As a popular way to create blogs, news portals and corporate sites, the WordPress content-management software is naturally a focus of attackers. But attackers ratcheted up the malicious attention last week when they launched a large password-guessing effort to compromise WordPress-powered sites.
The attack, fueled by a botnet of home computers, seeks out Websites and blogs that use the default “admin” user name and that may have generally weak passwords, according to a description of the attack posted on Web-security firm CloudFlare’s blog. The attack software attempts to log into a targeted Website’s administration panel using the user name “admin” and thousands of popular passwords.
While the attack may only succeed a small percentage of the time, the attack could result in hundreds or thousands of compromised servers when averaged over tens of thousands of sites powered by WordPress software.
“One of the concerns of an attack like this is that the attacker is using a relatively weak botnet of home PCs in order to build a much larger botnet of beefy servers in preparation for a future attack,” Matthew Prince, CEO of CloudFlare, stated in the blog post. “These larger machines can cause much more damage in DDoS attacks because the servers have large network connections and are capable of generating significant amounts of traffic.”
For at least a year, attackers have used servers compromised through their content-management software—such as WordPress and Joomla—to level distributed denial-of-service (DDoS) attacks against financial institutions and companies in other industries. Alleged hacktivists, known as the al Qassam Cyber Fighters, have targeted financial institutions since September, inundating the victims with tens of gigabits per second of traffic and specially crafted requests designed to tie up or crash the targeted servers.
While run-of-the-mill DDoS attacks have used tens of thousands of compromised consumer PCs to overwhelm a targeted server, the latest attacks stand out because they use a relatively low number—hundreds, or perhaps, thousands—of servers to do the same job.
While the attack may be having some success, WordPress founder Matt Mullenweg stressed in a blog post that the threat was mostly overblown and, if WordPress administrators use a unique user name and strong password, they should not be vulnerable.
“If you still use ‘admin’ as a user name on your blog, change it, use a strong password, if you’re on WP.com, turn on two-factor authentication, and of course make sure you’re up-to-date on the latest version of WordPress,” Mullenweg wrote on his blog. “Do this, and you’ll be ahead of 99 percent of sites out there and probably never have a problem.”
A comment to the post warned users that similar attacks had employed other user names, not just “admin.” The most common include aaa, adm, admin, admin1, administrator, manager, qwerty, root, support, test and user.
CloudFlare has updated both its paid and free services to block these specific brute-force attacks against WordPress sites.