Image: CloudFlare
If your WordPress admin pages suddenly become sluggish, unreachable or you?re unable to log in there?s a good chance your site is being attacked.
According to CloudFlare CEO Matthew Prince, the attack is using brute force against WordPress? admin pages using the old default username ?admin? and then trying thousands of passwords. There?s nothing new about that approach, but what makes this attack different, and particularly potent, is that the attackers have some 90,000 unique IP addresses at their disposal.
For its part CloudFlare has pushed out an update that ?detects the signature of the attack and stops it.?
Popular WordPress Host HostGator reports that it too has ?seen over 90,000 IP addresses involved in this attack.?
WordPress creator Matt Mullenweg has also weighed in, pointing out that it?s been over three years since WordPress used the username ?admin? as the default for new installations.
However, there are no doubt a great many sites that still have ? whether they use it or not ? the ?admin? user account hanging around in WordPress. It?s also worth noting that, while this attack appears limited to trying the ?admin? username, a more sophisticated approach could do the same thing, but with unique usernames ? for example, find the most frequently used account name on the public site, assume it?s an admin account and run the same attack against the admin pages. So far that hasn?t happened.
?Here?s what I would recommend,? writes Mullenweg on his blog, ?if you still use ?admin? as a username on your blog, change it, use a strong password, if you?re on WP.com turn on two-factor authentication, and of course make sure you?re up to date on the latest version of WordPress.?
Unfortunately, given the number of IP addresses that seem to be at the attackers? disposal, other common security measures ? like tools that limit logins by IP address ? aren?t going to be terribly effective against this attack. Short of getting rid of the default ?admin? account (if it still exists), there isn?t a whole lot you can do to stop the attacks (unless you want to use a web application firewall like CloudFlare or ModSecurity). Be sure to contact your hosting company if you think your site has come under attack.
No comments:
Post a Comment