More threads by djbaxter


Jun 28, 2012
Reaction score
WordPress blogs and more under global attack - check your passwords now!
by Paul Ducklin,
April 13, 2013

If you have a web service that supports remote users, you will know that malevolent login attempts are an everyday occurrence.

Even on my own home-hosted SSH server, listening unassumingly on an IP number on a DSL line, I've seen thousands of login attempts from dozens of different IP numbers in the course of a single day.

But hosting providers worldwide are reporting that they've been seeing systematic attempts, over the last 48 hours or so, to breach blogs and content management systems (CMSes) at well above average levels.

The primary target seems to be WordPress, with Joomla users also reportedly getting a bit of a hammering.

Word from the anti-DDoS world is that a botnet is responsible, with estimates of "up to 90,000," "more than tens of thousands," and "up to 100,000" infected computers (all those figures can be true at the same time, of course) orchestrating the felonious login attempts.

Since it would take too long to try every possible username and password on every known WordPress or Joomla server, this onslaught is using what is known as a dictionary attack.

That's where a crook settles on a list of the most likely usernames and passwords, and tries those in quick succession.

The idea is simple: automate the password guessing, speed up the attack, and don't spend too long on any individual site.

Look for the low-hanging fruit, and harvest it as quickly as you can; if you can't get in within a few hundred or thousand attempts, move on to the next potential victim.

It's doorknob rattling, but on an industrial and international scale.

I have taken a few steps to further protect my clients' WordPress sites (including my own):

1. Get everyone on CloudFlare (they offer a free service!)
2. Install the "limit attempted logins" plugin
3. Install an old plugin I had that creates a captcha system on the WordPress login page

Also, as a standard practice I have always used a very uncommon username and a strong password for the login page. As the article states, avoid usernames like "admin" or "test." I usually use the business owner's name as the username: John Smith.

Travis Van Slooten

Login / Register

Already a member?   LOG IN
Not a member yet?   REGISTER

LocalU Event


Trending: Most Viewed

  Promoted Posts

New advertising option: A review of your product or service posted by a Sterling Sky employee. This will also be shared on the Sterling Sky & LSF Twitter accounts, our Facebook group, LinkedIn, and both newsletters. More...
Top Bottom