djbaxter
Administrator
- Joined
- Jun 28, 2012
- Messages
- 3,778
- Solutions
- 2
- Reaction score
- 1,877
WordPress blogs and more under global attack - check your passwords now!
by Paul Ducklin, Sophos.com
April 13, 2013
If you have a web service that supports remote users, you will know that malevolent login attempts are an everyday occurrence.
Even on my own home-hosted SSH server, listening unassumingly on an IP number on a DSL line, I've seen thousands of login attempts from dozens of different IP numbers in the course of a single day.
But hosting providers worldwide are reporting that they've been seeing systematic attempts, over the last 48 hours or so, to breach blogs and content management systems (CMSes) at well above average levels.
The primary target seems to be WordPress, with Joomla users also reportedly getting a bit of a hammering.
Word from the anti-DDoS world is that a botnet is responsible, with estimates of "up to 90,000," "more than tens of thousands," and "up to 100,000" infected computers (all those figures can be true at the same time, of course) orchestrating the felonious login attempts.
Since it would take too long to try every possible username and password on every known WordPress or Joomla server, this onslaught is using what is known as a dictionary attack.
That's where a crook settles on a list of the most likely usernames and passwords, and tries those in quick succession.
The idea is simple: automate the password guessing, speed up the attack, and don't spend too long on any individual site.
Look for the low-hanging fruit, and harvest it as quickly as you can; if you can't get in within a few hundred or thousand attempts, move on to the next potential victim.
It's doorknob rattling, but on an industrial and international scale.
Read more...
by Paul Ducklin, Sophos.com
April 13, 2013
If you have a web service that supports remote users, you will know that malevolent login attempts are an everyday occurrence.
Even on my own home-hosted SSH server, listening unassumingly on an IP number on a DSL line, I've seen thousands of login attempts from dozens of different IP numbers in the course of a single day.
But hosting providers worldwide are reporting that they've been seeing systematic attempts, over the last 48 hours or so, to breach blogs and content management systems (CMSes) at well above average levels.
The primary target seems to be WordPress, with Joomla users also reportedly getting a bit of a hammering.
Word from the anti-DDoS world is that a botnet is responsible, with estimates of "up to 90,000," "more than tens of thousands," and "up to 100,000" infected computers (all those figures can be true at the same time, of course) orchestrating the felonious login attempts.
Since it would take too long to try every possible username and password on every known WordPress or Joomla server, this onslaught is using what is known as a dictionary attack.
That's where a crook settles on a list of the most likely usernames and passwords, and tries those in quick succession.
The idea is simple: automate the password guessing, speed up the attack, and don't spend too long on any individual site.
Look for the low-hanging fruit, and harvest it as quickly as you can; if you can't get in within a few hundred or thousand attempts, move on to the next potential victim.
It's doorknob rattling, but on an industrial and international scale.
Read more...
