Mass WordPress Brute Force Attacks? – Myth or Reality

46 comments

1. So is there any solution how to stop the brute force attempts?

   1. There are several ways that you could stop these wordpress plugins. Firewalls or modsecurity as mentioned in the post, you can install wordpress plugins such as stealth login page, limit login attempts, wordfence. You could also use .htaccess to limit access to the wp-login and wp-admin pages to only ip addresses that need to be connecting to it.

   2. Block them.
      Or limit maximum login attempts in a time period using a plugin.

      1. Limit Login Attempts will not work – they are using far too many IPs, usually one login per IP per account. Best way is to .htaccess block attempts to POST to wp-login.php without the HTTP_REFERER being your domain.

         1. Makes sense, overlooked that.

   3. moving the location of your login is the best option. use Better WP Security to make that easy.

      1. I think you can just nest your wp-admin subdirectory an extra level deep, like yoursite.com/foo/wp-admin/.

         1. If you use Better WP Security you can make it yoursite.com/admin-area-that-no-one-will-ever-guess . It uses mod_rewrite to mask the true location and denies direct access to the true wp-admin location.

2. Really odd with the passwords that are clearly generated strings like ‘aethAEHBAEGBAEGEE%’..

   At first I suspected that these could be example passwords used in the WordPress Codex or posted publicly somewhere, but a Google search yields nothing except this post.

   Don’t you just hate that feeling.. that they may know something you don’t.

   1. Wild assed guess, these are hashes or strings used by things like ManageWP and InfiniteWP. I’ve never been exactly clear how those worked but they look vaguely close. Again, wild guess, not saying I know that’s what they are, but I might play around later today to see.

   2. Perhaps they are attempts at SQL injection?

3. My host just shut down access all together. I am now getting a 403 error when attempting to log in. Is that a common practice? Seems reasonable to me as long as it clears up soon. Thanks for the info!

   1. Change hosts!

      1. That would be the nuclear option, but it is a good tactic if they are having to choose between that or the server crashing. We had to use that on 1 to 2 of the servers being heavily attacked for a 6 hour period while we wrote and tested a series of new fixes / defenses as the attack evolved. It’s a good short term fix.

4. Even if you limit wp login, there is xmlrpc

   1. You’re absolutely right, in our CloudProxy, we point out xmlrpc specifically in addition to wp-admin. 🙂

   2. Better WP Security plugin has an option to turn off xmlrpc

5. Once your in their sights its more likely apache will fail than them brute forcing your login. Even if you shut down your login pages. Your IP will be passed across the botnet and you will be down till the attack is over.

6. Please note they are now rotating the username including words without “admin” or anything similar in them.

   One of the best things to do is use .htaccess to make sure the HTTP_REFERER is actually your site before allowing access to wp-login.php.

   The worst part is that these attacks have been very successful, compromising at least 10% of the accounts they are hitting.

   If you have been attacked (in other words, if you have a WordPress site), follow this article to clean up and secure the site:

   http://calladeveloper.blogspot.com/2013/04/global-wordpress-brute-force-attacks.html

   1. You’ve spammed that link on every blog post discussing this, yet your link contains pretty much nothing of value asides from “change your password and if you don’t know how to review your code, call us!”.

   2. HTTP_REFERER can be faked actually. So you’ll have to add another layer of security probably

7. Hi,

   You said using ModSecuity? is there any resource you can point to? I have Config Server Firewall that blocks IP’s that login to server related things like cPanel, FTP, etc. but not WordPress.

   1. I wrote a basic guide here on how to get started with mod_security and WordPress it’s a bit dated but gives a general overview. http://wpsecure.net/2012/01/using-mod_security-2-with-wordpress/

8. I am also seeing these on my self-hosted WordPress site. Digest authentication in front of the WP login page + OSSEC = FAIL. 🙂

9. One of the servers I manage has been dealing with this problem, so I wrote up a checklist for securing WordPress …which includes installing the Securi plugin http://www.transcendevelopment.com/web-design-news/wordpress-can-make-such-a-word-mess-how-to-secure-it/ glad to say we’re doing much better now, with a large amount of gratitude to Securi’s fine work.

10. I just tried to log into a site I manage and got this message: “WordPress administrator area access disabled temporarily due to widespread brute force attacks.” Anyone else getting this?

    1. GoDaddy did this (one of my clients sites), but they didn’t provide that notification. That’s nice!

11. Facebook Hacked, Claims – No Evidence of User Data Compromised
    http://topworldwidestories.blogspot.com/2013/02/facebook-hacked-claims-no-evidence-of.html

12. Does anyone have any info on what a install after a successful login looks like? Are they installing plugins or modifying code? Can anyone share something to look for to identify compromised installs?

13. All good and well, but the hosting companies do not seem to get it right either to counter this. My login gets disabled when subscriber activity is up who are logging in. When I do a a 302 redirect 15 minutes later I can login, so the bits are clicking on the homepage intead of using xxx.com/wp-login.php This shows that there is no bot activity, neither was an increased activity registered by google analytics.

14. “chmod 0 wp-login.php wp-admin” does the trick for me until I catched up on the big picture.

    1. 0 being a zero

15. I am thinking the long strang password attempts are to access accounts that have previously been taken control of by this or another botnet.

16. Dumped a list of offending ip addresses to Pastebin for anyone who is digging into this… http://pastebin.com/eCjGyyBR

17. A very smart and powerful response is to set up Apache password for wp-login.php and wp-admin/ directory. Do this in the .htaccess file.

18. NO Myth, I run limit login plugin and I was receiving emails all day about attempts. I installed an admin login page reroute and the emails stopped. Banned the ip’s and keep a close watch. SO far so good.

19. My site has documented three attempts to break in and has locked out all three IP addresses. Should I be reporting these IPs somewhere?

    1. The FBI and CIA… The White House should be the last resort! (facepalm)

20. To really safeguard WordPress, it’s best to have lockout plugins, cloudflare-type CDN and very strong password
    for the admin role. I wrote an article about the method I use to create
    very strong passwords you’ll remember, read here
    http://www.inscribd.com/how-to-create-an-unhackable-password-youll-remember/

    Hope this helps

21. How can we change our usernames from ‘admin’ to something else?

    1. Create a new admin user (you will have to use different email address), log out of WordPress, log in as the new user, delete the old “admin” user, make the new user the author of all the old posts (WordPress will ask you to do this when you attempt to delete the old user), go into your settings and change your email address back to the old admin email addresses. Done.

       1. Actually there are plugins voor wordpress that you can install that will allow you to change the adminstrator password, without having to create a new one and deleting the old.

          Admin renamer extended is an example that I use, but there might be more.

          1. You can change administrator’s password without plugin too but the idea behind is to delete user with id=1.

       2. I also inlcluded a captcha plugin which ads an extra layer of security. Of course nothing is foolproof, but everything that makes it harder to crack your site helps, doesn’t it?

22. solved with:
    iptables -I INPUT -m string –algo bm –string “wp-login” -j DROP

    result:

    2480 957K DROP all — any any anywhere anywhere STRING match “wp-login” ALGO name bm TO 65535

23. Is there any way to
    limit attempts to login within “Sucuri Security” standard version or do I still
    have to use the plug-in “Limit Login Attempts” in addition?

Comments are closed.