

of course it is

sn0rt said:

I read somewhere these hackers are only interested in using their servers. I wonder if this is their attempt to mine botcoins?

Click to expand...

I am sorry but that is just stupid to think they would use them for mining bitcoins. There are far more profitable things you can do with a hacks server.
Lets see...
You can use it for browser exploit traffic(these installs can be used for bitcoin, but highly doubt it)
You can use it to put links on hacked websites on the footer location of the websites, sape links anyone?
Depending on the speed of the server, it can be a nice addition to a bigger network of servers for DDosing.
Redirect traffic, replace your affiliate links , javascript, even adsense. Just these alone would make you atleast 500-1k times more than mining for bitcoins.


Besides, cpu mining is around 400-1000 much slower than mining with a GPU. How many servers do you know that have GPU on them? None because, it would be stupid and inneficient to do that, they don't need graphics but more RAM. Why do you think you never see the type of graphics (if any) when your buying or renting a server on the specs list.However, you do see cpu speed, cores, ram, storage and there is a reason for that.

The most profitable way to mine for bitcoin is very simple, go spread some hacks, keygens and get those gamers that half the brain of a peanut and will download any hacks,keygens, maps etc about their [INSERT GAME HERE] . These kids have the high-end computers with all those nice graphic cards, guess what? One of these kids would mine a lot faster than a hacked server.

So who ever thinks they are using servers to mine for bitcoins, either has no idea how bitcoins work, how long it takes to mine them, what you need to use to mine them. Or is just simply making a very uneducated guess based on a lot of uninformed people around here.

RMX said:

We've been getting a lot of these, but we're fighting back. Brute force attacks is why we're encouraging our clients to switch to CloudFlare - helps a lot against these + speeds up their sites.

Click to expand...

I received your mail about cloudflare. Have started using their services.

Maybe this is an opportunity for hosting companies to promote Cloudflare for more revenue?

I studied the attacks 3 days ago when we first saw them and it took us 30 minutes to shut them across our network. If your host can't put an end to this simple attack then you need a different host. You don't need to pay for cloud hosting to accommodate worthless hacker traffic. You need a host that can shut any IP down that hammers your site more than 10 times a second. This attack was child's play compared to a real DDOS attack.

For the person that say this is a dictionary attack and not a brute force attack; brute force attacks are scripts that quickly try logins typically using dictionary lists first and working their way through dictionary+numeric and so on. These are brute force attacks and they probably are working with dictionary lists.

lock your wp login with strong htaccess pass aaaaaand they are gone