Wordpress under attack

[lilelvis2000]

I believe so. It's a botnet that's crawling all over the web looking for WordPress sites, so if it hasn't visited yet that doesn't mean it won't eventually. At the moment though all it does is try to brute-force the password for the account named "admin", so if your administrator account has a different name it won't get anywhere. Good passwords will keep it out, but the problem is if it thinks there's an account called "admin" (from the message it gets when it's rejected, I assume) it'll keep trying for ages, amounting to a massive DDOS against the site.

I noticed a massive spike on my site around 3 weeks back. Suspect it was this bot. In my case there was a spike of about 400 visits in one day. The usual number is about 150.

[lilelvis2000]

I have WP and have ditched the admin account. I also attribute the posts to another user account which has minimum capabilities.

That seems to have kept my site safe so far.

[NickFitz]

I have a number of WP sites all with hardened security. Google Analytics doesn't show unusual traffic. Is this attack still ongoing?

I believe so. It's a botnet that's crawling all over the web looking for WordPress sites, so if it hasn't visited yet that doesn't mean it won't eventually. At the moment though all it does is try to brute-force the password for the account named "admin", so if your administrator account has a different name it won't get anywhere. Good passwords will keep it out, but the problem is if it thinks there's an account called "admin" (from the message it gets when it's rejected, I assume) it'll keep trying for ages, amounting to a massive DDOS against the site.

[Cliphead]

I have a number of WP sites all with hardened security. Google Analytics doesn't show unusual traffic. Is this attack still ongoing?

[NickFitz]

One basic additional thing I've done though - and in retrospect it seemed so basic that I don't know why I didn't do it before - is to loose the "admin" user name.

This is, it seems, the single most important thing to do in the face of this attack. Here's some wisdom from Matt Mullenweg, creator of WordPress, on the matter; and an explanation of how to go about it, including the all-important step of changing attribution of existing posts so they don't disappear: Change your WordPress admin Username

Do remember to backup your database first, too

EDIT: done mine Would have gone more smoothly if I'd remembered the bit about logging out, then back in as the new administrator - turns out WordPress won't let you delete the user you're logged in as

[ThomserveBAS]

I assume like the majority of attack these day's people exploit the laziness or lack of knowledge that most people have, I am using WordPress › Better WP Security « WordPress Plugins to take the basic vulnerabilities away

Thanks for the tip about Better WP Security - I've installed it on my network of sites so hopefully improved security a little.

[Jessica@WhiteFieldTax]

I run our firms web site in WordPress.

I have an alert on bogus logins, and last week in went into overdrive Fortunately I have security plugins, including IP banning after 5 incorrect logins.

One basic additional thing I've done though - and in retrospect it seemed so basic that I don't know why I didn't do it before - is to loose the "admin" user name.

But brute force is difficult to resist. Interestingly another WP site I administer had only 1/10th the number of bogus logins. Its older, but less content and less prominent on search engines.

[administrator]

From the article:

..those responsible for this crime campaign are scanning the Internet for WordPress installations, and then attempting to log in to the administrative console at these sites using a custom list of approximately 1,000 of the most commonly-used username and password combinations.

So they are just using brute force - no new-found security flaws with WP, just bad password management.

[Sysman]

Its like the old story about Mac's not needing Anti Virus because there are less of them so they are less appealing targets for hackers etc. One vulnerability on a system with hundreds of millions of users is a better return than dozens of vulnerabilities on a system with a few thousand users.

It depends what the bad guys' aims are.

Stuxnet demonstrated that for high value or strategic systems it can be worth a lot of effort targeting relatively few systems.

[SimonMac]

Its like the old story about Mac's not needing Anti Virus because there are less of them so they are less appealing targets for hackers etc. One vulnerability on a system with hundreds of millions of users is a better return than dozens of vulnerabilities on a system with a few thousand users.

[d000hg]

Custom or less popular systems are not really any more or less secure, they're just less popular so that there is less incentive to attack them..

I think in general they are very much less secure because they don't have all the holes found and fixed, and they don't have a team continually working on them and rigourously testing the security.

[yasockie]

or get Wordpress hosted on wordpress.com or even get wordpress VIP (see qz.com as an example - they're not getting hacked, are they?)
It's an interesting thing, because WP is so popular it makes sense to attack.
Custom or less popular systems are not really any more or less secure, they're just less popular so that there is less incentive to attack them..

[SimonMac]

I assume like the majority of attack these day's people exploit the laziness or lack of knowledge that most people have, I am using WordPress › Better WP Security « WordPress Plugins to take the basic vulnerabilities away

[Sysman]

Time to check your Wordpress installations, folks.

Security experts are warning that an escalating series of online attacks designed to break into poorly-secured WordPress blogs is fueling the growth of an unusually powerful botnet currently made up of more than 90,000 Web servers.

We’re talking about Web servers, not home PCs. PCs maybe connected to the Internet with a 10 megabit or 20 megabit line, but the best hosting providers have essentially unlimited Internet bandwidth. We think they’re building an army of zombies, big servers to bombard other targets for a bigger cause down the road.”

Indeed, this was the message driven home Thursday in a blog post from Houston, Texas based HostGator, one of the largest hosting providers in the United States. The company’s data suggests that the botnet of infected WordPress installations now includes more than 90,000 compromised sites.

Brute Force Attacks Build WordPress Botnet