WordPress Sites Under Massive Password-Guessing Attack
A Web-security firm warns that attackers are likely building a botnet of WordPress servers to support future distributed denial-of-service attacks.As a popular way to create blogs, news portals and corporate sites, the WordPress content-management software is naturally a focus of attackers. But attackers ratcheted up the malicious attention last week when they launched a large password-guessing effort to compromise WordPress-powered sites. The attack, fueled by a botnet of home computers, seeks out Websites and blogs that use the default "admin" user name and that may have generally weak passwords, according to a description of the attack posted on Web-security firm CloudFlare's blog. The attack software attempts to log into a targeted Website's administration panel using the user name "admin" and thousands of popular passwords. While the attack may only succeed a small percentage of the time, the attack could result in hundreds or thousands of compromised servers when averaged over tens of thousands of sites powered by WordPress software. "One of the concerns of an attack like this is that the attacker is using a relatively weak botnet of home PCs in order to build a much larger botnet of beefy servers in preparation for a future attack," Matthew Prince, CEO of CloudFlare, stated in the blog post. "These larger machines can cause much more damage in DDoS attacks because the servers have large network connections and are capable of generating significant amounts of traffic."
For at least a year, attackers have used servers compromised through their content-management software—such as WordPress and Joomla—to level distributed denial-of-service (DDoS) attacks against financial institutions and companies in other industries. Alleged hacktivists, known as the al Qassam Cyber Fighters, have targeted financial institutions since September, inundating the victims with tens of gigabits per second of traffic and specially crafted requests designed to tie up or crash the targeted servers.